[EXTERNAL EMAIL] - RE: Morning
I'll be in the lobby of 26 fed in 5 minutes — Liz, should we meet you in lobby or go to a specific floor?
Sent from my iPhone
Adding
Sent from my iPhone
I can do 430-530
Otherwise I’m free tomorrow from 9 am-3 pm, but I forget if Wednesday doesn’t work for you
Sent from my iPhone
Ok, but I have a hard stop at 4, so can we start right at 3?
Things we learned today, thank you for clarifying:
- On one of the harddrives you've populated for us, this is the breakdown.
EFTA01659718
| Report | Folder / Backup Type | Child files (visible) | Group (annotation) |
|---|---|---|---|
| report small D_b38 (r) | Apple iCloud (Backup) (r) | AccountPackage (r); CellebriteReader.exe (r); Apple iCloud (Backup)_2021-11-09_Report.ufdr (r) | iCloud return |
| report small blended (r) | Apple iCloud (Backup) (r) | CellebriteReader.exe (r); Apple iCloud (Backup)_2021-11-09_Report.ufdr (r) | iCloud return |
| report D_b38 (r) | Apple iCloud (Backup) (r) | AccountPackage (r); CellebriteReader.exe (r); Apple iCloud (Backup)_2021-11-09_Report.ufdr (r) | iCloud return |
| report D_22 (r) | Apple iCloud (Backup) (r) | AccountPackage (r); CellebriteReader.exe (r); Apple iCloud (Backup)_2021-11-09_Report.ufdr (r) | iCloud return |
| report blended (r) | Apple iCloud (Backup) (r) | CellebriteReader.exe (r); Apple iCloud (Backup)_2021-11-09_Report.ufdr (r) | iCloud return |
| report IB12 (r) | EvidenceCollection (r) | EvidenceCollection_2021-11-09_Report.ufdr (r); CellebriteReader.exe (r) | Askew phone |
- The disk called "1b1 copy thumbdrive from K&L Gates 9/29/2020" is the same as 131 on the harddrive, but exported from the FTK imager. The disk version is better to give to defense.
Things that we need to tackle on Thursday, by repopulating the SDNY drive:
- the CD called "working copy of emails" that initially had on it a sticky labelled "lb8" is not 1b8. It might be 1b2. This is the contents of that cd:
| Report_Files (r) | 12/1/2020 3:53:52 PM | |
|---|---|---|
| • Autorun.inf (r) | 36 | 12/1/2020 3:53:52 PM |
| • Index.html (r) | 400 | 12/1/2020 3:53:52 PM |
| • Report.fo (r) | 79,917,625 | 12/1/2020 3:59:22 PM |
| • Report.pdf (r) | 37,566,805 | 12/1/20204:08:27 PM |
- 338 on the harddrive is in the access data file type and needs to be read by the FTK imager. Ideally we could dump that out of the program into a type that can be more easily read by defense counsel. This is the current disk contents:
| Name | Date modified | Type | Size |
|---|---|---|---|
| NYC030127.ad1 | 11/24/2020 3:45 PM | AD1 File | 16,910 KB |
| NYC030127.ad1.txt | 11/24/2020 3:46 PM | Text Document | 2 KB |
- the file called 1B9 contains the fug phone. This should NOT be produced as it is. The folder 1B9 was populated with that phone by mistake. [This also might be 1b2.] The true contents of 1B9 has to be re-pulled across from the original- from the folder called "Report" from 2/5/21, last updated at 10:01
questions in blue:
| 1b5 | Just pertinent, |
| 1b6 | Screenshots, not a phone extraction |
| 1b7 | Just pertinent, |
| 1b8 | Is this just pertinent? |
| 1b9 | [needs help] |
| 1b10 | Just pertinent, |
EFTA01659719
1b12: Is this just pertinent?, Askew phone
this is the music I referred to throughout this afternoon:
https://www.youtube.com/watch?v=LkZM4dk0RQs&t=964s
skip to 16:14 "standby to reckon up your battleships"
Hi all,
am completely open any time after 2 tomorrow, or I can make a time in the morning work.
Please let me know what you all are thinking.
Thank you,
Hello, just trying to figure out tomorrow. Thank you.