RE: 90A-NY-3151227 (Epstein) --- UNCLASSIFIED
Classification: UNCLASSIFIED
I am a CART Examiner at Quantico and have received items for case 90A-NY-3151227 (Epstein).
From what I understand videos have been recovered from DVR 1 and my immediate focus here will be on DVR 2. Some of the drives for DVR 2 are under repair. Once those are complete we will be attempting to reassemble the disks and hopefully gain access to the data.
I will keep you posted on progress.
The image contains multiple instances of the text "Classification: UNCLASSIFIED". There is also a black rectangle at the top of the image, the content of which is not visible.
EFTA00075831
Classification: UNCLASSIFIED
Can you please request the password for the Administrator account on the main server controller (Dell PowerEdge R420)?
We have DVR 1 up and it appears to see the disk array but we are determining access. We have DVR 2 up but it is not currently seeing the disk array. We are working on the connection.
We'd like to have the Administrator password from the main controller to get a full picture.
Thanks,
Classification: UNCLASSIFIED
Working on it. Hope to have the password by the end of the day.
FBI New York | Squad C-19
Classification: UNCLASSIFIED
Current status:
All systems are powered up using clones of the original disks.
DVR Main Controller —The Administrator password is needed to gain access. Matt is working on it.
DVR 1 System — This is up and running. The disk array appears to have assembled but we need access to the DVR Main Controller for visibility.
DVR 2 System — This is our priority and is currently problematic. The system is up, but the disk array is NOT assembling. It appears the configuration of these 16 disks in the array has been lost (likely from being pulled out of the system live). 3 of the disks had to undergo repair before being useable. We will have to attempt to reassemble this array manually (if possible). Typically, we can look at the structure of the disks and find patterns that potentially give us clues into how they were assembled but a review today did not prove insightful.
Important: Can you please reach out to MCC and request if there is any documentation available there on the configuration of this disk array or a technician there that can speak to it? In the meantime, I will review the operating system drives to see if there is any configuration documentation there that might have been saved.
FYI, I will be away from the office Thursday and Friday. With the holiday on Monday, I won't be back in the office until Tuesday, Sept 3 rd.
However, if you receive the Admin password and/or information on the disk array configuration please respond to this email. My Lab Supervisor and a Senior Level Technician are copied.
From:
EFTA00075829
Classification: UNCLASSIFIED
We had a visit from SigNet technician | of the system.
today who gave us a better understanding
DVR 1 System — Up and running. We have the password for the AMS (server that contains the software that controls the 2 DVR's) and so now have visibility into the video contained on this system through the software. I have reached out to those who specialize in DVR video retrieval for further instruction and am waiting for details.
DVR 2 System — After reviewing logs it appears that there is no video recording beyond July 29th as a result of disk failure at that time. The engineers here will be reviewing the disk structures to see if there is any possibility of manually rebuilding some of this data contained on the disk array if the timeframe available is still of interest and you want to pursue it.
Notes:
• From what I understand there is a potential 14 day window of video. So best case coverage would be DVR 1 (Aug 1- Aug 15) and DVR 2 (Jul 15 —Jul 29)
• It looks like roughly half the cameras were assigned to DVR 1 and half were assigned to DVR 2. Currently we only have visibility into whatever video was assigned to cameras on DVR 1.
For those of you who were at the meeting today, please chime in if you feel there is anything else pertinent to add.
EFTA00075828