Thank you! From: Sent: Thursda . S tember 05.2019 8:53 AM To Subject: RE: Keychain cracking -- UNCLASSIFIED Classification: UNCLASSIFIED The machines in question arc Macs running APFS. and their images arc aff4 files. I have them here in Blacklight. but I can't confirm which one because the Case Agents are using my one Blacklight machine to review. The images are NYCO24353 and NYCO24329. One of them has a user account ofJEE or a similar usemame which is obviously the subject. If you have a list of possible passwords, could you forward that for me to try on the T2 iMac? From- Sent: Tbursda Se tember 05 2019 8:43 AM To: Cc: Subject: RE: Keychain cracking UNCLASSIFIED Classification: UNCLASSIFIED Good morning can certainly try. When I worked on your request I was able to recover several passwords for him from other systems (and their keychains) that were provided so I may already have it. Which ones did you want me to check? Let me know and I'll take a look at it. IT Specialist /Senior Forensic Examiner Secure Technologies Exploitation Unit (STXU) tional Technology Division (OTD) - Miami From 3503-0 II Page 6 of 8 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001903 EFTA00157088

Sent: Wednesday. September 04.2019 3:35 PM To: Subject: Keychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED You seem to be the Mac guy for your unit. Quick question. If I give you an un-encrypted image of a Mac either in APFS or HFS+, would you be able to recover the password for the user account? I have multiple images of macs from Epstein, and they all have the same password hint. Figuring he just used the data migration tool and rolled everything along. Hope it can give us a password for a T2 iMac we can't get an image of. NYOLAKI Coordinator Senior Forensic Examiner Classification: UNCLASSIFIED Classification: Classification: UNCLASSIFIED UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED 3503-011 Page 7 of 8 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001904 EFTA00157089

Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED 3503-011 Page 8 of 8 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001905 EFTA00157090