Subject: RE: US v. Maxwell - [conferral re photo and other discovery deficiencies] Date: Wed, 26 May 2021 17:03:55 +0000 Inline-Images: image001.png; image002.png Thank you for the explanation. We have reviewed this new information and it seems to explain the difference in the number of files. We will await answers on the other issues I raised. Thanks, Laura From: Sent: Monday, May 24 2021 9:36 AM To: Laura Menninge Cc: Jeff Pa Subject: RE: US v. Maxwell - [conferral re photo and other discovery deficiencies] Laura, (USANYS) obbi Sternheim I am still working with our vendor and the FBI to address the issues you raised regarding the metadata for this production. In the meantime, I am able to explain why there are more entries in SDNY011 than on the non-nude index. The non-nude index does not include the 3 excel files or the 28 pdf files that were contained in the SDNY011 production. Those 31 files should explain the discrepancy between the number of files in SDNY011 and the number of entries in the non-nude index. Best, From: Sent: Thursday, May 20 2021 8:22 PM To: 'Laura Menninger' (USANYS) Cc: Jeff Pa Bobbi Sternheim Subject: RE: US v. Maxwell - [conferral re photo and other discovery deficiencies] Laura, I will pass this on to the FBI and our vendor for review. Once I have consulted with them, I will revert back to you on this issue. Thank you, From: Laura Menninger Sent: Thursday, May 20, 20213:28 PM To: ica; (USANYS) EFTA00091229

Cc: Jeff Pa Subject: RE: US v. Maxwell - [conferral re photo and other discovery deficiencies] obbi Sternheim Thank you for your explanation. I also have gone back to our IT department and, unfortunately, your FBI/vendor explanation is insufficient. • Based on our review, which has been double-checked, there are hash values in the overlay that don't match the index and visa- versa. • The snips below show an example of an entry from the overlay file you provided (with file names and MD5 Hash) which did not join to the non-nude index. We were able to find the corresponding file in the index using the file name, which in this particular instance was unique. As you can see, the MD5 hashes don't match. From the overlay file ProdBegBates • File Name - MD5 Hash 4 SDNY_GM_00503260 Jeffrey VF2.psd DA92DF87819FCC13F38E0584D8077DFB SDNY GM 00506551 LSJ Ilbrarywindow150dpi.tif SBACKBE826591AEFD0604ABA226272D From non-nude index 1 File Name SKA-1 MD5 LSJ librarywindow150dpi.tif 043670EDF17D35EE5794E80F094AEF63495D489A 80E866247E99D1C9EE028A30FB8F72D5 • More importantly, if as you report you did not deduplicate the production and if the index you produced is accurate, we should be able to match files based on the combination of File Name and MD5 hash. The hash + file name combination might not be unique, but each hash+file name value in the index should have a corresponding entry in the overlay unless hash values and/or file names were modified somewhere in the process. • As previously reported, if we require a match on the hash value and ignore file names, there are 65 production numbers that don't match the index. • There are more entries in SDNY011 (40,567) than entries on the non-nude index (40,536). We cannot understand the discrepancy based on your explanation. My earlier requests - a new copy of the non-nude index with an added column to note the production number of each file and a new index for the produced files that were not included in the prior index —still stand. Thank you, Laura Laura A. !Henninger I Partner Haddon, Morgan & Foreman, P.C. 1501. 10th Avenue! Denver, CO 80203 From: Sent: Tuesday, May 11, 20219:15 PM To: Laura Menninge Cc: Jeff Pa liuca Subject: RE: US v. Maxwell - [conferral re photo and other discovery deficiencies] (USANYS) 'Bobbi Sternheim Laura, EFTA00091230

I have consulted with the FBI and our vendor regarding the issues you raised with the overlay. Below is what I understand from them: When using the overlay, you should require only a match of the hash value. When our vendor uses the overlay, they do not see any production numbers that do not have a match in the index. If you are still seeing outliers, please let us know which files are not matching up with the index, and our vendor will look into what that issue could be. • The 17 files with no hash values were either incomplete files or corrupt files when they were recovered from the CDs. We produced them to you so that you would have a copy of every file on the CDs that did not have identifiable nudity. • Any non-unique hash values are duplicate files. There were many duplicate files on the CDs. The FBI and vendor did not de- duplicate the images before producing them in an effort to ensure that you had a complete set of all files recovered from the CDs. • There are a number of files that were recovered from the CDs but are unopenable on our end. We produced them to you so that you would have a copy of every file on the CDs that did not have identifiable nudity. If you would like to check to see if any particular files are unopenable on our end, we would be happy to check. Given the above, the FBI and the vendor believe the overlay previously provided should be sufficient to allow you to review the metadata in this production. Best, Assistant United States Attorney Southern District of New York I St. Plaza New York, NY 10007 From: Laura Menninger Sent: Wednesday, April 28, 2021 1:18 PM To: 1 >; (USANYS) Cc: Jeff Pagliuc. ; 'Bobbi Sternheim Subject: FW: US v. Maxwell - [conferral re photo and other discovery deficiencies] Thank you for sending the overlay. After review, it unfortunately does not appear sufficient to allow us to properly match the metadata to your production of native files. Based on your representations, the "Non-Nude index" located at Bates 467567 in Excel should match the Bates number native images produced at SDNY011. However: • The number of entries in the Non-Nude Index is less than the number of files produced. • Although the overlay file has 40,567 entries (the same number of files in SDNY011), they don't match up to the Non-Nude Index. o When joining the overlay file to the index: If we require a matching value for both MD5 hash and file name, there are 24,757 entries in the overlay that do not match the index. If we require a match on the hash value and ignore file names, there are 65 production numbers that don't match the index; 17 of those don't have hash values at all. • The overlay has many non-unique hash values, meaning we cannot rely on hash value alone. • The Non-Nude index also has many non-unique hash values. I think the only feasible resolution is for you to provide a new copy of the non-nude index with an added column to note the production number of each file. We also need a new index for the produced files that were not included in the prior index. Let me know if you will agree to produce these two new indices. EFTA00091231