Latest / Parsing the Truth: One Byte at a Time / Frames Don’t Lie: Epstein’s Missing Minutes

Transcript

Frames Don’t Lie: Epstein’s Missing Minutes · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty, to cracking the complexities of
0:29
iPhone forensics Stacey's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left TuneIn
0:42
and start parsing the truth. Hello everybody, welcome to
0:46
another episode of parsing the truth one bite at a time.
0:50
I am your Co host Stacy Eldridge and I am joined by my lovely Co
0:55
host Becky Passmore. Good evening everyone.
0:57
And welcome to the next episode. All right, we've got some spicy
1:01
digital evidence for you tonight.
1:03
Becky, what's our spicy digital evidence?
1:06
We're going to just jump on the bandwagon of everyone else
1:09
talking about it. We're going to talk about this
1:11
Jeffrey Epstein videos that are out there, been provided.
1:17
And all the information, how it was collected and how was
1:23
handled. So we're just going to jump on
1:25
the bandwagon and talk about. That a little bit.
1:27
Yeah, It was not our intention to get on this bandwagon, but
1:32
there is just so much stuff going on about it continuously
1:38
and we want to talk about why that is, how it should have been
1:44
done. Becky's going to go through like
1:46
if I was in the FBI, this is how I would have collected evidence
1:49
and and done some of the examination stuff.
1:52
And then I'm going to walk through the analysis that I did.
1:56
And we're going to talk about all the things that we're doing
1:58
to try to figure this out. And then we're we're going to
2:02
get to the spiciness at the end. We are going to give you the
2:05
facts. We're not approaching it from
2:07
conspiracy theories. We're going to demonstrate what
2:11
we did. This might be one of those
2:13
episodes where you want to watch us on Spotify or head on over to
2:17
YouTube because we're going to do some screen sharing because
2:20
there just is so much information we want to show you.
2:24
Wired started a lot of this stuff and they had an episode
2:29
where they said we're going to be on our podcast and we're
2:31
going to tell you exactly how we found all this stuff out.
2:34
And that was truly wah wah because they didn't explain
2:38
anything at all. When when we talk about using
2:42
digital forensics tools, when we talk about using versions of
2:46
tools and what did that tool display and was that tool
2:50
designed to pull out information?
2:52
And we didn't get any names of tools, any versions of tools.
2:57
So if we as forensic examiners wanted to go repeat what those
3:02
people did, we would not be able to do that because we don't even
3:06
know what tool. They used right.
3:08
They gave us nothing. Nothing.
3:09
So we got no secrets. We're going to lay it all out
3:12
here. So we're going to go back a bit
3:15
in history, I guess. And we reviewed the OIG report
3:20
that came out in 2023 that dealt with basically the collection of
3:27
the evidence. And so this is where I'm going
3:29
to screen share to start, make it work OK.
3:34
And so some of the background that I think is important to
3:38
level set was as shown on my screen back in 19 on August 8th,
3:47
they found about the DVR failure that these prison video cameras
3:53
were recording on and it backdated to July 29th.
3:59
And so we can jump ahead and see that, but it's unfortunate
4:02
because the death, we don't know exactly when, was either late on
4:10
August 9th or early on August 10th.
4:12
But they didn't figure out anything about this DVR failure
4:16
that was causing many cameras to not record until August 8th.
4:22
And if you go in to read some of this information that's in
4:25
there, there was basically a miscommunication about when this
4:28
stuff was going to be fixed. They've established in this
4:31
report that it was known the day before that some of this stuff
4:35
wasn't working. And then let's get into where
4:43
here is some more of the documentation that you need to
4:46
know. They show that at 7:49 PM on
4:48
August 9th, Epstein was escorted back into his cell.
4:53
There's lots of great documentation in terms of
4:56
pictures in here that show where the cameras were, what they
4:59
show, and things of that nature. So this is worth a read if
5:01
you're trying to figure out what is looking at what.
5:05
So here's some of those pictures, for instance, so you
5:08
can analyze those more pictures. This is your main view right
5:14
here. So you can see the yellow
5:17
camera. This is what you can see in this
5:19
screen and then his cell. So you can kind of see him walk
5:23
across and and then he, you know.
5:25
Disappears. So that's when did they
5:27
originally come and get the DVRS?
5:29
That's the date I am missing. So FBI evidence documents
5:32
revealed that on August the 10th, the FBI seized all hard
5:35
drives contained within. The DVR 2 system, they returned
5:41
on the 14th to the to MCC New York and seized additional DVR 2
5:47
components and then on the 15th and they seized the entire DVR
5:53
One system goes on to talk about the Digital Forensic Digital
5:59
Forensics Analysis unit at Quantico.
6:02
Defu defaw, defaw, defaw. I remember how we pronounced it,
6:06
but it used to be Fabio or is that a different unit?
6:10
OK, it was. I want to make sure.
6:11
Yeah, I still call it Fabio. OK.
6:13
Yeah. The forensic audio visual unit.
6:18
Yeah, I remember that. And so then the Quantico
6:23
Virginia team received the DVR system on the 16th where they
6:29
they started to conduct a forensic analysis of the system.
6:32
And so according to those reports, the DVR 2 did not start
6:37
successfully and they and, and this unit, Digital Forensic
6:42
Analysis Unit found that the system contained 3 faulty hard
6:46
drives and that those three drives were repaired by the FBI
6:52
Advanced Data Recovery Specialist Group.
6:55
So again, how this was collected and handled, managed is very
7:04
critical. The preservation of evidence is
7:08
a key factor and that includes DVR systems.
7:12
When I managed handled DVR systems, we would, if we were
7:18
going to need the entire hard drive, we would clone the drive.
7:22
So you would take the drive out, you would clone it.
7:26
And a clone is different than a forensic image.
7:28
It's not the same thing. That's right, because your image
7:31
is compressed, your clone is exactly what it says.
7:35
You could put it back into the system and it's going to run
7:38
just like a computer system. And what would happen is once
7:42
you like any other thing that you connect that is alive, I'm
7:47
gonna call it live, you connect now you're changing the time
7:50
stamps, you're changing the information.
7:53
But that's how you view this data.
7:55
And so you can't, you cannot forensically image it in a
8:00
compressed state because that's not how a DVR system works.
8:04
That's not how they are read. And so the whole fact that they
8:08
had to go back three separate times and collect more and more
8:12
and more, it's just, it's a concern of how and who was
8:17
making these collections. Because, you know, when you and
8:21
I were forensic examiners at the FBI, only Computer Analysis
8:26
Response Team, digital forensic examiners were to handle digital
8:29
evidence. And then if that digital
8:31
evidence had to be sent off to one of our specialty units,
8:35
because you have an encryption specialty unit, you have an
8:37
advanced repair specialty unit, you have a, you know, a forensic
8:42
analysis unit, which is actually cart sits under that forensic
8:45
analysis unit. You send it back.
8:47
And then the people that are specialized in those areas
8:50
actually are the ones that would do the work.
8:53
So just knowing that it was, there was quite a few
8:57
collections at the time and knowing that some of the
9:01
equipment didn't work seems to be, you know, concerning here.
9:05
And it certainly demonstrates how tricky it is to try to get
9:09
any evidence off of of ADVR system.
9:12
And I'm certain they were coming from it to a certain degree of
9:16
the aspect of we need to preserve some of their ability
9:20
to continue to record videos here in the prison.
9:25
So they probably thought, let's take the minimum DVR has the
9:31
video, we'll take it. Well, it sounds like they just
9:34
grabbed the hard drives out of it first, couldn't get anywhere.
9:37
They went back for the DVR and then they had to go back a third
9:41
time to get the others the. And Stacey, let's talk about
9:43
this. We both know that if you sent me
9:46
a computer today that was raided and had multiple hard drives in
9:50
it and I pulled those hard drive, what's going to happen?
9:53
Yeah, it's not going to work quite right anymore if you just
9:56
pull them all out. Yeah, you're likely going to
9:58
corrupt something. And I'm not saying that's what
10:00
happened in this situation. I'm just saying that handling
10:04
evidence, how evidence is handled, how evidence is
10:07
preserved, is extremely critical.
10:10
In these situations, right, if you don't get it preserved right
10:14
the first time around, who knows what you lost?
10:17
That's right. So what we're saying here is the
10:22
hard drives should have been cloned and then the clones would
10:26
have been put back into the DVR system.
10:29
But we wouldn't have made just like one clone.
10:31
There probably would have been 2 clones and then an image of a
10:34
clone. And we would have many, many
10:36
copies to make sure we're not at risk of losing, you know, best
10:41
evidence or anything that we can continue to pull from evidence
10:46
control and continue to work on it.
10:48
That's right, because we don't want to have to go back and ever
10:51
touch the original hard drives again.
10:53
Right. And and that's keep point there
10:55
too, is if you know you're going to have to take the original and
11:02
clone it, but then you could take the original and also image
11:06
it because you can restore that to a clone.
11:09
So then you're not having to deal with the original evident
11:13
the original hard drive. And and that's just trying to
11:17
protect that original and just use your, your image and your
11:22
clone. To be able to review the data
11:26
without having to continue to go back to the original evidence.
11:30
And so one of the things that have people all in a hullabaloo
11:33
is because DOJ said we are releasing the raw video.
11:39
So Becky, let's say we successfully clone our hard
11:43
drives. We've got a clone in the DVR,
11:46
we're up and running. What are the options to look at
11:49
the videos, get videos off? How can we get something that we
11:54
we can examine with our tool? But yeah, you you definitely
11:57
could again have a clone. You can have a full data set of
12:03
that data. You could also select depending.
12:07
Let's see let's say this depending on the type of DVR
12:10
system. And we could just figure out
12:11
what the DVR system was. It was not published in that OIG
12:16
report. I could not find it on the
12:18
Internet. If you know, let us know and
12:21
we'll see what we can figure out from that.
12:23
Right, because depending on the type of DVR system it is, some
12:27
DVR systems allow you to take snippets, right?
12:30
Take a certain time period, starting and ending time period
12:35
and extract that out some DVR system to let you plug in Ausb
12:42
device and take out what you need without having to pull the
12:47
entire hard drive, without having to go through 10 plus
12:50
hour video to try and figure out what's going on.
12:54
There are ways that to be able to, and I understand that, that
13:00
it's the part of the FBI is, you know, their commitment to being
13:04
trans, you know, having that transparency.
13:07
I get that. And, and, and I would expect
13:09
that because the FBI is trying to do the right thing.
13:12
There's no doubt about that. However, when you take and you
13:15
start moving data around, especially a big large video, is
13:22
it raw? Is that data raw?
13:25
Because if it's raw, then we're going to have some other
13:29
concerns here. Well, and what would you
13:31
consider raw? And maybe everybody has a
13:34
different definition and we don't know who told who what.
13:39
We don't know who produced these videos.
13:43
I mean, and we'll get to some of that metadata later.
13:46
We might have an inkling, but so we don't know who did what.
13:50
Was it FBI Computer Analysis Response Team members that made
13:55
this stuff that was released to the public?
13:57
Was it somebody NPR who explained that it was a raw
14:01
video? Did somebody just say raw
14:03
because they meant raw is unedited?
14:06
I didn't do anything to it. It visually looks fine.
14:11
And when I think about it, if you're saying RAW to me, I'm
14:15
thinking this is the video chunk you get straight from the DVR.
14:20
Now on some DVR systems, if you've you know whether you have
14:24
it cloned or you're working off of the image and you're put it
14:26
into your tool, can you ever see some videos, whether it's a 12
14:31
hour video or smaller videos? Is there ever a video where you
14:34
can grab that video like as what we're used to dealing with on
14:38
our computers? And I think of raw data very
14:41
much like the unprocessed data that is collected and recorded
14:49
directly from a source without any manipulation, organization,
14:53
or analysis. It truly is.
14:56
I got that hard drive. I cloned that hard drive.
14:59
Here's the raw data. Nothing else has been done to
15:01
it. That's raw data.
15:03
Again, terminology, when we talk about forensics and technology,
15:07
can get lost in translation. So raw data is definitely
15:12
something that's unprocessed, not analyzed, not manipulated,
15:17
with not, you know, extractions or snippets taken from it.
15:21
It is truly how it was collected and then how it was presented.
15:27
I would imagine, I don't know what this DVR is chunking stuff
15:30
into, but it might very well be a 24 hour long video.
15:34
Is that why it's rebooting every night at midnight?
15:36
Because it's got to stop at some at some point, right?
15:39
Otherwise you're going to have like 1 video file that is 365
15:44
days long. That right?
15:45
That seems crazy. And then we could talk about
15:47
like the file system that it's on and the file system storage
15:51
limitations and how big can a file be.
15:53
So I mean it gets complicated. And how big can that hard drive
15:56
be? And what is the, what is the
15:59
natural process? Is it every 10 days it starts a
16:02
new recording and it starts overwriting?
16:06
Yeah. When does the overwriting
16:07
happen? How long does stuff sit on that
16:09
drive? Right.
16:10
Is it 10 days? Is it 30 days?
16:13
Is the system large enough to store that amount of streaming
16:17
data over the time period? Could that be, I mean, is it, is
16:21
it properly maintained in a server or a data room that is
16:25
cooling enough to keep those hard drives from overheating,
16:30
which can also cause corruption. So yeah, there's a lot of
16:33
factors that go into play here when you're managing large
16:38
streams of. Data like that, yeah.
16:40
So I think we've presented that DVRS are tricky.
16:44
Everyone is different. We don't know what it look like
16:49
on those hard drives. So I think the next thing to
16:52
dive into unless there's anything else on the DVRS that
16:55
you wanted to mention, Becky. I think that's yeah, how we
16:59
handle it, how it's handled and how it's preserved, how it's
17:02
managed, how it's transported. What kind of system is it?
17:06
We talked about an analogue system.
17:08
Is that, is that, is that what kind of system it was?
17:12
Was it an analogue system? Yes.
17:14
And this one was analog cameras recording to this DVR system
17:19
that was recording the videos on hard drives.
17:22
Yeah, so I can make a difference too.
17:24
Yeah, and you can see that when you watch the video.
17:27
Like, it's not super sharp lighting.
17:31
It's all right. I mean, some of that lighting
17:33
depends on just your lighting of the areas.
17:35
But they were slated to start getting a new video camera
17:39
system sometime new. So I don't know how old it was
17:41
at this point, but you know, 2019 it certainly was not new,
17:45
was going to get replaced. So that certainly adds to
17:48
everything with it being. Old.
17:49
Sure. And also, what type of codec was
17:51
it using? You know, I'm not and will never
17:54
be a digital forensic examiner expert in DVRS, but I've handled
18:00
several and I know the process to be able to get that.
18:03
What kind of codec was it using? What kind of kind of tool had to
18:07
be used to review the data and if any was extracted?
18:11
What form? What codec?
18:13
Codec was being extracted in to know to be able to look at it in
18:19
another format or in real time. Those are different tools and
18:22
processes as well. Yep.
18:24
And as the examiner, let's not forget you would document
18:28
fiercely in your case notes, anything and everything that you
18:32
did in order to get that video off.
18:36
If you had to try 5-6 different things, you would document that
18:39
and you you would certainly document that in your final
18:42
written report as well. I'm going to document the crap
18:45
out of it. Yes, absolutely.
18:47
Let's move on to the video itself now.
18:50
Becky and I have both watched the video all the way through.
18:57
Ours. Becky looks super excited that
18:59
she got to do that. That was not our intention to do
19:02
it. And we'll walk you through the
19:05
rabbit hole we went down and we lost the rabbit holes.
19:09
We had to do that. Well, that's the thing.
19:10
If you're going to be a good digital forensic examiner, you
19:13
better love rabbit holes, because the answer to one
19:17
question should do what, Becky? You do another question or three
19:21
or four questions. You should always be exactly.
19:24
You should always be curious and inquisitive about what that
19:28
result produces that leads you down the next.
19:32
And sometimes you have to go away from the rabbit holes and
19:35
get to the real meat of the work.
19:37
But sometimes rabbit holes can lead lead you to the smoking
19:40
gun. They can.
19:41
And that's why my case notes are kind of like all over the place
19:45
because I'll be like, I'm going down this path, shiny object.
19:49
And so I kind of go down that path for a while because I think
19:51
it relates to that. And then I'll get halfway down
19:53
there and I'm like, Nope, that's nothing.
19:54
Or I figure out what it means. Then I kind of go back and then
19:57
I have lots of facts all over the place.
19:59
And then I got to look back from the 10,000 foot view and be
20:02
like, what does this mean? Right.
20:06
Did I find any answers? Do I have more questions?
20:08
Does this prove it? Does it disprove it?
20:11
Is it exculpatory? What?
20:12
What have I got here? Or do I still have to go back
20:14
and look again? And that is kind of what
20:17
happened here for sure. That's exactly what happened
20:20
here because we were taking in information, We were taking in
20:23
information from the OIG report, from the FBI memo.
20:27
We were watching podcasts that were produced by Wired.
20:31
We were reading through an article produced by the UK about
20:35
the metadata of this file. And then we were doing our own
20:38
hands on, let's figure out what we can figure out from the raw
20:43
data that's dropped in this memo.
20:46
Yep. Absolutely.
20:47
And one of the things that I was disappointed with when the FBI
20:51
memo came out was an FBI memo or no DOJ memo.
20:56
Oh, this was a department, it's Department of Justice Federal
20:59
Bureau of Investigation memo, OK.
21:01
But there was not any hash values.
21:04
There was. Not no, I would.
21:06
Have liked a hash value for both just so when I downloaded it I
21:09
made sure I had. The right thing downloaded, I
21:12
don't know. And nobody else has published
21:14
their hashes that they calculated for it.
21:16
So I mean, I have my hash right and think about it too.
21:21
I mean, we're talking about people making determinations
21:26
based on this video that has been provided.
21:31
And one, how many downloads have has happened?
21:34
And two, did you get the full download?
21:37
And if you didn't get the full download, does it appear that
21:40
you got the full download? Because we don't have a hash to
21:43
match back to once we downloaded this video.
21:47
Throw it in a hash hasher and figure out that video hashes and
21:52
O they provided me the hash so I know I got a 100% digital.
21:59
Fingerprint of that file. I feel like somebody, an FBI
22:04
cart, should have been called in on the authoring of this memo
22:08
and clearly confirmed or denied or whatever about the RAW.
22:12
Video. And then they should have said,
22:13
you know what would be a great idea?
22:14
Let's put some hashes in here for everybody.
22:17
That's how we download our tools.
22:19
We download our tools. We know that we're downloading
22:21
the right tool. Sometimes we're even downloading
22:23
evidence and what are we doing? We're comparing the hash once we
22:26
get that the evidence into our possession to make sure that we
22:30
are not missing anything that would be detrimental to the
22:36
downloading because something could not come down clearly and
22:40
a hash would make sure that it would prove that you had 100%
22:46
the file. And I think the way this
22:48
everything happened, the memo was released, the links were
22:51
there, people downloaded the videos.
22:53
And then I think the first thing that was said about it was, hey,
22:57
here's a one minute, 2 second gap right before midnight.
23:00
And then Bondi came back and said that's due to the DVR
23:03
system boot. She said that in a long
23:06
roundabout way. I don't know who explained that
23:08
to her, but they should have given her a better definition
23:10
and analogy because she kind of rambled on through that.
23:13
So, so that's kind of the first thing that happened.
23:16
So now everybody's like, oh, you know, 60. 2 seconds is.
23:20
Missing and then I think from that everybody just dived in
23:24
harder and deeper and then it got worse.
23:26
Right, right. And that whole one minute and
23:30
two seconds reboot is at the end of the day, at the end of one
23:34
day, the start of a new day again, how it's configured
23:40
within the right, we don't know how those DVR configuration
23:44
settings are set up. Is it is it configured that way
23:48
or is somebody up there going? Reboot.
23:53
Yeah, restart. The next sort of stuff that came
23:55
out about it was the created date.
24:01
And their people are looking at the modified dates and times in
24:05
the metadata. So they're getting a created
24:07
date and a modified date from May of 2025 and I'm not gonna.
24:14
That was just a few months ago. Yeah, just a few months ago,
24:18
Key, if we were looking at the raw data.
24:22
What? Date would we expect to see or
24:25
perhaps what year? Well, it certainly would not be
24:27
this year if we were looking at the raw data.
24:30
If we were looking at the raw data, we would be looking at
24:33
something around 8-9, eight, 10/20/19.
24:36
Yes, yes, that's that's what we're looking for.
24:39
So and that's kind of right there at the top of the
24:42
metadata. So people are looking at, at
24:44
that and they're like 2020, what is that?
24:47
So then they continue to Scroll down and then they find it's not
24:54
one video, but two videos in this video that has made this
25:01
one big video. There's two little videos in
25:04
there that is making that up and those videos we also have file
25:10
names from 2025 and we'll screen share some of that stuff.
25:15
But so now there's two more videos named after, you know,
25:19
month, day, year, or hour, minute, minute, 2nd, 2nd and you
25:24
know, you that's kind of indicative something happening
25:29
right then maybe you start a screen capture, maybe you start
25:32
an export. There's lots of things that
25:34
default to the current date and time.
25:37
However, none of this should have been done in 2025.
25:41
Somebody should have went to evidence, pulled the stuff out
25:43
from evidence control, all the stuff they gathered in 2019,
25:47
made more copies, did whatever they had to do with that.
25:50
So they're going through that. They're finding a bunch of
25:53
editing time, and then it gets even worse because they are
25:57
finding somebody who is editing this and let me see if I can
26:01
find it in my notes. I mean, I have it in my notes
26:04
because it's a matter of scrolling through like 20 pages
26:06
notes to find it for you all. But, and this has been
26:10
everywhere on the Internet. There was in Windows, there's
26:13
the user path. And so typically when you're
26:15
saving your files, you're going to see something like the whole
26:18
long path C colon back slash, users back slash, username back
26:24
slash, like documents back slash, and then the name of the
26:28
file with the extension. And so like my username on a
26:32
system might be Stacey Eldridge, but in this system, we're not
26:36
seeing in sort of like your first name, last name.
26:39
We're seeing MJ Cole till day one.
26:43
Becky. What's the significance of
26:45
seeing a username with that till day one in it?
26:50
File name. So file name, yeah.
26:53
What is that it? Is it it normally?
26:55
I mean, it is referencing that that short file name is a link
27:00
to it. A long file name, yeah.
27:02
So, and that's, are we typically seeing short file names being
27:08
used in Windows systems, whether you're on Windows 10 in 2019 or
27:14
even if you went back to Windows 7, would you have seen short
27:17
file names if you're working? Yeah.
27:19
So, so that's really weird. That's like you might see it in
27:22
some apps you're using in a DOS from the command prompt sort of
27:26
situation, but that's weird. That is an 8.3.
27:29
Version 8.3 Yeah, that's what I was trying to think of.
27:31
The 8.3 is referencing the short file name and because you we
27:36
only have 8 characters and then the .3, the tilde is there in
27:41
place to say this. You know this is a longer full
27:46
name. Yep, and so it just goes, it
27:47
cuts it off and then at six and then you get 7-8 till they is 7
27:52
and 8 is like the one or the 2 or whatever.
27:55
So we don't know who MJ Cole dot dot dot.
28:00
It could be Coleman, but we don't we don't know who that is.
28:02
We don't know where they work, but somebody who is making this
28:06
video had that username directory that they were saving
28:10
this project into. And so that's kind of all of the
28:13
information that's been out there.
28:15
They're like it's, you know, we've got stuff from 2025
28:19
created and modified dates. We got two different files into
28:22
it, also with names from 2025. And then we've got a name in
28:27
here and the project extension made everybody know that it was
28:31
Adobe Premiere. So we know all of that, but we
28:35
go into it, we're looking at the data and then we see that
28:38
there's these two different videos in there.
28:41
And as any good forensic examiner will do, we've got to
28:45
account for all the things. So whether it's all the space on
28:48
the hard drive or all the time in the video, we start to do
28:52
that. And so this is kind of where the
28:55
rabbit hole begins. And I'm going to share my screen
28:59
so you guys can kind of walk through some of that stuff as
29:03
well. So if we look inside the video
29:06
and we're looking at the time stamps, it begins precisely on
29:10
August 9th, 2019 at 7:40 PM and then the end timestamp is
29:16
8/10/2019 at 6:40 AM. So here we are, exactly 11 hours
29:23
of video. In video one dot MP4, it was
29:26
about a 20 gig download. Now I go in and look at the
29:30
metadata, this EXIF metadata and I use EXIF tool and I got some
29:34
other stuff. I'll show you where I give the
29:36
version and stuff, but it says the duration of this video is
29:41
not 11 hours. It says it's 10 hours, 52
29:45
minutes, 24 seconds. Now we know there's one minute
29:48
and two seconds of video missing and that nightly reboot was at
29:53
115858. Now, the first duration of the
29:57
video from the first section before the video reboot is at 4
30:02
hours, 16 minutes, 23 seconds, and it ends at a specific frame
30:08
that I've got documented here. And then we go on and I
30:11
calculate how long is it from when the video picks back up
30:16
exactly at midnight. And then when does that end?
30:20
Now on the time remaining indicates that it was only 6
30:25
hours and 36 minutes where it should have been six hours and
30:33
40 minutes because from midnight to 6:40 AM is how long Becky?
30:38
Six hours and 40 minutes. Exactly.
30:41
So this is where I start freaking out because Wired had
30:47
reported, you know, they think about 3 minutes of video is
30:50
missing and I'm like, I don't have 3 minutes of video.
30:54
I have it. I'm doing all of this math,
30:57
right? As a forensic examiner, you're
30:59
still going to have to do math. So I'm going like, when does it
31:01
start? When does it end?
31:02
I'm doing all the calculations of the time differences and I'm
31:05
like there is 6 minutes and 34 seconds of video missing.
31:14
What the heck is going on here? So this is where the rabbit hole
31:18
begins. So, Becky, when I told you that,
31:21
what did you think? I thought, did we miscalculate?
31:25
I thought, did our tool produce the right information?
31:32
So there's a lot of things that run through your mind as a
31:35
forensic examiner. Is Stacey.
31:37
Just adding and subtracting wrong.
31:39
You get well and that. Could be it too, right?
31:41
I mean, right, so I start using my fingers and my toes and my
31:45
and I'm like, OK, 123, you know, go back to elementary and it and
31:51
you know, it is it sends you into this adrenaline pump and
31:56
let me figure out why there's. Miscalculation here.
32:01
Yeah, that's what we're thinking for sure.
32:03
So we're going through double checking the math on the first
32:05
part of the video, the second part of the video, adding it all
32:09
together, and we're checking between what the EXIF metadata
32:13
is reporting. We're checking what we're seeing
32:16
on the screen. Because when you're playing it,
32:18
I didn't, I was using Media Player Classic.
32:21
It has a very nice countdown of like how much is remaining
32:23
total, all of that sort of stuff.
32:25
And it's all matching up and then I'm like, well, let's go
32:29
back and try, try to figure out how did Wired come up with
32:33
almost 3 minutes of video missing.
32:36
They don't disclose how they figured it out anywhere.
32:39
I can't find anybody else. I do see a couple other people
32:43
that have reported metadata out there with some of their
32:46
findings backing up and they're, they say, I agree with Wired
32:50
that almost 3 minutes of video is missing.
32:53
So we've double checked the math and this is where we go.
32:57
We've got to watch the video because we don't, we don't know
33:00
where it's missing from. And sometimes that's just what
33:02
you have to do. You have to watch videos all the
33:06
way through. It doesn't.
33:07
And this happens in all sorts of crimes and different cases.
33:10
You may have to watch the video all the way through.
33:13
So we're splitting up. We're watching through it.
33:16
Becky took the first half, I took the second-half.
33:18
And then we kind of skim through it all together anyways.
33:22
And we're we're not finding anything.
33:24
I'm like getting almost to the end.
33:25
I'm like, there should be 4 minutes missing from the
33:27
second-half. I've got two hours left and I'm
33:30
only missing 2 minutes, but I never saw anything missing from
33:34
the screen because it's got the clock going the whole time so
33:37
you can see. And then we were like, well, are
33:40
they doing movie magic? I mean, we got ridiculous with
33:43
our theories of like, what, what are we missing?
33:45
What did they do? How complicated, you know, was
33:49
this something from Mission Impossible?
33:51
Did they swap out the video? And there was this overlay and
33:55
the, you know, and it wasn't any of that.
33:57
So what we figured out that it was and I'm going to I don't
34:03
need to share my screen for this is So then I started doing more
34:07
math and I'm like, let's think about the frames in the video.
34:12
If you're not familiar with the video, this one and is common
34:16
with most videos in the United States.
34:18
A-frame is basically like your single still picture and in a
34:22
video you're going to have 29.97 frames per second.
34:28
So almost 30 individual images go by in a single second.
34:33
So now, so now we're doing more math and I'm like how many
34:37
frames are in this video? There are 1,212,196.59 and some
34:48
change frames in this video and then I go OK, how much video do
34:53
we think is missing? 6 minutes and 34 seconds from
34:58
almost an 11 hour video and that is 11,808.18 frames potentially
35:07
missing. I wonder what the loss rate is.
35:10
This is why I'm doing this. And then so I divide, you know,
35:15
the 11,808 and change frames by the total number of frames,
35:20
which is over 1.2 million and I get a loss rate of .97%, less
35:28
than 1%. And so I'll look it up.
35:32
I do some research. What's an acceptable loss rate
35:35
of frames when I'm dealing with analog video recordings and the
35:41
acceptable rate of loss is between 1 and 5%.
35:46
And there's all sorts of things that can account for why you're
35:50
dropping some frames. So we're below 1%.
35:54
So we've, we've kind of ended it there, all right?
35:58
We're, we're good. We've, we've got a logical
36:01
explanation backed by, you know, actual numbers, then things that
36:06
we can calculate from the video itself.
36:08
But we're still stuck with, why does Wired say there's 3 minutes
36:14
of video missing? OK, you guys are going to have
36:17
to buckle up because I'm going to drive you through the EXIF
36:20
metadata to show you. All the things we looked at in
36:25
there, really digging through it.
36:27
OK, Are you ready, Becky? Let's go.
36:29
All right, let's do it. OK, Sorry, I'm at the bottom.
36:32
It's OK. And and let's remind we are
36:35
telling our listeners the tool that we used is EXIF tool
36:40
version 13.29 point 64. That's the most current version.
36:45
And Phil Harvey. Is the author of Exit Tool so
36:49
free open source tool. It's one of the best tools out
36:52
there for reading metadata. It digs deeper than just what is
36:57
on the surface of metadatas. If you're going to use a tool to
37:01
dig deep and learn more information about anything, Exit
37:05
Tool is a tool that we recommend.
37:08
Yes, and this will give you way more than just right clicking
37:11
and like viewing the properties. You can get a lot of stuff out
37:13
of there, but this is going to give you a lot more, especially
37:16
when it comes to video and if you're watching.
37:19
I've even got three different versions of the commands that I
37:23
ran on my screen, trying to get the most out of it because
37:27
different commands result in different data being saved in
37:33
there. So I have at the beginning and
37:35
I've got just snippets of it because I'm trying to put this
37:39
in a fashion of as I was thinking through it.
37:42
So we see here right at the beginning the created and
37:45
modified dates of this project that is recorded in here and it
37:50
lists the creator toll as Adobe Media Encoder.
37:54
Now that is the encoding engine that is making the video a video
37:59
from whatever you're putting into the project.
38:01
Now either Premiere Pro or After Effects, they both use the same
38:06
encoder. Now you've probably been hearing
38:08
people say well it's Premiere Pro.
38:11
How do they know that? Well, if you Scroll down and
38:14
this was kind of towards it was at the very bottom of the
38:17
metadata collected. Here is where we get the good
38:21
stuff. It gives you the Windows Atom
38:23
extension extension which is dot PRPROJ and this also shares
38:30
where we have the username the MJ Cole till they won.
38:33
You see the temp directory that this is being worked on and
38:37
again you see the extension here.
38:39
So This is why we know it's Adobe Premiere Pro.
38:42
And then we've got some more times in here created and
38:47
modified date. And the other thing that you're
38:48
looking for this because some of these dates and times and
38:51
information are stored in here through different tags in the
38:56
EXIF data. And so you're going to be
38:58
looking for these to be matching along the way.
39:03
And we consistently see that created a modified date, you
39:06
know, created on the 20 3rd, modified on the 24th.
39:11
And these dates and times here are in UTC.
39:13
So don't think somebody was up working late in the middle of
39:16
the night on this one. And anyways, we also have a
39:20
duration very long number, it's in second.
39:23
So you've got to get it in two hours and minutes.
39:26
And again, that is the 10 hours, 52 minutes.
39:29
It's matching. Here we've got some more
39:33
information about the track data.
39:35
Because this was produced in a project.
39:38
There is just one track, there is one stream.
39:42
And so here you see where this one track, not the project the
39:48
track was created. Now you've got more numbers
39:52
here. And this is where I really had
39:54
to start digging in, trying to figure out where is 3 minutes
39:58
missing from. So you have the.
40:01
Duration value. This duration value right here
40:06
352-294-5426 This is an internal time units value for Adobe and
40:16
you have to use the value be below it 1.1111 to do the
40:21
conversion to figure out how long it is, which I have done
40:26
here. And that's just another fancy
40:28
way of saying this video is 10 hours, 52 minutes and 17 seconds
40:33
long. And you and you confirm that
40:35
through this exit data. Yep, Yep.
40:37
And I was like, you know, taking this number, times it by this
40:40
number using the old calculator. And that's right, everything is
40:44
still matching up because I can't eyeball this and and
40:47
figure out what the heck it means.
40:49
And there is all sorts of documentation out there from
40:52
Adobe of what all of this stuff is and what it means and how to
40:58
convert it. So I wasn't just like, oh, this
41:00
supports my narrative. I was looking all this stuff up
41:04
in the different documentation sources.
41:06
So don't think we did this in 15 minutes.
41:11
I. I feel like, I feel like you did
41:15
that 10 hours. I feel like like you did between
41:20
you and I having conversations over the last two or three days,
41:23
I feel like you did it many times and our conversations
41:29
going back and forth were and what is the acceptable loss
41:32
rate? Well, the acceptable loss rate
41:34
is this and how are you getting to that conclusion?
41:38
So it wasn't like, we just, like, came up with this.
41:42
It was a lot of research went into this.
41:45
Yeah, yeah. As does every episode.
41:47
But this one was heavier because there's no case notes, written
41:53
reports, No. Court transcript.
41:55
This is just what you know, We had some other people and some
41:58
information that they've released out there, but this is
42:00
really us acting as forensic examiners working Like if you
42:05
gave me this evidence, no, regardless of the side I was
42:10
working for, I would be digging into all this stuff, especially
42:13
once I found like missing times. This is supposedly raw, but
42:17
there's two videos that were made into one video.
42:19
So I'm trying to figure out what the heck happened so I could go
42:23
back and then demand the right stuff.
42:26
But let let's continue down more of this metadata.
42:29
So there's this tracks markers start time and you see below it
42:34
the tracks markers type is a comment.
42:37
I don't know what the comment is, but it's it's what it says
42:40
at that tracks markers. They put a comment in.
42:44
You have to divide that by the frames per second of the video
42:47
and do more math. And so this marker was put in at
42:53
4 hours, 17 minutes and 59 seconds into the first video
43:00
chunk. Now we're getting into pantry
43:03
values. We've got these pantry duration
43:07
values. I've got them both listed here.
43:10
Sorry, it cuts over on the pages.
43:12
But the the second video which depicts from midnight till 6:40
43:19
in the morning is listed 1st and then the video that starts on
43:24
the night of the 9th is the second one listed here.
43:28
But they have these pantry duration values, these pantry
43:33
duration values and it took me freaking forever.
43:36
It wasn't until like 5:00 PM tonight, This is Wednesday night
43:39
that I finally figured out these silly pantry duration values.
43:44
Bane of my existence. The entry duration states how
43:49
long the video file is there. Whatever the file was that was
43:52
put into it in this project, it was video files and the scale.
43:57
The number below it indicates milliseconds and so to figure
44:02
out how long it is, you have to take the duration value
44:06
multiplied by the duration scale to calculate it all.
44:11
So I've got it all here for you in a nice little chart and it
44:16
says the and why I didn't rearrange it.
44:19
My apologies, but so the video that goes from midnight to 6:40
44:24
AM, it says its duration is 6 hours, 36 minutes and one second
44:29
long, which matches what I visually matches what I
44:35
calculated out from the video player from start to end.
44:38
So that that's all there, all that video is there.
44:40
Then the other video file, which runs from 7:40 PM until it cuts
44:46
off just before midnight, is 4 hours and 19 minutes long and 16
44:53
seconds. And then if you add those values
44:55
up, you're coming up with 10 hours, 55 minutes and 17
45:00
seconds. However, how long is our video?
45:03
Video One dot MP4 Becky. 1010 minutes, 10 hours, 52 minutes
45:09
and 17 seconds. So now we have a difference of
45:14
two minutes, 9 seconds and a little bit of change.
45:18
Now I went back and I was trying to figure out, OK, so there is 3
45:23
minutes missing. I really wanted to figure out
45:26
where they were missing from. So I was like, well, let's go to
45:31
where that marker was set because somebody could have put
45:33
that marker there to cut something out.
45:36
So that marker was at 4 hours, 17 minutes and 59 seconds, which
45:41
is one minute and 17 seconds before the end of the pantry
45:48
duration. So I'm like, OK, so a little bit
45:52
before the end of this video, maybe they they cut it off like
45:57
is it ending like they cut it there and that's why it cuts off
46:02
at 11:58. But then even if I add up the,
46:06
the one minute and the 2 seconds gone for the reboot, I'm only up
46:10
to two minutes and 20 seconds of video missing.
46:16
There's another 40 seconds worth of video missing here.
46:21
We, we watched the video. So it's not missing in between
46:25
anywhere. There's nothing cut from the
46:27
middle of it. It doesn't seem like there was.
46:29
So even if you're cutting off a minute and two seconds for the
46:33
reboot in the middle of the night, because maybe something
46:35
happened, that's what the conspiracy theorists are saying.
46:38
The smoking gun happened, you know, right during the video cut
46:41
off, it's still not accounting for all of the video that's
46:44
missing. So it seems to me the only thing
46:48
left at this point since we watched everything and remember
46:51
the video starts exactly AT74000.
46:55
I'm thinking they probably cut it off at the beginning of the
46:59
video. Yeah.
47:00
And again, it goes back to this is not the raw video.
47:04
This is someone preparing the video to upload or to share with
47:12
the community so that the DOJ and the FBI are very
47:17
transparent. This is someone preparing that
47:22
in a program that can be uploaded and downloaded.
47:26
So the time difference, we all know when you copy and you paste
47:32
and you move things around and you use other tools and it's not
47:37
raw data that that small changes can occur.
47:42
And it's evident in the video because you can see like it's,
47:45
it's clearly got to be a screen recording, which is documented
47:49
by several things. You can see like the player
47:51
controls in the upper right hand corner, you can see a mouse
47:54
moving around. You can see the aspect of ratio
47:57
change from before and after. So even say somehow those two
48:03
videos that were put into the project were the raw videos
48:08
because whatever their names are their names for whatever reason
48:11
of 2025, let's give them the benefit of the doubt as we have
48:13
this conversation. They should have just released 2
48:16
videos be like because of the reboot, we're going to have to
48:19
have two videos to show you everything from those nights and
48:22
then we put them all into one video when we edited it in video
48:27
2 dot MP4 to make it sharper and brighter.
48:31
That's what I would have expected to see like 2 raw
48:33
videos and then a cleaned up video that consisted of the two
48:37
raw videos. But this is not evidence.
48:40
This is not the raw data. There's facts.
48:44
There's nothing pointing to this being handled in a forensically
48:48
sound matter. I don't know who did this, but I
48:51
wouldn't have expected to see this come out from somebody in
48:54
cart. This would not have.
48:56
This would not have been like what they would have turned over
48:59
for discovery. Now sometimes there's
49:02
communication issues clearly between case agents, attorneys
49:07
on both sides. And so maybe say I got this as
49:10
part of discovery, then I'd go back and be like, this is nice
49:13
work product, but I need the 2 raw videos.
49:16
So then I would ask for those two raw videos.
49:18
And if I knew it was from 20/19, I would have been like, well
49:21
what evidence do you have from 2019 that I can look at in this?
49:24
Case top of that, we would ask for the hashes like, hey, how
49:27
was this data prepared? What is the hash value?
49:30
We want to verify the integrity of the data.
49:33
We want to verify the integrity of the files.
49:35
So absolutely. And and that is again, no, no,
49:39
I'll intent, it just was not preserved properly.
49:43
When we talk about the methodology process in digital
49:46
forensics and maybe it was preserved and the raw data is
49:50
the raw data, but this is not, this is not the raw footage.
49:55
This is prepared for the public using a specific tool, Adobe Pro
50:01
Premiere. Yep, this is just work product.
50:04
Something nice to look at, easy to share, easy to distribute.
50:08
We always talk about our derivative.
50:10
You have your original evidence, digital evidence and then you
50:14
have that derivative and the derivative is prepared data for
50:19
your personnel that's gonna be, you know, utilizing it, whether
50:23
that be attorneys just, you know, turned over and discover
50:27
or whatever. And it's clearly labeled as
50:29
derivative. And that in this situation I
50:32
would have expected this to be said instead of it say the full,
50:37
raw and enhanced videos, the derivative of the videos.
50:43
Yeah, or they could have just said a screen capture.
50:45
This is a screen capture because of the way the DVR isn't it
50:49
being so old and stupid we had to make a screen capture.
50:52
Absolutely. And on top of that again there's
50:55
nothing from our analysis that says that there is anything
51:00
missing with I'll intent. It was just prepared that way
51:03
for. The public, yeah, but
51:05
unfortunately it has spiraled out of control because people
51:11
did what we did. We're disclosing what we're
51:13
doing so you guys can retrace our steps and I'll put something
51:16
somewhere so you can follow this more closely.
51:22
But I think there's, you know, there's some lessons learned out
51:25
of this that you can take to heart as a new forensic examiner
51:29
or if you're wanting to become a forensic examiner.
51:32
What are a couple of your key takeaways here, Becky, as we get
51:35
to wrapping up? Yeah, you know, going back to
51:38
always be mindful of when you're preparing or preserving,
51:43
identifying that evidence, document, document, document.
51:47
Be very mindful and clear about what you're documenting, what
51:51
you're collecting, how you're preserving that Don't call it
51:54
raw data, call it best evidence or derivative of that original.
52:01
And also ask to be able to produce the results of what you
52:05
did document your tools, document your versions.
52:10
You know, because I feel what you and I have done for this
52:15
episode, another examiner could come behind us.
52:18
Download the videos, follow the EXIF tool process, download the
52:23
EXIF tool, follow that and get the same results by
52:26
understanding all of that. So that's my takeaways.
52:30
Yep. And let's see, I think the other
52:33
key take away here is communication is key.
52:36
Maybe some of this mess happened because of the miscommunication
52:40
of what RAW meant, correct? So at the end of the day, we
52:44
don't see any missing 3 minutes in the middle of the video
52:48
anywhere. There is a little bit of frames
52:52
being lost over time, but there's not like where the
52:55
timestamp is rolling. Nothing is locked.
52:58
There's just slowly some frames dropping here and there.
53:01
Less than 1% of the frames were dropped.
53:04
Now, if you've watched this, you have something completely
53:07
contrary. You found something that we
53:09
missed. Please reach out and we will
53:12
just continue down this rabbit hole because we're here to
53:15
present the facts and share the facts every single time.
53:18
That's right. So until then, stay safe, stay
53:21
sharp, and as always, keep parsing the truth one bite at a
53:24
time. If you enjoyed this episode,
53:27
make sure to follow us to be notified when the next episode
53:31
drops and if you can do more parsing.
53:34
The Truth is a nonprofit organization and we are raising
53:37
money to send one lucky digital forensic examiner to IASYS
53:42
training in the spring in Orlando next year.
53:46
Head over to parsingthetruth.com to donate by clicking on the
53:51
donate button for your tax deductible donation.
53:54
Thanks. If.