Timeline Analysis of Desktop Property # 0214 207268 HDD Image Z6E8M349.E01 (Device 1)

Timeline Analysis of Desktop Property # 0214 207268 HDD Image Z6E8M349.E01 (Device 1) Important Identifiers: User: Michael Thomas Username: BOP19012 SID: S-1-5-21-1823249720-3210992811-1527010081-1102 SID: Microsoft Security Identifier Date Time Action 8/10/2019 0:36:54 User BOP19012 Successfully Logged onto the System 8/10/2019 0:38:36 User launches GroupWise (grpwise.exe) 8/10/2019 0:39:31 User saves/downloads document named "SHU 30 CHECK SHEET (CONDENSED)_1.docx" to location "CAUsers \bop19012 \ Documents \GroupWise 8/10/2019 0:39:31 The "SHU 30 CHECK SHEET (CONDENSED)_1.docx" Word Document is also opened at this time. 8/10/2019 0:40:10 The GroupWise program crashes 8/10/2019 0:40:14 The GroupWise program reloads 8/10/2019 0:43:00 Last Printed timestamp indicates "SHU 30 CHECK SHEET (CONDENSED)_1.docx" was printed 8/10/2019 0:44:19 User saves/downloads document named "SHU Rules Metropolitan Correctional Center New York.docx" to location "CAUsers\bop19012\DesktopV 8/10/2019 0:44:19 The "SHU Rules Metropolitan Correctional Center New York.docx" Word Document is also opened at this time 8/10/2019 0:44:53 User opens document named "SHU ORDERLY REQUEST 42214.rtf" from location "C: \Users \bop19012 DesktopV 8/10/2019 0:45:58 User launches Calculator (calc.exe) 8/10/2019 0:48:20 User opens document named "1- SHU LOCATOR 2019(HARDCOPY).docx" from network location "\\NYMC_GRPS_SERVER\GRPS\GROUPS\SHAREDOC\SHU PAPERWOF 8/10/2019 0:49:11 Execution of splwow64.exe by user BOP19012 indicates something was printed from the system 8/10/2019 0:50:50 User launches Calculator (calc.exe) 8/10/2019 0:53:20 User continues to access document named "1- SHU LOCATOR 2019(HARDCOPY).docx" from network location 8/10/2019 0:53:31 User launches Internet Explorer (iexplorer.exe) 8/10/2019 0:53:35 User is navigated in IE to "iellwelcome.microsoft.com/" 8/10/2019 0:53:37 User is navigated in IE to "http://sallyport.bop.gov/" -- Internet Explorer Hompage 8/10/2019 0:53:48 User navigates in IE to "http://sallyport.bop.gov/inst/nym/index.jsp" 8/10/2019 0:53:55 User navigates in IE to "http://sallyport.bop.gov/inst/nym/corrsvc/index.jsp" 8/10/2019 0:54:01 User navigates in IE to "http://sallyport.bop.gov/inst/nym/corrsvc/nymofficer.jsp" 8/10/2019 0:54:06 User opens document named "Daily Fire & Security Form[1].pdf" in Internet Explorer from "http://sallyport.bop.gov/inst/nym/corrsvc/docs/" 8/10/2019 0:56:46 User launches Internet Explorer (iexplorer.exe) 8/10/2019 0:56:49 User is navigated in IE to "http://sallyport.bop.gov/" -- Internet Explorer Hompage 8/10/2019 0:57:18 User open Microsoft Database named "Roster.accde" at "\\NYMC_APPS_SERVER\APPS\BOPAPPS\Roster\Ver3.1\" EFTA00062276 8/10/2019 0:59:22 User launches GroupWise (grpwise.exe) 8/10/2019 1:00:24 User searches Bing for "cycletrader" 8/10/2019 1:00:28 User navigates in IE to "https://www.cycletrader.com/" 8/10/2019 1:00:31 User navigates in IE to "https://www.cycletrader.com/myt/saved-listings/myListings?_=1565413229430" 8/10/2019 1:00:52 User searches Google for "suzuki gsx-r 750 motorcycle for sale" 8/10/2019 1:00:54 User navigates in IE to "https://www.cycletrader.com/Suzuki-Gsx-R-750/motorcycles-for-sale?type=motorcycle%7C356953&make=suzuki%7C2320128&model=gsx-r9 8/10/2019 1:01:21 User navigates in IE to "https://www.cycletrader.com/userSavedListings" 8/10/2019 1:02:14 User navigates in IE to "https://www.cycletrader.com/" 8/10/2019 1:02:18 User searches "gsxr" on "https://www.cycletrader.com/" 8/10/2019 1:02:25 User navigates in IE to "https://www.cycletrader.com/motorcycles-for-sale" 8/10/2019 1:03:16 User searches Google for "suzuki gsx-r 1000 motorcycle for sale" 8/10/2019 1:03:02 User Internet Activity Ends 8/10/2019 1:03:02 User activity on the system stops 8/10/2019 1:13:49 Screen Pass is Executed by System/User - Computer System is Locked 8/10/2019 5:14:10 User is logged off from the system 8/10/2019 6:03:30 User BOP19012 Successfully Logged onto the System 8/10/2019 6:03:41 User searches "shu" in Windows Explorer 8/10/2019 6:12:15 User launches GroupWise (grpwise.exe) 8/10/2019 6:14:15 User launches Internet Explorer (iexplorer.exe) 8/10/2019 6:14:21 User is navigated in IE to "http://sallyport.bop.gov/" -- Internet Explorer Hompage 8/10/2019 6:15:03 User searches Bing for "espn" 8/10/2019 6:15:07 User navigates in IE to "https://www.espn.com/nfl/" 8/10/2019 6:19:05 User Internet Activity Ends 8/10/2019 6:19:05 User activity on the system stops 8/10/2019 6:29:07 Screen Pass is Executed by System/User - Computer System is Locked 8/10/2019 8:55:12 User is logged off from the system EFTA00062277 EFTA00062278 i7C764861123&trim=750%7C3160&zip=08832&radius=150" EFTA00062279 Timeline Analysis of Desktop Property k 0214 207270 HDD Image Z6E8K1EV.E01 (Device 2) Important Identifiers: User: Tova Noel Username: 60P61232 S-1-5-21-3548300276-3289552418-2794689317-1126 Microsoft Security Identifier Date Time Action 8/9/2019 23:40:11 User BOP61232 falls to Login - Incorrect Password 8/9/2019 23:40:27 User BOP61232 Successfully Logged onto the System 8/9/2019 23:41:28 User launches Mkrosft Access IMSACCESS.EXE) 8/9/2019 23:42:55 User launches Internet Explorer (lexplorer.exe) 8/9/2019 23:43:04 User Is navigated In IE to "hnp://sallypon.bop.govP — Internet Explorer Hompage 8/9/2019 23:43:12 User searches Google for 'ebenefits' 8/9/2019 23:43:21 User navigates in IE to littpsnvw.w.ebenefits.va.gov/" 8/9/2019 23:43:27 User navigates in IE to lotpsnmyaccess.dmdc.osd.mil/Identitymanagement/authenticate.do?gotoUrl.haps://myaccess.dmdc.osd.mil/opensso/SAMUtwareSeivletnARGET=Imps://eauth.va.gov/ebenefits-portal" 8/9/2019 23:44:01 User navigates in IE to lotpsneauthsa.gov/ebenefits-portal' 8/9/2019 23:45:40 User searches Google for 'What does it mean by VA claim contention Input' 8/9/2019 23:46:16 User navigates in IE to lotp://vmw.benefits.va.gov/warms/docs/admin21/m21_11mr/part3/subptli/ch07/m21-1IIIJI_7.doc" - Attachment Al 8/9/2019 23:47:06 User types In the URL"Mtps://www.amazon.comr 8/9/2019 23:53:42 User Internet Activity Ends 8/9/2019 23:53:42 User activity on the system stops 8/10/2019 0:13:53 Screen Pass is Executed by System/User -Computer System Is Locked 8/10/2019 3:55:42 Computer Is unlocked by user 80P61232 8/10/2019 3:55:56 Website "itovw.amazon.comr Is accessed by user. Likely indicator that the web browser was left open and accessed at this time. 8/10/2019 3:55:59 User navigates in IE to Thnps://10.33.56.106/TRUACaSS/Login.aspe 8/10/2019 3:56:19 User navigates in IE to Imps://10.33.56.106/TRUACCESS/Dashboard.aspx" 8/10/2019 3:56:27 User navigates in IE to "https://10.33.3.57/RunTruscope.aspe 8/10/2019 4:30:58 User launches GroupWise (grpwise.exe) 8/10/2019 4:31:19 User launches Internet Explorer (lexplorer.exe) 8/10/2019 4:32:21 User Is navigated In IE to "http://sallypon.bop.govt — Internet Explorer Hompage 8/10/2019 4:31:28 User searches Google for 'epp' 8/10/2019 4:31:34 User navigates in IE to Imps://vmw.nfcusda.gov/personaV" 8/10/2019 4:33:13 User searches Bing for "calendar 2019" 8/10/2019 4:35:51 User searches Google for "unum Insurance" 8/10/2019 4:36:02 User navigates in IE to lotps://www.unum.cornr 8/10/2019 4:36:15 User navigates in IE to lotps.//www.unum.com/employeee 8/10/2019 4:36:39 User navigates in IE to'https://www.unumcom/employees/benefits' 8/10/2019 4:36:47 User navigates in IE to'https://www.unumcom/employees/benefts/disablllty-Insurance" 8/10/2019 4:38:45 user searches Google for "usincibs" 8/10/2019 4:39:12 User navigates in IE to littps://vnwe.usaJobs.gov/Searchr 8/10/2019 4:48:07 User searches Google for 'furniture bronx ny' 8/10/2019 4:48:47 User navigates in IE to 'hitps://w1W/.mybobs.com/stores/new-york/bronx-co•op-tlty" 8/10/2019 4:49:11 User navigates in IE to lotps://vmw.mybobs.com/c/bedroom-sets" 8/10/2019 4:50:47 User navigates in IE to lotps://vmw.mybobs.com/furniture/bedroom/bedroom-sets/maJestic-king-bedroom-set/p/20023186" 8/10/2019 4:52:00 User searches Google for "ashleys furniture 8/10/2019 4:55:13 User launches Internet Explorer (lexplorer.exe) 8/10/2019 4:55:19 User Is navigated in IE to "hop://sallypon.bop.govr — Internet Explorer Hompage 8/10/2019 4:55:25 User searches Google for "ashleys furniture 8/10/2019 4:56:03 User navigates in IE to lotps://wvwe.ashleyfurniture.com/c/furniture/sets/bedroorn-setsP 8/10/2019 4:56:56 User types In the URL"Mtps://www.raymourflanIgan.comr 8/10/2019 4:57:26 User navigates in IE to lotps://www.raymoudlanigan.com/hempsteadaing-bed-597155007.aspx" 8/10/2019 5:03:07 User Internet Activity Ends 8/10/2019 5:03:07 User activity on the system stops 8/10/2019 5:11:34 User launches Internet Explorer (lexplorer.exe) 8/10/2019 5:11:38 User Is navigated In IE to "Mtp://sallypon.bop.govr — Internet Explorer Hompage 8/10/2019 5:14:02 User searches for Last Name 'noel' in BOP Staff Directory — hnps://sallypon.bop.gov/StaffEtirectory/execute/sdStafthirectory?action=sd_actionsearch&(acilityCocka&lastNamernoel&firstName•&recordsPerPage=25 8/10/2019 5:16:34 User launches GroupWise (grpwlse.exe) 8/10/2019 5:17:32 User launches Mkrosft Access IMSACCESS.EXE) 8/10/2019 5:18:15 User launches Internet Explorer (lexplorer.exe) 8/10/2019 5:18:18 User open Microsoft Database named Itostetaccde at ifile:///K:/80PAPPS/Roster/Ver3.1/Roster.accde 8/10/2019 5:18:20 User navigates in IE to Thttps://10.33.56.106/TRUACaSS/Login.aspx" 8/10/2019 5:18:56 User navigates in IE to lotps://10.33.56.106/TRUACCESS/Dashboard.aspx" 8/10/2019 5:19:00 User navigates in IE to lotps://10.33.56.106/truaccess/ApplicationLaunchetaspe 8/10/2019 5:19:06 User navigates in IE to lotps://10.33.3.57/Dashtoard.aspe 8/10/2019 5:27:30 User launches Internet Explorer (lexplorer.exe) 8/10/2019 5:27:34 User Is navigated in IE to "hop://sallypon.bop.govP — Internet Explorer Hompage 8/10/2019 5:27:54 User searches Google for "KENYATTA TAISTE" 8/10/2019 5:28:05 User activity on the system stops 8/10/2019 5:38:54 User searches Google for 'KENYATTA KHAN' 8/10/2019 5:39:23 User navigates in IE to Imps://lmfromdriftwood.com/tag/kenyatta-taister 8/10/2019 5:41:49 User navigates in IE to 'hnpsf/pose-fx.fandom.com/wlkiLady_Kenyatta_Talste" 8/10/2019 5:42:06 User searches Google for "KENYATTA TAISTE" EFTA00062280 8/10/2019 5:42:28 User searches Google for 'KENYATTA KHAN' 8/10/2019 5:42:50 User searches Google for latest on epstein In Jail' 8/10/2019 5:43:03 User navigates in IE to Thitps://bwew.cnbc.com/2019/08/09/documents-released-aboutieffrey-epstein-and-ghislaine-maxwell.htmr 8/10/2019 5:46:06 User navigates in IE to littps://wbwe.google.comiurtha.t8dct.j&q.&esrczs&sourcemweb&cd=2&ved=2ahUKEwp)02(FglAhVKT98KHO.kbDzwQOPADMAF6EIAgAFAk&uthhttps%3A%2F%2Fktla.com%2F2019962F08%2F09162F)effrey-epsteln.repeatedly-refused-to-answer-questlons-about-allegations-he-orchestrated-sex-trafRcking-ring-documents%2F8tusg=ACNVaw3ISUNS06WDlzbkDale9K5C" 8/10/2019 5:52:29 User searches Google for latest on epstein In Jail' 8/10/2019 5:53:02 User searches Google for latest on omar amanat' 8/10/2019 5:53:38 User navigates in IE to littps://nypostcomitagiomar-amanatr 8/10/2019 5:54:39 User navigates in IE to 'hups://wbwelustice.goviusao-sdny/priformer-owner-and-manager-dubal.based-investment-fund-found-gullty-inanhattan-federal" 8/10/2019 5:54:58 User navigates in IE to 'hups://wbwelaw360.com/anIcles/1148332/ex-cfo-of-fraud-ridden-video-startup-spared-more-prison' 8/10/2019 5:58:32 User searches Google for latest on omar amanat' 8/10/2019 5:58:47 User opens file from IE named "nysd-1_2015-cr-00536-446092-00792(1).pdf" -- SENTENCING MEMORANDUM OF OMAR AMANAT 8/10/2019 6:01:55 User launches GroupWise (grpwise.exe) 8/10/2019 6:12:22 Screen Pass is Executed by System/User -Computer System is Locked 8/10/2019 6:16:43 Computer is unlocked by user 80P61232 8/10/2019 6:16:52 User launches Internet Explorer (lexplorer.exe) 8/10/2019 6:16:54 User Is navigated In IE to "hnp://sallypon.bop.govt — Internet Explorer Hompage 8/10/2019 6:17:05 User searches Google for law enforcement discounts' 8/10/2019 6:17:33 User navigates in IE to'httpsd/wbwr.badgedlscounts.com/" 8/10/2019 6:18:31 User navigates in IE to 'hups://proudpolicewife.cornithe-mega-list-of-law-enforcement-discountsr 8/10/2019 6:19:03 User searches Google for law enforcement discounts' 8/10/2019 6:19:10 User navigates in IE to 'hups://bwew.verizonwireless.com/supportifirst-responders-discounts-faqsr 8/10/2019 6:19:22 User Internet Activity Ends 8/10/2019 6:19:22 User activity on the system stops 8/10/2019 6:31:28 Screen Pass is Executed by System/User -Computer System is Locked 8/10/2019 10:31:40 User Is logged off from the system EFTA00062281