EFTA00784470: Forensic iMessage Extraction From Seized Device
Snapshot
| Field | Details |
|---|---|
| Primary record | EFTA00784470 |
| Full production | EFTA00784470 through EFTA00784486 |
| Document type | Forensic device extraction report |
| Source image | NYC024362.aff4 |
| Evidence identifier | NYC024362.aff4 001 |
| Source volume | Macintosh HD |
| Extracted application data | Apple Messages database and archived iChat files |
| Message range | Messages 25,501 through 25,600 of 32,198 |
| Dates visible in this segment | April 17 and April 18, 2019, in UTC |
| Length | 17 pages |
| Public release | United States Department of Justice, Data Set 9 |
| Evidentiary status | Primary source for what appears in this forensic export, subject to redactions, extraction limits, duplication, and authentication questions |
EFTA00784470 is a 17 page forensic report showing a portion of an Apple Messages extraction associated with a device image labeled NYC024362.aff4. The report identifies the source volume as Macintosh HD and labels the evidence image NYC024362.aff4 001.
The visible messages span April 17 and April 18, 2019. They include discussions about media attention, a possible legal action, Saudi Arabia, a planned filmed interview, finance, science, the 1980s New York scene, music, philosophy, William Barr, and Robert Mueller. Most correspondent names and contact details are redacted.
The report repeatedly identifies the device user as “Self” and displays the account jeeitunes@gmail.com. The text also includes messages giving the names “Jeffrey” and jeevacation@gmail.com. Those details strongly support an association with Jeffrey Epstein, but this article does not claim that every extracted message was personally typed by him or that every statement in the messages was true.
Why This Record Matters
This production is important for two different reasons.
First, it preserves a portion of the messaging environment associated with Epstein shortly before his July 2019 federal arrest. The exchange shows active conversations about press coverage, legal exposure, public presentation, and a filmed project that would cover finance, science, and Epstein’s personal history.
Second, the report reveals how the evidence was assembled. It identifies a forensic image, a source volume, the Apple Messages database, and several archived iChat files. That structure helps researchers distinguish original message events from repeated rows created when the same communication was recovered from more than one source file.
The report does not identify who seized the device, when it was acquired, who created the forensic image, or what validation procedures were used. Those gaps matter when assessing chain of custody and authenticity.
Document Provenance
The first page identifies the source as NYC024362.aff4, with evidence ID NYC024362.aff4 001. AFF4 is a forensic evidence container format used to preserve digital evidence and related metadata. The report interface lists several categories, including calendar items, calls, contacts, messages, top contacts, and user accounts.
The final page identifies these source paths:
/Users/jee/Library/Messages/chat.db- An archived iChat file associated with the displayed name “Terje”
- An archived iChat file whose contact name is redacted
- An archived iChat file associated with the displayed name “Martin”
- A second archived iChat file whose contact name is redacted
The visible extraction therefore combines material from the active Apple Messages database and archived chat files. The report does not include a forensic examiner’s declaration, acquisition log, hash values, device serial number, or explanation of the software used to generate the pages.
What the Extraction Contains
The header describes this segment as Messages 25,501 through 25,600 of 32,198. It contains iMessage records and two SMS records. The messages are displayed in UTC.
The visible records fall into several broad groups:
- Short scheduling messages and attempts to reach contacts
- Discussion of press attention and possible legal exposure
- References to a planned filming session and the intended subjects of that session
- A pasted passage about alleged Saudi connections to two September 11 hijackers
- Exchanges about science, finance, music, philosophy, Newton, and alchemy
- Links to a Spotify album and an Oliver Sacks essay
- Comments about Attorney General William Barr and Special Counsel Robert Mueller on the day the Mueller report was publicly released
The report is not a conventional conversation transcript. It is an extraction view that merges records from several files, displays redactions, and sometimes repeats the same message.
Media Attention and Legal Discussion
On EFTA00784471, a redacted correspondent wrote that a filming session had been pushed back and that the correspondent remained in Washington, D.C. The correspondent referred to people being in “meltdown” over the following day. The message was sent on April 17, 2019, one day before the public release of the Mueller report.
The same page contains questions about whether a separate action was being brought against “u.” The device user answered no, then wrote that others had apologized but said they had no choice because “dersh would not stop.” The report does not expand “dersh,” identify the other people, specify the contemplated action, or establish what event the exchange concerned.
On EFTA00784472 and EFTA00784473, another redacted correspondent asked whether anyone was outside the device user’s residence and commented that the media had been “all over this story.” The device user answered that nobody was outside. The record does not identify the story or the residence.
These messages establish that the participants discussed press attention and possible legal developments. They do not establish the accuracy of the participants’ assumptions, the identity of the people referenced, or the existence of any unfiled legal action.
References to “Ehud,” “dersh,” and Other Partial Names
Several messages use first names, shortened names, or nicknames without enough information for conclusive identification.
- EFTA00784470 contains the message “Ehud here at 3.” The record does not provide a surname. It may refer to Ehud Barak, who had a documented association with Epstein, but this page alone does not prove that identification.
- EFTA00784471 contains “dersh.” The term may refer to Alan Dershowitz, but the extraction does not spell out the surname.
- EFTA00784474 includes a question that appears to read “Talking to rich?” The record does not identify “Rich.”
- EFTA00784478 names camera workers “Dane” and “Mattew,” with the latter likely a misspelling of Matthew. No surnames are supplied.
- EFTA00784479 through EFTA00784481 display a correspondent as “Martin.” The redacted contact information prevents a reliable surname identification.
EpsteinWiki does not convert these partial references into confirmed identities without corroborating records.
Saudi Arabia and KSA References
On EFTA00784473, the device user asked whether he was going to speak to the correspondent’s “guys” regarding “KSA.” KSA commonly abbreviates the Kingdom of Saudi Arabia, but the message does not define the acronym or identify the people involved.
On EFTA00784475 and EFTA00784476, the device user sent a long block of text discussing alleged relationships among Saudi figures, September 11 hijackers Nawaf al Hazmi and Khalid al Mihdhar, Omar al Bayoumi, Osama Bassnan, Abdussattar Shaikh, and the FBI. The visible text begins in the middle of a sentence, and the extraction does not identify its author or source.
The device user then distinguished between support “within” a government and support by the government itself. A correspondent later said that unnamed people considered a call successful and were retrieving material the device user had requested.
The pasted passage is evidence that this text was transmitted in the extracted conversation. It is not, by itself, proof that every allegation within the passage was accurate.
Planned Filming and Narrative Development
EFTA00784473 through EFTA00784479 contain the clearest sustained exchange in the production. A redacted correspondent asked whether filming could occur the next day and whether the device user’s lawyers had approved it.
The device user answered that a lawyer was unavailable but said he could discuss science or money. The correspondent replied that those were the only subjects wanted at that stage, that they were not yet approaching “your case,” and that they needed to establish the arc of the device user’s story.
The participants then discussed a filming window. The correspondent said a camera worker named Dane could arrive at noon and proposed recording from either 1 to 4 or 2 to 5. The correspondent also said another camera worker, rendered as “Mattew,” was filming in Europe.
The proposed subjects included:
- Finance
- Science
- The 1980s New York scene
The extraction shows planning for a filmed presentation. It does not identify the project, production company, intended audience, final editor, or whether the planned session occurred. It also does not identify the redacted correspondent. Any attribution of the project to a specific journalist, filmmaker, political adviser, or media organization requires evidence outside this production.
Science, Money, and Image Construction
On EFTA00784482 through EFTA00784484, the redacted correspondent asked about the device user’s scientific “verticals” and what areas had received his time, thought, and money.
The device user’s responses listed mathematics, evolution, money, finance, and music. He also referred to the difference between the unexplainable and the occult. The exchange moved to Newton, alchemy, and the philosopher’s stone.
The correspondent said that covering even one third of the device user’s science would be sufficient and stated that they were trying to show something that would “mesmerize” people.
This sequence is relevant to analysis of Epstein’s reputation management because it shows a planned narrative centered on intellectual interests, finance, and scientific patronage while discussion of “your case” was deferred. That is an evidence based interpretation of the participants’ stated filming plan, not proof of the final purpose or use of any footage.
Music, Philosophy, and an Oliver Sacks Essay
On EFTA00784479 and EFTA00784480, a contact displayed as “Martin” sent a Spotify album link and described it as beautiful. The device user replied with a question about how God could give matter thought and attributed the idea to Leibniz, whose name is misspelled in the extracted text.
On EFTA00784480 and EFTA00784481, the device user sent a New York Times link to an Oliver Sacks essay about gardens. The same link appears several times because the report recovered records from more than one source.
The extraction does not provide enough unredacted information to identify “Martin” conclusively.
Barr, Mueller, and the April 18 News Cycle
On EFTA00784485, a redacted correspondent asked what the device user thought of Barr and Mueller. The device user replied that Barr had “slammed the dems hard” and said he had read most of the report.
The exchange occurred on April 18, 2019, the date Attorney General William Barr delivered remarks concerning the release of the report on Russian interference in the 2016 presidential election. The timing supplies context for the messages. It does not show any private access to the report or contact with Barr, Mueller, or the Department of Justice.
The final phrase on EFTA00784486 appears to read “mccann a hero.” The extraction does not identify the person meant by “mccann,” and the OCR may not preserve the original spelling reliably.
Duplicate Messages Within the Report
Several communications appear twice or more. The repeated entries often have the same timestamp and text but different bracketed source numbers.
Examples include:
- The April 17 message “Tried” on EFTA00784470
- The filming arrangements on EFTA00784478
- The proposed subject list on EFTA00784479
- The Spotify and Oliver Sacks links on EFTA00784479 through EFTA00784481
- The science discussion on EFTA00784482 through EFTA00784484
- The Barr and Mueller exchange on EFTA00784485 and EFTA00784486
The source notes explain the likely cause. Source number 1 is the main chat.db database, while other source numbers point to archived iChat files. A duplicated row therefore should not automatically be counted as a second message event.
Continuity With Adjacent Extractions
This report is one segment of a much larger message export.
- EFTA00784441 contains messages 25,301 through 25,400.
- EFTA00784458 contains messages 25,401 through 25,500 in a lower quality scanned rendering.
- EFTA00784470 contains messages 25,501 through 25,600.
- EFTA00784487 continues with messages 25,601 through 25,700.
Researchers should read these neighboring records together when reconstructing a conversation. A message can begin on the final line of one page or segment and continue on the next. Context may also appear in earlier or later message groups.
Evidence Appearances
| EFTA identifier | Visible material | Evidentiary caution |
|---|---|---|
| EFTA00784470 | Extraction header, evidence image, message range, “Terje,” and “Ehud here at 3” | First names and redacted contacts do not support conclusive identification |
| EFTA00784471 | Delayed filming, Washington, D.C., media concern, possible separate action, and “dersh” | The legal matter and nickname remain unidentified |
| EFTA00784472 | SMS error, two email addresses, the name Jeffrey, and question about people outside a residence | The record does not identify the recipient or location |
| EFTA00784473 | Media discussion, filming request, and KSA reference | KSA is not defined in the extraction |
| EFTA00784474 | Breakfast planning, duplicate Terje records, and questions about calls | Several brief messages lack context |
| EFTA00784475 | Beginning of pasted text about Saudi and September 11 connections | Source and author of the pasted text are not shown |
| EFTA00784476 | End of pasted text, government distinction, call follow up, and filming schedule | The participants’ statements are not independent findings |
| EFTA00784477 | Lawyer availability, science and money subjects, and “arc” of the story | Project and correspondent are redacted |
| EFTA00784478 | Camera workers and proposed filming times | Duplicate rows reflect multiple source files |
| EFTA00784479 | Finance, science, 1980s New York, and Spotify link from “Martin” | Martin’s surname is not established |
| EFTA00784480 | Spotify link, music comment, Leibniz reference, and Oliver Sacks link | Link rows are duplicated |
| EFTA00784481 | Repeated Oliver Sacks link and reaction from a redacted correspondent | Repetition should not be counted as separate sending events without database review |
| EFTA00784482 | Scientific “verticals” and device user’s stated interests | Statements reflect self presentation, not proof of expertise or patronage |
| EFTA00784483 | Science funding question, unexplained versus occult, Newton and alchemy | Redacted correspondent remains unidentified |
| EFTA00784484 | Philosopher’s stone and strategy for science filming | Extraction contains spelling errors and duplicate rows |
| EFTA00784485 | Hawaii, Barr, Mueller, and political reaction | No evidence of private government contact |
| EFTA00784486 | Final political comment and forensic source notes | “mccann” is not identified; source notes do not supply full chain of custody |
What the Record Establishes
The production supports the following limited conclusions:
- A forensic report was generated from an evidence image labeled NYC024362.aff4.
- The report associates the evidence image with a Macintosh HD volume.
- The extracted data includes the Apple Messages database and archived iChat files.
- This segment displays messages 25,501 through 25,600 of a reported 32,198 messages.
- The visible messages are dated April 17 and April 18, 2019, in UTC.
- The report displays “Self” with the account jeeitunes@gmail.com.
- The messages discuss media attention, possible legal exposure, Saudi Arabia, filming, finance, science, music, philosophy, Barr, and Mueller.
- Several rows are duplicated because the report draws from multiple message sources.
- Most correspondent identities and contact details are redacted.
What the Record Does Not Establish
The production does not establish:
- Who seized or supplied the device
- The date, place, or legal authority for acquisition
- Who created the AFF4 image
- The hash values of the source device or forensic image
- Whether every account user was the same person
- Whether Jeffrey Epstein personally typed every message attributed to “Self”
- The identities of redacted correspondents
- The surnames of Terje, Martin, Ehud, Rich, Dane, or Mattew
- The identity of “dersh” or “mccann”
- Whether the planned filming occurred
- Who commissioned, produced, owned, or edited the proposed footage
- Whether any proposed legal action was filed
- Whether statements copied into messages were accurate
- Whether deleted, unsent, edited, or inaccessible messages existed outside the produced data
- Whether the production is complete
Authentication and Chain of Custody Limits
The visible report has meaningful forensic markers, including an evidence container name, an evidence ID, a source volume, application database paths, archived chat paths, timestamps, and message source numbers. Those features make it more informative than an isolated screenshot.
However, the 17 pages do not provide a complete chain of custody. They do not show an examiner’s name, acquisition date, validation log, cryptographic hash, warrant return, evidence transfer record, or forensic methodology report.
The extraction also contains redactions, typographical inconsistencies, broken links, OCR errors, and repeated rows. Researchers should rely on the PDF image when exact punctuation or spelling matters and should avoid treating the extracted text layer as flawless.
Survivor Centered Reading Note
This record primarily concerns Epstein’s communications, media strategy, and intellectual self presentation. It should not be allowed to shift attention away from the survivors whose reports and testimony established the human cost of his conduct.
Discussion of Epstein’s science interests, wealth, political opinions, or access to prominent people does not mitigate his criminal conduct or the institutional failures surrounding it. The most relevant accountability question is how communications and planned media activity may have helped him manage reputation and influence after his 2008 conviction.
Fact Check
| Claim | Finding | Basis |
|---|---|---|
| EFTA00784470 is a forensic Messages extraction | Confirmed | Header and source notes in EFTA00784470 and EFTA00784486 |
| The report comes from DOJ Data Set 9 | Confirmed | Epstein Data document metadata and the DOJ source path |
| The report is 17 pages | Confirmed | EFTA00784470 through EFTA00784486 |
| The segment covers messages 25,501 through 25,600 | Confirmed | Extraction header on EFTA00784470 |
| The source image is NYC024362.aff4 | Confirmed | Device details and notes on EFTA00784470 and EFTA00784486 |
| The report identifies Jeffrey Epstein as the device owner | Not stated in a formal ownership field | The device user is “Self,” the account jeeitunes@gmail.com is displayed, and messages include “Jeffrey” and jeevacation@gmail.com |
| “Ehud” is Ehud Barak | Plausible but unconfirmed in this record | Only the first name appears |
| “dersh” is Alan Dershowitz | Plausible but unconfirmed in this record | Only the shortened reference appears |
| “Martin” is a particular known Epstein associate | Unconfirmed | Surname and contact details are redacted |
| A filming session occurred | Unconfirmed | The messages show planning, not completion |
| The redacted correspondent was a specific known filmmaker or adviser | Unconfirmed | The report does not reveal the identity |
| Epstein had advance access to the Mueller report | Not supported | The exchange occurred on the public release date and contains no evidence of private access |
| Every repeated row represents a separate message | Not supported | Identical timestamps and source notes indicate recovery from multiple files |
Questions Still Unanswered
- Which agency acquired the source device, and under what legal authority?
- When and where was the forensic image NYC024362.aff4 created?
- What are the cryptographic hashes for the device image and extracted database?
- Which forensic program generated the report?
- Who controlled the jeeitunes@gmail.com account during the relevant period?
- Who are the redacted correspondents discussing media coverage, legal action, KSA, and filming?
- Do other records conclusively identify “Ehud,” “dersh,” “Rich,” “Martin,” “Dane,” “Mattew,” or “mccann”?
- What event or story prompted the questions about media outside the residence?
- What separate legal action was under discussion?
- What did “KSA” mean in this conversation, and who were the “guys” referenced?
- What source supplied the long pasted passage about Saudi connections and September 11?
- What material did unnamed people agree to retrieve after the call?
- Who commissioned the proposed filming?
- Did the April 18 filming session occur, and where is the resulting footage?
- Were Epstein’s lawyers shown or asked to approve the planned subjects?
- Was the project intended as journalism, biography, documentary production, political strategy, litigation preparation, or reputation management?
- Are original database records, attachments, reactions, delivery states, and message GUIDs preserved elsewhere in the production?
- Why are some archived file names and paths misspelled or incompletely rendered?
- Are there acquisition logs, examiner notes, warrants, hash reports, or custody records that authenticate this extraction more fully?
Related EpsteinWiki Pages
- Jeffrey Epstein
- Epstein Email Communications Index
- Ehud Barak
- Alan Dershowitz Legal Actions Connected to Jeffrey Epstein
- Alan Dershowitz “Off the Record” Response Regarding Jeffrey Epstein
The Ehud Barak and Alan Dershowitz links provide background on people who may be referenced by partial names. Their inclusion does not convert the ambiguous terms in this extraction into confirmed identifications.
Source List
- EFTA00784470, complete 17 page production at Epstein Data
- EFTA00784470, PDF copy at Epstein Data
- EFTA00784470, Department of Justice Data Set 9
- EFTA00784441, preceding Messages extraction
- EFTA00784458, immediately preceding Messages segment
- EFTA00784487, immediately following Messages extraction
- Department of Justice remarks concerning the April 18, 2019 release of the Mueller report