MESA COUNTY CLERK E RECORDER Board of County Commisioners SEP 17 2021 CONFIDENTIAL LEGAL DOCUMENTS EXEMPT FROM COLORADO OPEN RECORDS ACT Hon. Janet Rowland, Chair, Board of County Commissioners Scott Melnnis, County Commissioner Cody Davis, County Commissioner 544 Rood Avenue Grand Junetion, CO 81501 RI Forensic Report No. | on EMS Server Images Dear Commissioners: Enclosed is the first report from the cybersecurity experts who have analyzed thoroughly the two forensic images of the drive of the DVS Democracy Suite Election Management System in my office which we used for the management of the 2020 election. Because the report documents a substantial amount of data destruction during the May 25 “Trusted Build” conducted by the Secretary of State's office and the vendor, I wanted to get this in your hands immediately. 1 just received this report today. From my review of the executive summary, it does appear that my concerns were more than justified. As you know, the legal duty to preserve election records falls solely to me and my office, “Extensive” amounts of data required to be preserved were instead destroyed, and done in a way that was totally beyond my control or knowledge. Among other these deletions would preclude a forensic audit of the last election. ‘Thanks to the pre-Trusted Build image I had commissioned in May, these data have been preserved, in full compliance with my obligations under federal and state law, preserving the integrity of our county’s election record archive and permitting a forensic audit if one were conducted. According to this report, the forensic examination has determined that this system and procedures “cannot meet the certification requirements of the State of Colorado and should not have been certified for use in the state.” Obviously, this is highly relevant to any decision whether to continue (o use these systems in our county. "You already know of my opposition to continued use of these systems, which prevent me from discharging the duties of my office and the requirements of the law, ‘The experts conducting the forensic analysis are apparently issuing additional reports in the near future, and of course | will promptly deliver these to you. In the meantime, | would welcome a discussion of these findings and the proper course forward for our county to preserve the integrity of our elections. Very truly yours, A, CMa Tina M. Peters Tina M. Peters Mesa County Clerk & Recorder 2005S. Spruce Street | Grand Junction, CO 81501 Tina.Peters@MesaCounty,US Office (970) 244-1714Mesa County Colorado Voting SystemsMesa County, Colorado, Voting Systems Report #1 with Forensic Examination and Analysis 15 September 2021Table of Contents Executive Summary. Introduction Legal References. Forensic Examination and Analysis Report .. Forensic Analysis System Identification Authenticity and Chain of Custody.. FINDINGS Overview of System Data Sources Server Disk Partition Structure Overwritten..... Website Server Log Files Missing... Server Microsoft SQL Server Installation Log Files Missing. Server Microsoft SQL Server Log Fil 5 Missing. EMS Server Dell Server Updates Missing.. Server ‘Administrator’ WebCache Log Files Overwritten Server ‘emsadmin’ WebCache Log Fil 's Overwritten.. Server SQL Server Management Studio (SSMS) Log Files Overwritten, ‘Server CBS Log Files Overwritten.. Server Election Databases Missing... Server Event Logs Missing/Overwritten Server System Users are Missing... Server Virtual Directories Log Files Missing... Server Windows Defender Log Files Missing/Overwritten, Server List of .log files in Before Image that were Deleted... Significant Number of Logfiles Missing List of .evtx Event Log Files deletes Analysis Summary Conclusion. Appendix A. Deleted *.log" files after Dominion Trusted Build update. Appendix B. Supporting Documentation: File details and hash sets for screenshots Appendix C. Microsoft EVENT log files... Appendix D. List of Figures... Appendix E. 2002 Voting Systems Standards (VSS)EXECUTIVE SUMMARY This report documents initial findings in an ongoing forensic examination of the voting systems of Mesa County, Colorado, used in the November, 2020 General Election. These voting systems represent a portion of overall election systems infrastructure, and this report fed to the findings of an ongoing investigation. The findings in this report were prepared by the cyber forensic expert retained to advise the County Clerk pursuant to her duties as the county's Chief Election Official as part of the impacted parties’ legal team. Federal law requires the preservation of election records ~ which includes records in electronic or digital form — for ‘twenty-two months after an election. Colorado law requires the preservation of election records for an additional three months beyond the Federal requirement. The obligation to ensure the integrity of elections and thatall election records are preserved pursuant to federal and state law falls to the elected Clerk & Recorder. This report, the first of several, is based on examination of the data obtained from forensic images of the Dominion Voting System EMS server last used in Mesa County for the November, 2020, election, images taken in furtherance of the preservation requirements of federal and state law. Based upon information received by the Clerk's office from various sources in early 2021, the Clerk became concerned that the voting system modifications might jeopardize these preservation and other legal requirements under the responsibilty of the County Clerk. For this reason the Clerk ensured a full backup of election records from the County voting systems, both before and after the software modification performed by the vendor and the Secretary of State on May 25-26, 2021, just six months after the November, 2020, election Forensic examination’ found that election records, including data described in the Federal Election Commission’s 2002 Voting System Standards (VSS) mandated by Colorado law as certification requirements for Colorado voting systems, have been destroyed on Mesa County's voting system, by the system vendor and the Colorado Secretary of State’s office. Because similar system modifications were reportedly performed upon county election servers across the state, itis possible, if not likely, that such data destruction in violation of state and federal law has occurred in ‘numerous other counties. The extent and manner of destruction of the data comprising these election records is consequential, precluding the possibility of any comprehensive forensic audit of the conduct of any involved election. This documented destruction also undermines the conclusion that these Colorado voting systems and accompanying vendor and Colorado Secretary of State-issued procedures could meet the requirements of Colorado and Federal law, and consequently vitiates the premise of the Colorado Secretary of State certification of these systems for use in Colorado. Two backup images, using forensic imaging methods, were obtained from the Dominion Voting Systems (OVS) Democracy Suite (D-Suite) Election Management System (EMS) Standard Server in Mesa County, Colorado. The first image was made of that EMS Standard Server in the D-Suite 5.11-CO version configuration, as used in the November, 2020 election. The second image was of the configuration of the EMS Standard Server in the D-Suite 5.13 version configuration, following the modification of the EMS Standard Server by a combined team of DVS vendor personnel and Colorado Secretary of State staff. The forensic information provided in this report is presented using screenshots from forensic analysts’ systems running industry-standard forensics software tools. The report includes "before" and “after” screenshots from the forensic tool that shows the differences between the two backup images. The forensic examination found that numerous logfiles had been deleted or overwritten. These logfiles are required to reconstruct the function of and events taking place on the the voting systems, and based upon information * Many individuals and organizations, some public officials, have made recent claims that no audit performed nor examination conducted on elections or computer-based election systems can be legitimate or credible unless the examiners are “election experts" or accredited election auditors. There is no such thing as an “accredited election auditor,” nor are there Federal standards or procedures to credential election auditors.provided by legal counsel, must, by law, be preserved. By comparing filenames in the two images (before and after the Dominion update on May 25-26, 2021), examination and analysis identified a total of 28,989 files that were deleted. During a software update, some replacement of program files and their related content is normally expected. However the examination found that 695 log and event log files necessary for the determination of election integrity were deleted. Based upon information provided by legal counsel, Colorado law (Colorado Revised Statute (CRS) § 1-5-601.5) requires that, prior to use in Colorado elections, electronic and computer-based voting systems be certified by the Colorado Secretary of State. This certification is based on the systems’ compliance with the requirements of the Federal Electon Commission's 2002 Voting System Standards (VSS), verified by their testing by a Federally-accredited (by vote of the U.S. Election Assistance Commission (EAC)) Voting System Testing Lab (VSTL). While several iterations of newer Voluntary Voting System Guidelines (VVSG) have been issued by the EAC, Colorado's statutory requirement is for compliance with 2002 VSS, which states: “Election audit trails provide the supporting documentation for verifying the accuracy of reported election results, They present a concrete, indestructible archival record of all system activity related to the vote tally, and are essential for public confidence in the accuracy of the tally, for recounts, and for evidence in the event of criminal or civil litigation." The relevant sections of the VSS are cited in Appendix E, ‘These statutory requirements establish that voting systems are required to generate and preserve, as critical to the ability to determine and reproduce the conditions and details of election conduct using these systems, logfiles of all system functions, including normal activity, connectivity, file and data access, operator- and automated-processes, and errors. Logfiles are critical to the ability to detect improper operation, including the ability to detect malicious intrusions as well as other improper activities and conditions, and configuration changes that could enable alteration of the actual vote count. Assuming this information to be correct, this forensic examination found that a substantially large number of these requirements have not been met. This examination also found that destruction of critical logfiles has occurred. This destruction is not incidental or minor but is extensive. The purpose of this initial report is to document these findings and present preliminary evidence demonstrating unacceptable conduct and system defects revealed by the examined images, as necessary for the Chief Election Official to discharge her statutory obligations. The facts and resultant findings support the conclusions that: 1) Election-related data explicitly required to be preserved, as stated in the 2002 VSS criteria referenced in this section, have been destroyed in violation of Federal and State law, and 2) Due to non-compliance with the 2002 VSS requirements, these voting systems and accompanying vendor-provided, Colorado Secretary of state-approved procedures cannot meet the certification requirements of the State of Colorado, and should not have been certified for use in the state. Comprehensive investigation is required to determine whether these critical failures are the result of malicious intent cor negligence, and to what extent the systems may have been compromised or subjected to unauthorized access or operation prior to, during, and after election use. That comprehensive investigation is beyond the scope of this report. Subsequent reports will address these issues in detail. Evidence supporting all of these findings is documented in this report.Introduction Election officials, including Secretaries of State, are obligated by law to ensure the integrity of all elections, including the transparency required for citizens to verify that integrity themselves. Modern electronic voting systems are marketed as an efficient solution to streamline the voting process and allow for automated collection, tabulation, and reporting of election results, but the efficiency they promise comes at a cost. ‘The necessary measures and safeguards to ensure the integrity of the systems and their operation against a severe, ‘mounting and ever-evolving threat from sophisticated nation-state and non-nation-state actors are so complex and dynamic as to outpace the limited capabilities and resources of our government, at all levels. While minimal security safeguards may be within government capacity, modern computer-based voting systems are extremely complex and difficult to secure, even for cybersecurity experts, and since voting systems are not under the direct control of the Federal government's top security experts, any government assurances about the sufficiency of those safeguards can serve only to mislead citizens and policy-makers. Even critical defense systems, relentlessly monitored and defended by highly-trained teams using costly, sophisticated tools, are at risk and are frequently compromised, sometimes before procurement. Earlier generations of voting systems relied on simple, human-scale safeguards, for example "air gaps" that is ~ to have no wired network connection to the system. But miniaturized wireless communication technologies and networks have proliferated, with billions of wireless devices installed or in use, and malicious actors have developed sophisticated attacks to bypass air gaps, compromise every kind of hardware, firmware, and software, often before they even come into customer or user possession, and to move laterally through networked systems, often undetected. Supply-chains for these systems, from the initiation of the design of integrated circuits and electronic components, most manufactured overseas with little U.S. insight or oversight, through the fabrication, testing, assembly, integration, and operation of these complex composite systems, are vulnerable and untrustworthy for critical functions of government and lucrative economic and national security targets. For all these reasons logfiles, such as those that have been deleted by the Dominion "Trusted Build” update must be preserved to document the complete operation of the computer system and voting applications, and to be able to verify the authenticity, integrity and accuracy of the vote. The feature size of individual circuits in the chipsets and components of our voting system computers is at the ‘nanoscale, smaller than the smallest known virus particle, and less than 3/10,000ths of the width of a human hair. So we have lost the ability, if we ever had it, to visually verify what is really happening, even at the physical level, in ‘our computer-based voting system. Regardless of how the systems appear to be configured to authorized users and poll-watchers, the functionality and connectivity in these computers can be enabled and modified remotely and wirelessly, or by the introduction of embedded codes on scanned paper, or triggered by specific unforeseeable and indiscernible predetermined software and hardware conditions, or by specific timing events, or by geographic location, or by the proximity of other devices or combinations of any of these means. For example, some Colorado voting systems ordered as specified by the voting system vendors, from foreign manufacturing and assembly facilities, have included “integrated Dell Remote Access Controllers (IDRAC),” which are designed to allow “out-of-band” remote management of those systems, meaning that the computers are explicitly equipped to be controlled by remote automated programs or by individuals other than those logged in locally. Through the IDRAC, voting systems might have any aspect of their Basic Input/Output System (8I0S), operating system, or applications controlled or modified, including the addition and deletion of user accounts, the enabling of communications components {ike wireless networking cards, and the modification, installation, removal or configuration of software and settings. Like the inclusion of multi-band wireless networking cards, similarly specified and ordered for Colorado voting systems by the vendor, there is no excuse or rational justification for the inclusion of components like these, and the fact that the entirety of U.S. voting system regulatory processes and institutions can apparently neither detect, note, nor address these gross vulnerabilities eviscerates the notion that our computer- based voting systems have been secured.Faced with incredible miniaturization, the importance of logfiles which are records of operation of a computer system, are more important than ever in managing this technology. When the computer is part of a national critical infrastructure, these operational records become essential, not only for troubleshooting or security alone, but for the integrity of the system itself as a component of the National Critical Infrastructure. For the purposes of this document and ensuing discussion, two terms are defined to differentiate and clarify the evidentiary findings. Election Data is all information regarding Ballot Design, Ballot Marking, Electronic scanning of completed ballots, interpretation of the intention of each voter's choice, including human, machine generated or programatic adjudication in the event that the election system is unable to determine conclusively the correct vote input from any specific ballot, tabulation of the actual vote including the databases used to actually contain the raw vote totals, scanned ballot images and Voter Registration and Voter identification information associated with any specific election, as well as the actual vote totals. This includes a complete record of any realtime changes in databases resident in the cloud such as voter registration data. Election-Related Data includes all of the computer log and configuration data that document the complete configuration state and operation of the entire computer system and infrastructure upon which Election Software is executed, as well as the operating system of devices that store log and election data such as Network Attached Storage (NAS). Also included in Election-Related data are logs and configuration of network Routers, Firewalls, Intrusion Detection Systems, Intrusion Prevention Systems, and other network security devices, including VPNs and more? Both Election Data AND Election-Related Data must be preserved as “Election Records” under the law, and this is broadly addressed in both the 2002 VSS and the EAC’s successor versions of VVSG ial task. It involves a ‘Securing computer systems is a non-ti ny of processes, including, but not limited to: «Engineering systems with a focus on security Building systems to meet published high-security standards and applicable regulations Patching systems to ensure that vulnerabilities are removed © Securing networks to ensure highly controlled access ‘© Logging of all communications, processes, access, system modifications ‘* Auditing of systems and logs regularly to ensure ongoing compliance ‘* Adequate training and certification for engineers, administrators, and system users ‘* Adherence to Industry Best Practices, for example, emphasis on password strength and configured security ‘and group policies These, among other measures, will help to ensure what is known as the CIA triad. The CIA triad represents the three pillars of information security: confidentiality, integrity, and availabilty, as follows: * Log and configuration examination of not only the computer systemis) but also all network systems are critical to forensic examination. Compromise of any unrelated information (e.g. plain-text cofiguration data containing normally-encrypted passwords) can be easily prevented, so long as simple, quick forensic examiner and cyber professional industry standards are used to obfuscate private and sensitive data from the network device files.Confidentiality — preserving authorized restrictions on information access and disclosure, Including means for protecting personal privacy and proprietary information Integrity — guarding against improper information modification or destruction and ensuring Information non-repudiation and authenticity Availability ~ensuring timely and reliable access to and use of information TY Failure any of the three pillars can and generally will result in a compromise of the system. Failure in the integrity ‘component can have dire consequences for public perception, election results, the future of our government and our country. Industry-standard forensics analysis tools were applied to the forensic examination. Information was forensically evaluated using backup images taken from a Mesa County Election server configured for DVS D-Suite 5.11-CO on Sunday, May 23, 2021, before its modification by Dominion Voting Systems and the Colorado Secretary of State to DVS D-Suite 5.13, and again on Wednesday, May 26, 2021, after the update had been applied. This server was the primary system that was used to process election data in Mesa County for the 2020 general election.The EMS server configuration and administrative standards were prepared by Dominion Voting Systems (DVS), running a combination of COTS and proprietary DVS software, and certified for use by the Colorado Secretary of State. Our conclusions include determining that this system not only failed to meet any reasonable standard or statutory requirement for cybersecurity but was also subject to removal of critical information (data destruction). ‘Our findings include serious irregularities that resulted in the loss of data integrit data and election-related data. ‘on the server, including election LEGAL REFERENCES Several Federal and Colorado state legal standards apply to the preservation and definition of election records, applicable to the data generated by and resident on voting systems. Beginning with 52 USC §20701, retention and preservation of records and papers by officers of elections; deposit with custodian; penalty for violation, which states: Every officer of election shall retain and preserve, for a period of twenty-two months from the date of any general, special, or primary election of which candidates for the office of President, Vice President, presidential elector, Member of the Senate, Member of the House of Representatives, or Resident Commissioner from the Commonwealth of Puerto Rico are voted for, all records and papers which come into his possession relating to any application, registration, payment of poll tax, or other act requisite to voting in such election, except that, when required by law, such records and papers may be delivered to another officer of election and except that, if a State or the Commonwealth of Puerto Rico designates a custodian to retain and preserve these records and papers at a specified place, then such records and papers may be deposited with such custodian, and the duty to retain and preserve any record or paper so deposited shall devolve upon such custodian. Any officer of election or custodian who willfully fails to comply with this section shall be fined not more than $1,000 or imprisoned not more than one year, or both. In addition to 52 USC §20701, multiple sections of Colorado Revised Statutes (CRS) appear applicable, including CRS 1-5-601.5. Compliance with federal requirements (Effective until July 1, 2022) Al voting systems and voting equipment offered for sale on or after May 28, 2004, shall meet the voting systems standards that were promulgated in 2002 by the federal election commission. At his or her discretion, the secretary of state may require by rule that voting systems and voting equipment satisfy voting systems standards promulgated after January 1, 2008, by the federal election assistance commission as long‘as such standards meet or exceed those promulgated in 2002 by the federal election commission. Subject to section 1-5-608.2, nothing in this section shall be construed to require any pc voting system that is in use prior to May 28, 2004. CRS 1-7-802. Preservation of election records The designated election official shall be responsible for the preservation of any election records for a period of at least twenty-five months after the election or until time has expired for which the record would be needed in any contest proceedings, whichever is later. Unused ballots may be destroyed after the time for a challenge to the election has passed. Ifa federal candidate was on the ballot, the voted ballots and any other required election materials shall be kept for at least twenty-five months after the election. 113-716. Destroying, removing, or delaying delivery of election records (2) No person shall wilfully destroy, deface, or alter any ballot or any election records or willfully delay the delivery of any such ballots or election records, or take, carry away, conceal, or remove any ballot, ballot box, or election records from the polling location or drop-off location or from the possession of a person authorized by law to have the custody thereof, or aid, counsel, procure, advise, or assist any person to do any of the aforesaid acts. (2) No election official who has undertaken to deliver the official ballots and election records to the county dlerk and recorder shall neglect or refuse to do so within the time prescribed by law or shall fall to account fully forall official ballots and other records in his charge. informality in the delivery of the ballots and election records shall not invalidate the vote of any precinct if such records are delivered prior to the canvassing of the votes by the county board of canvassers. (3) Any person who violates any provision of this sectior thereof, shall be punished as provided in section 1-13-111. guilty of a misdemeanor and, upon conviction ‘And several sections of the Code of Colorado Regulations appear applicable, including: 8 CCR 1505-1, Rule 21, 21.4.2: All voting systems must meet the requirements of the 2002 Voting Systems Standards, parts 5— 7 of article 5 of title 1, CRS, as amended, and this Rule 21.FORENSIC EXAMINATION AND ANALYSIS REPORTFORENSIC ANALYSIS SYSTEM IDENTIFICATION The server that was analyzed is capable of operating on a small local area network (LAN). The network consists of several systems, including servers and workstations running in a non-virtualized environment. The server that we evaluated was named EMSSERVER. It is running the Microsoft Windows Server 2016 Standard operating systern. ‘The forensic evaluation and reviews were based upon a forensic image archive collected from the Mesa County Dominion EMS Server. The Before and After forensic images were collected from the same server and same hard drive, as documented below, from the actual acquisition. The serial number of the hard drive shown in each collection data set verifies the data origin to be the same physical device. Figure 1—EMS Server (5.11-CO) Image Attributes Before Created By AccessData® FTK® Imager 4.2.0.13 Case Information: Acquired using: ADI4.2.0.13 Case Number: 052321 Evidence Number: 00003 Unique description: EMSSERVER Information for F:\EMSSERVER\EMSSERVE! Physical Evidentiary Item (Source) Informatio [Device Info] Source Type: Physical (Drive Geonetry] cylinders: 121,534 Tracks per Cylinder: 255 Sectors per Track: 63 Bytes per Sector: 512 Sector Count: 1,952,448, (Physical Drive Information] Removable drive: False Source data size: 953344 MB Sector count: 1952448512 [Computed Hashes] MDS checksum: — 3d7cf0Sca6e42db765b£5c15220c097d SHA1 checksum: eab06a7ea23586de2746b9142461717e075£5c9£ Image Information Acquisition finished: sun May 23 2021 Segment list F: \EMSSERVER\EMSSERVER. £01Figure 2- EMS Server (5.13) Image Attributes After Created By AccessData® FIK® Imager 4.2.0.13 Case Information: Acquired using: ADI4.2.0.13 Case Number: 052621 Evidence Number: 00002 Unique description: EMSSERVER_v2 Information for E:\Mesa\EMSSERVER_v2: Physical Evidentiary Item (Source) Information: [Device Info] Source Type: Physical [Drive Geometry] Cylinders: 121,534 Tracks per Cylinder: 255 Sectors per Track: 63 Bytes per Sector: 512 Sector Count: 1,952, 448,512 (Physical Drive Information] Drive Model: DELL PERC H730 Adp SCSI Disk Device Drive Serial Number: 0022266: i6eid00s£c54220044a Five Interface Typ: Removable drive: False Source data size: 953344 MB Sector count: 1952448512 [Computed Hashes] MDS checksum: — 52861d5a7750ab535a9d5£7277469c10 SHA1 checksum: — Ibf8£22edb37£72bb29428a591046a1£64279a3f Image Information: Acquisition finished: Wed May 26 2021 Segment list: E: \Mesa\EMSSERVER_v2.E01‘Two backup images were obtained, using forensic imaging methods, from the Dominion Voting Systems (DVS) Democracy Suite (D-Suite) Election Management System (EMS) Standard Server in Mesa County, Colorado. The first image was made of that EMS Standard Server in the D-Suite 5.11-CO version configuration, as used in the November, 2020 election on May 23, 2021. The second image was of the configuration of the EMS Standard Server in the D-Suite 5.13 version configuration, following the modification of the EMS Standard Server by a combined team of Dominion Voting System vendor personnel and Colorado Secretary of State (SecState) staff, on May 26, 2021. A forensic image {forensic copy) is a bit-by-bit, sector-by-sector duplicate of a physical storage device using specialized hardware and software; it is a much more comprehensive representation of the state and configuration of the imaged system than could be obtained using simple file backup methods. The images include all files, folders, and unallocated, free, and slack space. These forensic images include not only all the files visible to the server operating system but also deleted files and fragments of files eft in the slack and free space but every digital bit of data present on the storage medium, in this case, a SCSI hard disk. When forensic images are acquired, a hash function, also known as a Message Digest, is computed. This hash can be used at any time to validate the integrity of the image to ensure that it has not been edited, modified, or changed in any way. The hash function result from the acquisition of data appears in the text above but also appears inside each respective archive and authenticates the data by demonstrating that it has not changed since it was acquired. These two images were evaluated to gather technical information, including the integrity of the data stored on the system. No effort was made to reverse-design, de-compile or reverse-engineer the Dominion software. Configuration, which is relevant to the operation of the system, was examined to determine whether improper settings could allow undesirable results and were found to contain such errors. Results relevant to this investigation are documented below. Additional supporting documentation can be found in the appendixes. They include directory listings for many of the directories seen in the screenshots and contain complete filenames, full path names where the files are located, and file hashes. We have included screenshots that can be used to review and verify these findings. These screenshots were obtained from the forensic images of the Dominion server. AUTHENTICITY AND CHAIN OF CUSTODY Digital chain of custody is the record of preservation of digital evidence from collection to presentation in the court of law. This is an essential part of the digital investigation process. The chain of custody is probative that the digital evidence presented to the court remains as originally collected, without tampering. The two images analyzed in this report were obtained through AccessData FTK Imager 4.2.0.13. The serial number on the EMS Server drive on both images match, thus establishing that both images were taken from the same physical drive. | have reviewed the documented chain of custody for both images and have determined that the chain of custody is complete from the forensic operator utilizing FTK Imager through the source from which I directly received these images. (Because of the pending civil litigation and criminal investigation, the written documentation remains in the custody of counsel for later introduction in court proceedings and thus cannot be released as part of this report.) Further confirmation that these are genuine images from the Mesa County EMS Server has been provided by the Colorado Secretary of State's office. See: https://www.sos.state.co.us/pubs/newsRoom/pressReleases/2021/PR20210817MesaCounty.htmlFINDINGS Overview of System Data Sources Figure 3 ~ EMS Server (5.11-CO) System Data Sources BeforeServer Disk Partition Structure Overwritten Purpose: The disk partition structure is the structure of how the hard drive is divided up. Figure 5 - EMSSERVER (5.11-CO) Disk Partition Structure Before Fee he ee Q ne Ee ‘Note Changes in Disk Volumes and Directory Structures Peres ontmeeae e YUigure 7- Server Disk Partition and Directory Changes 1 naptime aimee ese et eae | pa Ee eed i Bore oT 2 ts js fergie a HSER ‘Bocrmere ‘Boece yt 21 sce | Somer | eorunead be nace ae 1 Scena Boren | eases Bete i Bowes menor Set 3 raprner bo soe B nepeoeetn »Bemeo Broce, reten B crannies B rover 4m ones Ppemotecr) Bh eecenaerts B heswoanen Beso Spurn) 4 reve . Bom eats 2a weeny Loreen ‘owen Soto nae oe mem Th | WD pentose OH | MP tpercrerosea o mil Before Dominion Update ‘After Dominion Update Computer hard disk drives are data storage devices that must be prepared before use - specifically, they must be partitioned into logical disk volumes and then formatted. Partitioning a hard disk drive is the equivalent of scoring horizontal and vertical rule ines onto blank paper, and then numbering each line, preparing that paper for the orderly recording and look-up of information. A disk is partitioned to organize information into sets of related data. A partition creates a logical drive, C:,D:, E:,etc., that the Master Boot Record (MBR) or Globally Unique Identifier (GUID) Partition Table, which are like maps of the partitioned and formatted memory storage locations on the hard drive, can then use to write and read stored data. Creation of such a partition, if previous partitions are not preserved, destroys the “map” of underlying data and data locations when the partition is formatted. The previous partition data is then only recoverable by forensic techniques, and is vulnerable to complete destruction if overwritten by data stored according to the new partition “map.” Note that in the before image above, each disk partition (Labeled “volX,” e.g. “vol1,” for “volume”) is identified together with the addresses of the beginning block and ending block for each volume.By comparing the images, it is evident that the disk was re-partitioned, reformatted, and the previous data map completely destroyed by overwriting it with new data, rendering the prior data (mostly) unrecoverable. Forensic examination of the system can reveal remnants of deleted data. When a computer deletes a file, it does not erase the data; it merely changes the first character of the filename to a non-printable character recognized by software that accesses the disk. This first character tells the operating system to no longer display the file as it is marked as a deleted file, and the space occupied by the disk is marked as reusable. Each block on the disk is the smallest unit of disk space that can be used. The size of all blocks on the disk are determined when the disk is formatted. The smallest disk block size in common use is 512 bytes. Even ifa file only ‘occupies 50 bytes of disk space, the entire 512 byte block is marked as “in use”. IFa file of 500 bytes is written to the disk, it occupies one block of disk space, with the last 12 bytes (on a newly formatted disk) each containing the numeric value zero (0). If this file is then deleted, and a file of 50 bytes is written to the same disk block, the first 50 bytes of the block contain the new file, and the next remaining 450 bytes of the disk block contain the data from the deleted file that previously occupied the disk block (followed by the 12 null (0) bytes of data), This data remnant is referred to as “File Slack Space” and is defined as any previous remnant data that remains on the disk and is not accessible via the operating system nor allocated as an accessible file. Special forensic software is required to access file slack space, and the data it contains are partial remnants of previous system data. This data may be of use in forensic investigation, and forensic tools often identify it. File Slack is identified here for clarity and better understanding of these data.Website Server Log Files Missing Figure 8 - EMS Server (5.11-CO) Web Server Log Files Before Figure 9 - EMS Server (5.13) Web Server Log Files After Prior to the Dominion update, there were 240 log files in this folder. After the update, there are only 3 log files showing and 3 (partial) remnants of previously used log files in File Slack space.‘Aweb server provides information to external web clients (via "web browser" software) using the HyperText Transfer Protocol (HTTP). This information can include both read and write access to databases and static presentation of information. Some software system designs utilize an Ethernet network interface that is essentially an internal connection to itself, known as a loopback interface. Thus the presence of a Web Server, by itself, does not indicate a connection to an external ethernet interface. However, such an external connection may be indicated by the data within web server logs, which are stored by default in Microsoft operating systems with Microsoft Internet Information Services (IIS) installed, in a “logs” subfolder to the “inetpub” folder. That log data would include information regarding what web ages and data were accessed and whether it was accessed from within the server (loopback) or via an external network connection. In these before and after views of the same web server directories, it is clear that the web server logs have been destroyed by or during the Dominion/CO Secretary of State DVS D-Suite 5.13 modification, This log data is required to verify that the election system was not accessed by an external, unauthorized device, but due to the specific and unusual installation method for a critical computing system, chosen by Dominion Voting ‘Systems and endorsed by the CO Secretary of State, these critical data files with election-related data have clearly been destroyed on the Mesa County EMS Standard Server.Server Microsoft SQL Server Installation Log Files Missing Purpose: The Database Management System that is used to hold actual ELECTION DATA — votes from each ballot. These log files contain information detailing the installation events of SQL Server. Figure 10 - EMS Server (5.11-CO) MS SQL Server Installation Log Files Before Ta csnnr mma sse8 - ox (ie ew ete eae dice apn 5 Se Rain Figure 11 - EMS Server (5.13) MS SL Server installation Log Files After aca eiape388 - a xy [ei Hoe Hey | edeia Gls == eions Ment. “mower ae 1 besoy datas Sere 1 beey esas Smet eae tno ‘The folders in Before are now completely missing. Pens Bu ‘pe ites sen Sse SPENG)S 0 Peper en ke eyThese log files were created by installing the SQL Server Database Management System software and contain data regarding the Initial installation of the software. In a full forensicinvestigation, these data are part of the information that investigators require to determine a baseline from which can be determined what changes were made, by whom, when the changes were made, and much more on a system with properly configured log recording. Therefore, these data are Election Related as they document not only the configuration but its changes and are relevant to the Integrity of the election. Figure 12 is an example of log content from the initial software setup. It tells us what (Microsoft) software executes, where data is stored (the G: drive), and it shows us what Registry values have been set during the installation. These are valuable should an investigation of an illegal computer intrusion occur, as they provide a record of the initial configuration during such an investigation. Figure 12 - Example of Log File Content from EMS Server (6.11-CO) BeforeServer Microsoft SQL Server Log Files Missing Purpose: These log files keep track of events that occur within the SQL. Server that manages the election databases. Figure 13 - EMS Server (5.11-CO) SQLServer Log Files Before (Baye doce = es am mer, ) gure 14- es Server (5.13) SQLServer Log Files After File sizes are different, file dates are different. Original files have been replaced with new. Previously 116 files, ‘now only 71 files.EMS Server Dell Server Updates Missing Purpose: These logfiles track installation of updates made to the various components ofthe servers, including updates to software for a remote-access cord. Figure 15 - EMS Server (5.13-CO) Dell Server Update Files Before ‘Sizes, Dates/Times are different. ‘These Log Files have been replaced with different files.Several log files of great importance to an investigation are shown in Figure 16. The SAS RAID firmware and drivers logs tell us about the functionality of hard disk controllers (RAID is an acronym for Redundant Array of Independent Disks) and about this storage redundancy's physical capability. Network Firmware logs tell us which hardware devices were updated with new firmware, and the version allows us to trace back to its network (and possibly Internet) functionality. The application of iDRAC controller firmware may indicate the presence of a special hardware controller intended to permit complete remote control of the computer system. This iDRAC controller is often used when a data center must be located an inconvenient distance away from its owner and/or operators, or for example, when such a computer might be physically located at an Internet Service Provider's secure data center. The iDRAC controller permits a remote user to remotely turn on the power to the server, reboot it, access administrative control functions, and make changes to the server, OUTSIDE THE CONTROL, or even the awareness, of the local computer operator and its operating system. Among the changes possible via an IDRAC are changes to the BIOS (Basic 1/0 ‘System) including those firmware settings that include the computer Clock, boot device order, which disks or other data storage devices are used to boot the computer, and some other computer capabili Take note of what files remain following the update. Not only are the files in an entirely different directory, but the file modification dates have changed, and more importantly, these logs are for DIFFERENT versions of the software, and the previous logs have been overwritten. Physicat examination of the EMS computer system is required to verify the presence or absence of an IDRAC controller, however itis highly irregular for update software to install updates to software for a hardware device that has not been installed.Server ‘Administrator’ WebCache Log Files Overwritten Purpose: These log files store information about websites visited, files opened, etc. |) Fgure 17- EMS Server (5.11-CO) Administrator WebCache Log Files Before Bipretias -enuopi@ear ) igure 12-0 Server (5.13) Adminstrator WebCache Log Fes Afar All the Before files have been replaced with new files, replacing the originals and therefore making itimpossible Cr nearly impossible to recover. ssiscomtcsset Suan :) Server ‘emsadmin’ WebCache Log Files Overwritten Purpose: These log files store information about websites visited, files opened, etc. Figure 19 - EMS Server (5.11-CO) "ernsadmin" WebCache Log Files Before‘The WebCache log files have been overwritten. IF the computer has been used on the Internet or with ANY webserver (even one on the local network, including this computer's OWN webserver), these WebCache files indicate the connections that were sought, as well as files that were opened. These may provide critical evidence that the system has been connected to a network, including networks that have access to the Internet. THESE ARE NOT the same files in the before and after images. They have been deleted and replaced. Here is a small subset of some of the information that was found on the Before image in these WebCache log files: Figure 21 ~ EMS Server (5.11-CO) Webcache Log File Content Before Ccontare_A5 (able =, 25 Gaal 2 fxtyid Contained Wt OO TeceseTine ' 8 anzoe0820200615:DYSAdministatr@-Host: This PC sars6re9266520 | loz 6 _zomotee20200615:BVSAdminitratr hese Aaminiater/DestopDVS2OAdjdicion2O2720Ke pk THSEEHSHEDIISTE For instance, the above log file entry seems to show a DVS Adjudication Encryption Key was accessed, where it was ‘stored and accessed from, and when it was accessed. Figure 22 - EMS SErver (5.11-CO) Webcache Log File Content Before - I Gorm Rae em Boxed z nyld_>Coninld 3 BRIA mace ase 140A msn GV. at Paste 58ST mcafee LAN RANTING A IRLOCULONEN HORNA | 27___ asta emetingie/ erm nn o/b ner/ON HO OI ESDATN| In addition, the above log file entry seems to show several interesting files (a windows ‘evtx’ log file being opened from an external attached USB flash drive, and a ballot detail file and even a ballot image from Batch 2003 being ‘opened from a Network Attached Storage device) Without a forensic Before image prior to a Dominion ‘Update’, this type of potentially critically-important forensic information could be, and likely would be, lost forever.Server SQL Server Management Studio (SSMS) Log Files Overwritten Purpose: These log files track the installation of the SQl. Server Management Studio, which is used to get into the back- end of the election databases. "Figure 23 -EMS Server (5.11-CO) SSMS Log Fi Figure 24 EMS Server (5.13) SSMS Log Files After ‘Ail previous Log Files have beenServer CBS Log Files Overwritten Purpose: These Log Files contain detailed information about installed updates. They could contain evidence of ‘changes to the server that would cause decertfication ofthe system. Figure 25 - EMS Server (5.11-CO) CBS Log Files Before uaaeusassaneecnseceanteaaaeenan Errno Figure 26 - EMS Server (5.13) CBS Log Files After File names, sizes, and dates have changed. These files have all been replaced. aasaveanscenneusszeeazeasgeusauczavcagasServer Election Databases Missing Purpose: This folder holds all the databases (votes, information regarding batches, when they were processed, how. ‘many were processed, who they were processed by, and much more). There are lso multiple extra databoses that contain information regarding ballot adjudication. Figure 27 - EMS Server (5.11-CO) Election Databases Before ) Bay edie. = eae Server DHCP Log Files Missing/OverwrittenPurpose: DHCP Log Files can show evidence regarding computers or other devices being connected to the network. Figure 29 - EMS Server (5.21-CO) DHCP Log Files Before The Number of Files, Dates, and Sizes are Different. They have all been replaced.) Server Event Logs Missing/Overwritten Purpose: These Dominion Log Files keep track of election/project-related activity. The Windows Server event logs outside the red box keep track of much of the activity on the server. Figure 34 - EMS Server (5.13-CO) Event Logs Before Figure 32 - EMS Server (5.13) Event Logs After ‘Nearly 200 EMS and Adjudication Log Files are gone that should be here alphabetically as they are above. Remaining Windows Log Files have been replaced with new files, retaining no information from Before.Below are some screen shots of the kind of Election-Related information (such as cast vote records, audit marks, image retrievals, result file loads, etc.) in the EMS Archive Logs that are missing After the Dominion Update: Figure 33 - Examples of Election Data Missing After Update (Diernace ammesnow [Pcrace Vanesa TF os f= = | [crmens! Neoasanrd seat = | es Ics iEServer System Users are Missing Purpose: These folders store the information for each user account on the server, Figure 34- EMS Server (5.11-CO) System Users Before TUTTE ini ‘Many User Accounts are now missing, and those that still exist have been recreated and do not contain the information that was in the Before folders.Server Virtual Directories Log Files Missing Purpose: These are the Log Files that contain information, warnings, and errors relating to the Website Server as the server processes election projects that have been set up. Figure 36 - EMS Server (5:11-CO) Virtual Directory Log Files Before ene ft I iL i ‘ hy All previous log files are gone.Server Windows Defender Log Files Missing/Overwritten Purpose: These og files keep track of the activity of the built-in Anti-Virus software. Figure 38 - EMS Server (5.11-CO) Windows Defender Log Files Before Dominion Update: (=e = Figure 39 - EMS Server (5.13) Windows Defender Log Files after eee - Files and even remnants of previously-deleted Files are missing and replaced with new files.Server List of .log files in Before Image that were Deleted. This list that follows this paragraph is a comparison of the Before and After forensic images of the Mesa County EMS Server. It is a comparative list of files that were deleted — either deliberately erased or overwritten with disregard for the preservation of these files, some of which contain ELECTION RELATED data. Each line in the image below is the full path listing to each one of the 807 files jth the word " log" foun onthe EMS Server before the Dominion update was applied, The Color code shows what happened to them After Dominion's update. Of all the files on the server Before the update ~ files highlighted in Green are still present on the server after the update, while files highlighted in light red have been overwritten and are deleted and not present in the image taken After the update Figure 40 - EMS Server Before/After og File Comparison List Haga i ee a aSignificant Number of Logfiles Missing ‘The dataset from which this spreadsheet was created was extracted from the EnCase images of the original evidence on the hard drives of the EMS Server and had a traceable chain of custody. While the images above are too small to bbe readable, the entire content of this list is reproduced in Appendix A. original 807 " log" files on the EMS Server before Dominion’ mn jin, and 505 "log" files, have been deleted or overwritten. Of the files that remain, the forensic examination has not yet verified whether the content of these files (which have ‘the same filename and Path~e.g,, in the same directories) is unchanged. The files that have been deleted DO include files that constitute Election Records and are subject to Federal and State data retention laws. ‘This list is only 807 files, and the text size is so small that the content is barely readable. The list of files has been broken down into small subsets because the number of files on the entire server totals 363,321 files, many of which are provided by Microsoft as part of the Windows Server 2016 operating system and its associated application programs and are not Election Related and do not contain actual Election Data.