T5 B35 K Moore Terrorist Mobility 2 of 3 FDR - KENBOM and TANBOM FBI 302 Aug 01 Re Computer Files Mercy International Etc

9/11 Law Enforcement Privacy
v. 08-28-2000)
FEDERAL BUREAU OF INVESTIGATION
Precedence: ROUTINE Date: 08/14/2001
To: New York Attn: Squad 1-45
From: New York

.Squad 1-45
Contact: SA
Approved By:
Drafted By:
Case ID #: 262-NY-2S7856-TR (Pending)

262-NY-267857 (Pending)
Title: KENBOM;
MAJOR CASE 148;
IT-OHAH
00: NEW YORK
TANBOM;
MAJOR CASE 149;
IT-OHAH
OO: NEW YORK
Synopsis: To provide copies of file lists and substantive text

files found on selected diskettes (disks) seized from Mercy
International Relief Agency (MIRA) on 08/20/1998 in Nairobi,
Kenya.
Reference: 262-NY-267856-TR Serial 55

262-NY-267856-TR Serial 57
Enclosures: Attached hereto are copies of the file lists for 19

disks seized from MIRA on 08/20/1998.in Nairobi, Kenya. Each disk
is known by its New York Office (NYO) Computer Analysis and
Response Team (CART) Q-number and also by its NYO IB-number.
Files lists were printed from the following disks:
Q119 - Q125 1B90, item 33 (7 disks)

Q126 - Q133 1B127, item 8 (8 disks)
Q134 - Q135 1B137,. items 20 and 21 (2 disks)
Q136 1B115, item 9 (1 disk)
Q137 1B47, item 12 (1 disk)
REQ. #34-1 000000193

To: New York From: New York
Re: 262-NY-267856-TR, 08/14/2001
Also attached hereto are substantive text files and

selected residue files found on four disks within the group of
19. These are the only substantive text files on the entire set
of 19 disks. The following files were printed:
9/11 Law Enforcement Sensitive
Details: On August 7, 1998, terrorist cells linked to USAMA BIN

LADIN bombed the United States Embassies in Nairobi, Kenya and
Dar Es Salaam, Tanzania. In the ensuing investigation,
investigators from the Federal Bureau of Investigation (FBI) and
REQ. #34-1 000000194

To: New York F^^ui:- New York
Re: 262-NY-267856-TR, 08/14/2001
the Kenyan Criminal Investigation Department (CID) searched the

Nairobi office of MIRA, along with numerous other locations. MIRA
is a non-governmental organization (NGO) headquartered in Dublin,
Ireland, and headed by ABDALLAH RASHID in Nairobi.
The MIRA search took place on 08/20/1998. Investigators

seized business records, both documentary and electronically-
stored items, along with many other items. Attached hereto are
copies of file lists and substantive text files found on selected
disks seized during that search. Specifically, this communication
addresses 19 disks (each disk is known by its NYO CART Q-number
and also by its NYO IB-number), including:
Q119 - Q125 1B90, item 33 (7 disks)

Q126 - Q133 1B127, item 8 (8 disks)
Q134 - Q135 1B137, items 20 and 21 (2 disks)
Q136 1B115, item 9 (1 disk)
Q137 1B47, item 12 (1 disk)
During the same search, investigators seized a Daewoo

laptop, known as both NYO CART item Q118 and NYO 1B241. Printable
files from that item are attached to referenced communication,
262-NY-267856-TR serial 57. Investigators also seized
approximately 104 additional disks and two CD-ROMS, known
collectively as NYO 1B118 and known individually as Q12 - Q115
and Q116 - Q117 (respectively). Printable files from those items
are attached to referenced communication, 262-NY-267856-TR serial
55.
Processing Disks O119 - O137
NYO CART copied all materials on disks Q119 - Q137 to a

magneto-optical disk and to a CD-ROM contained in KENBOM sub-302
1A1308. Logical files were copied to folders named "FILES;"
deleted files were recovered and copied to folders named
"ERASED;" all other printable characters that were not otherwise
contained in a file were recovered and copied to folders named
"RESIDUE." Each such file folder appears in a parent folder named
by Q-number, such that every disk has its own files folder,
erased folder, and residue folder.
The following disks had no files in their respective

"ERASED" folders: Q120 - Q125 and Q127 - Q133. Disk Q127
contained no files whatsoever.
REQ. #34-1 000000195

To: New York Fx^m: New York
Re: 2S2-NY-267856-TR, 08/14/2001
All substantive text files contained on the 19 disks

were printed and attached hereto, including:
9/11 Law Enforcement Sensitive
All substantive text files are written in Arabic, except those

marked with a double asterisk {**). Those files are written in
English. Documents written in Arabic are being submitted for
translation under separate cover.
Two residue files that contained recognizable English

names were also printed and attached hereto, including:
REQ. #34-1 000000196

Re: 262-NY-267856-TR, 08/14/2001
free.126 from Q126\RESIDUE
free.136 from Q136\RESIDUE
The remaining files are system files, executable files,

wav files, and files, etcetera, and do not contain substantive
text.
REQ. #34-1 000000197

\)
FEDERAL BUREAU OF INVESTIGATION
Precedence: ROUTINE Date: 08/24/2001
To: New York Attrx: Squad 1-45
From:, New York

Squad 1-45 ,
Contact: SA/
Approved By:
Drafted By:
Case ID #: 262-NY-267856 (Pending)

262-NY-267857 (Pending)
Titles KENBOM;
MAJOR CASE 148;
IT.-OHAH
00: NEW YORK
TANBOM;
MAJOR CASE 149;
IT-OHAH
00: NEW YORK
Synopsis: To summarize computer and computer-related evidence

matters in the.captioned investigations.
Reference: 262-NY-267856 Serial 4643

2S2-NY-267857 Serial 3469
Enclosures: Enclosed for reference are the following Computer

Assistance Response Team (CART) reports and Latent Fingerprint
Section (LFS) reports:
CART FD-302 dated 07/18/2001, 262-NY-267856-302 serial 1721

LFS Lab Report dated 02/12/1999, 262-NY-267856 serial 3935

LFS Lab Report dated 01/20/1999, 262-NY-267856 serial 3816
CART Lab Reports dated 12/08/1998, 262-NY-267856-E serial 24
(two reports -- 980911013 and 981022001)
CART Lab Report dated 10/14/1998, 262-NY-267856 serial 4651
Details: On August 7, 1998, terrorist cells linked to USAMA BIN
REQ. #34-1 000000198


Re: 262-NY-267856, 08/24/2001
LADIN bombed the United States Embassies in Nairobi, Kenya and

Dar Es Salaam, Tanzania. The ensuing investigation led to the
seizure of several computers and computer-related items. SA
formerly assigned to Squad 1-45, oversaw the
processing of all such items as requested by referenced
communications. The following is a summary for each item of
KENBOM/TANBOM evidence classified as computer or computer-related
evidence .
I. Mercy International Relief Agency (MIRA) , Daewoo Laptop

Computer, seized 08/20/1998, Nairobi ,. Kenya
KENBOM 1B241; NYO CART item number Q118
On August 20', 1998, V^^HHHH^HH|| seized a Daewo°

laptop computer from the MIRA offices in Nairobi, Kenya. This
computer is known as KENBOM 1B241 and NYO CART item Q118.
The New York (NYO) Computer Analysis Response Team

(CART) made a logical copy of all files (including erased and
residue) on the laptop and recorded them to a CD-ROM stored in
KENBOM main file 1A225. See attached FD-302 dated 03/08/2000,
known as KENBOM sub-302 serial 1219. See also KENBOM sub-302
1A946 for CART exam notes and printout of BMP and WAV files that
CART was unable to open.
A copy of the printable files from the laptop is

attached to an electronic communication (EC) dated 03/21/2000,
known as KENBOM sub-TR serial 57 .
II. MIRA, Disks and Compact Disks (CD-ROMs), seized

08/20/1998, Nairobi, Kenya
A. KENBOM 1B47, item 12; NYO CART item number Q137
approximately one disk from the MIRA offices in Nairobi, Kenya. ^

This disk is known as item 12 of KENBOM 1B47 and NYO CART item
Q137.
NYO CART made a logical copy of all files (including

erased and residue) on the disk and recorded them to a magneto-
optical disk and to a CD-ROM stored in KENBOM sub-302 1A1308. See
attached FD-302 dated 07/18/2001, known as KENBOM sub-302 serial
1721.
REQ. #34-1 000000199

Re: 262-NY-267856, 08/24/2001
A copy of the printable substantive text files from

this disk is attached to an EC dated 08/14/2001, known as KENBOM
sub-TR serial 125.
B. KENBOM 1B90, item 33; NYO CART items Q119 - Q125
approximately seven disks from the MIRA offices in Nairobi,

Kenya. These disks are known as item 33 .of KENBOM 1B90 and NYO
CART items Q119 - Q125.

erased and residue) on the disks and recorded them to a magneto-
1721.
These disks do not contain printable substantive text

files.
C. KENBOM 1B115 item 9; NYO CART item Q136
approximately one disk from the MIRA offices in Nairobi, Kenya.

This disk is known as item 9 of KENBOM 1B115 and NYO CART item
Q136.

erased and residue) on the disk and recorded them to a magneto-
1721.

this disk is attached to an EC dated 08/14/2001, known as KENBOM
sub-TR serial 125.
D. KENBOM 1B118; NYO CART items Q12 - Q115 (disks) and

NYO CART items Q116 and Q117 (CD-ROMs)
approximately 104 disks and two CD-ROMs from the MIRA offices in
Nairobi, Kenya. These disks and CD-ROMs are known collectively as
KENBOM 1B118 and individually as NYO CART items Q12 - Q115
(disks) and NYO CART items Q116 and Q117 (CD-ROMs).
REQ. #34-1 000000200

Re: 262-NY-267856, 08/24/2001

erased and residue) on disks Q12 - Q115 and CD-ROMs Q116 and Q117
and recorded them to CD-ROMs stored in KENBOM main file 1A219.
See attached FD-302 dated 01/04/2000, known as KENBOM sub-302
serial 1204. See also KENBOM main file 1A222 for a duplicate set
of CART CD-ROMs and KENBOM sub-302 1A905 for CART exam notes.
A copy of the printable files from the disks and CD-

ROMs is attached to an EC dated 03/21/2000, known as KENBOM sub-
TR serial 55.
E. KENBOM 1B127, item 8; NYO CART items Q126 - Q133
approximately eight disks from the MIRA offices in Nairobi, ^

Kenya. These disks are known as item 8 of KENBOM 1B127 and NYO

1721.

disk Q126 is attached to an EC dated 08/14/2001, known as KENBOM
sub-TR serial 125. The remaining disks do not contain printable
substantive text files.
F. KENBOM 1B137, items 20 and 21; NYO CART items Q 134

- Q135
approximately two disks from the MIRA offices in Nairobi, Kenya.

These disks are known as items 20 and 21 of KENBOM 1B137 and NYO
NYO CART made a logical copy of all .files (including

optical disk and to a CD-ROM stored in KENBOM sub-302 1A1308 . See
1721.

disk Q134 is attached to an EC dated 08/14/2001, known as KENBOM
sub-TR serial 125. Disk Q135 does not contain printable
REQ. #34-1 000000201

\\, To: New York Fz^m: New York
4V\ ,. Re: 262-NY-267856, 08/24/2001
substantive text files.
KENBOM IBS 10' items 1 and 2; Lab Items K191 and K192
On September 2, 1998,mmmtmmi,^^^^ seized

\y 37 disks from the residence of
Twenty-one of these .disks are known both as item 1 of KENBOM

\1B510 and lab item Ki'51; sixteen of these disks are known as both
.item 2 of KENBOM 1B510'and lab item K192.
\Q CART made at physical image of all media specimens

containing file systems to a. magneto-optical disk and a CD-ROM
ki^own as KENBOM 1B860. Erased-..files and residue were recovered
ffpm the disks to 1B860. Severa.1 disks were found to be
unreadable, thus, physical images were not recorded to 1B860. See
attached Lab Report number 980911013 S/I FX SX dated 12/08/1998,
known as KENBOM sub-E serial 24.
A copy of the printable files, from the disks is

attached to an EC dated 03/21/2000, known as KENBOM sub-TR serial
54 . \n addition, the lab recovered latent fingerprints
\t palm prints on four disks, K191.6., K192.1.6,

iK192.1.\9, and K192.2.5. One latent fingerprint developed on disk
;K192.2.5 was identified as a finger impression of | I
I I. See attached Lab Report number 980911013 FX
CW dated,02/12/1999, known as KENBOM main serial 3935.
IV.
KENBOM 1B513 item 1; Lab Item K189
| On September 2, 1998, seized a

Macintosh Computer from the n£_
us computer is known both as item 1 of KENBOM IBS 13 and lab

item K189.
REQ. #34-1 000000202

To: New York Fi«^m: New York

Re: 262-NY-267856, 08/24/2001
Lab item K189 is a first generation Macintosh and does

not contain an internal hard drive; therefore, CART conducted no
analysis of this item.
No latent prints of value were developed on lab item

K189. See attached Lab Report number 980911013 FX CW dated
02/12/1999, known as KENBOM main serial 3935. It should be noted
that 'a,tern K189 is not referenced in the Results of Examination;
however, K189 appears in the lab communication as a specimen
examined for latent fingerprints.
V.
\M 1B513 item 2; Lab Item K190
On September 2, 1998,
C£>U from the residence ofl
This CPU is known

both as item 2 of KENBOM 1B513 and lab item K190.
\Q CART determined that the HDD CPU contained a

Seagate ST32122A hard drive, serial XKF04812/9J7013-503, which
was designated as lab item K190.1. CART copied a physical image
of the Seagate hard drive to a magneto-optical disk and a CD-ROM
knowfi as KENBOM 1B860. Three-hundred and seventy-three (373)
eraseld files were recovered from the Seagate hard drive to 1B860.
See attached Lab Report number 980911013 S/I FX SX dated
12/08/1998, known as KENBOM sub-E serial 24.
A copy of the printable files from the Seagate hard

drive is attached to an EC dated 03/21/2000, known as KENBOM sub-
TR serial 54.
\e lab developed latent fingerprints and/or latent

palm prints on the HDD CPU, but no identifications were made. See
attached\Lab Report number 980911013 FX CW dated 02/12/1999,
known as \KENBOM main serial 3935.
VI.
KENBOM 1B521 item 45, Lab Items Q791 - Q798
REQ. #34-1 000000203

Td>...... New York Fiw.n: New York

fee..: 262-NY-267856, 08/24/2001
On September 2 , 'i-9.98 ,
approximately eight: disks from"
'I 1 ''-The disks were found in a briefcase, known as KENBOM
1B521, that, belonged t'dl ~l The disks are known both as item
45 of 1B521 and as lab items Q791 - Q798.
FBIHQ CART copied a physical image of the disks'

readable sectors to, a magneto-optical disk and CD-ROM known as
KENBOM 1B359. Lab items Q793 and Q798 were unreadable due to
extensive media errors,-, thus, physical images were not recorded
to 1B859. Readable specimens were found to contain a Macintosh
. (HFS) file system. NYO CART,.. labeled the same disks NYO CART items
Ql - Q8 and conducted an independent analysis. NYO CART also
'found the readable disks to contain a Macintosh file system. See
Attached FD-302 dated 09/15/1998, .known as KENBOM sub-302 serial
re 98.
FBIHQ CART searched the magneto-optical disk for any
stiings possibly representing an internet e-mail address using
the', regular expression u [a-zO-9]@[a-zO-9] " and produced no
significant results. See attached Lab Report number 981022001 S/I
FX SX dated 12/08/1998, known as KENBOM sub-E 'serial 24.
As of the date of this communication, SA| \ was reviewin
printable files for the KENBOM file.
No latent prints of value were developed on lab items

Q791 - 0798. See attached Lab Report number 981022001 S/L FX SX
CW dated.01/20/1999, known as KENBOM main serial 3816.
VII.
KENBOM 1B902 (part); Lab Item K200.4
; On or about September 9, 1998,

\seized a Toshiba 2.5" IDE hard drive, model MK2326FCH,from
^ByTech Engineering in Nairobi, Kenya. Investigation revealed that
I I had left this hard drive, along with several other parts
from a Sharp laptop computer, for repair at ByTech Engineering.
This hard drive is known both as KENBOM 1B902 (part) and lab item
K200.4.
FBIHQ CART copied a physical image of this hard drive

to a magneto-optical-disk and CD-ROM known as KENBOM 1B858.
REQ. #34-1 000000204

"To.: New York From: New York

Re: 2.62-NY-2S7856, 08/24/2001
Erased files were recovered from this hard drive and also
recorded to 1B858.
CART searched the residue report for the following text

strings, u[a-z]@[a-z] Sender:" and're.sults were recorded to
1B858. See attached Lab Report number 98$914024 S/I FX SX dated
10/14/1998, known as KENBOM main serial 4651.,
\s of the date of this communication, SAI I

I I was reviewing this hard drive and preparing copies of the
printable files for the KENBOM file.
VIII. UIMARA BARUTI INDUSTRIES, aka TOMMY SPADES

MANUFACTURING, Computer, seized 09/02/1998, Dar Es
Salaam, Tanzania
TANBOM 1B276 item 59; Lab Item K98.1.1
On or about September 2, 1998,

seized an Olivetti M24XS, P166-X CPU, Serial A4979F-0503240, from
UIMARA BARUTI INDUSTRIES, aka TOMMY SPADES MANUFACTURING, in Dar
Es Salaam,. Tanzania. CART determined that the CPU contained a
Fujitsu MPA3017 AT hard drive. The hard drive is known both as
item 59 of TANBOM 1B276 and lab item K98.1.1.
FBIHQ CART copied a physical image of this hard drive

to a 2.3 gigabyte disk and CD-ROM known as TANBOM 1B283.
Investigation revealed that UIMARA BARUTI INDUSTRIES,

aka TOMMY SPADES MANUFACTURING, and its owner THOMAS LYIMO had no
connection to the Embassy bombings in Nairobi, Kenya and Dar Es
Salaam, Tanzania. In April 2000, NYO shipped this computer to the
Regional Security Officer (RSO) in Dar Es Salaam for return to
Thomas Lyimo.
IX. UIMARA BARUTI INDUSTRIES, aka TOMMY SPADES

MANUFACTURING, disk, seized 09/02/1998, Dar Es Salaam,
Tanzania
TANBOM 1B276 item 40; Lab Item K138
On or about September 2, 1998,

seized one computer disk, from UIMARA
TOMMY SPADES MANUFACTURING, in Dar Es Salaam, Tanzania. The disk
is known both as item 40 of TANBOM 1B276 and lab item K138.
REQ. #34-1 000000205

To: New York Fiom: New York
Re: 262-NY-267856, 08/24/2001
Investigation revealed that UIMARA BARUTI INDUSTRIES,

aka TOMMY SPADES MANUFACTURING, and its owner THOMAS LYIMO had no
connection to the Embassy bombings in Nairobi, Kenya and Dar Es
Salaam, Tanzania. In April 2000, NYO shipped this disk to the RSO
in Dar Es Salaam for return to Thomas Lyimo.
REQ. #34-1 000000206

T5 B35 K Moore Terrorist Mobility 2 of 3 FDR - KENBOM and TANBOM FBI 302 Aug 01 Re Computer Files Mercy International Etc

Caricato da

Informazioni sul documento

Descrizione originale:

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

T5 B35 K Moore Terrorist Mobility 2 of 3 FDR - KENBOM and TANBOM FBI 302 Aug 01 Re Computer Files Mercy International Etc

Caricato da

Copyright:

Formati disponibili

9/11 Law Enforcement Privacy

FEDERAL BUREAU OF INVESTIGATION

Precedence: ROUTINE Date: 08/14/2001

To: New York Attn: Squad 1-45

From: New York

Case ID #: 262-NY-2S7856-TR (Pending)

Synopsis: To provide copies of file lists and substantive text

Reference: 262-NY-267856-TR Serial 55

Enclosures: Attached hereto are copies of the file lists for 19

Q119 - Q125 1B90, item 33 (7 disks)

REQ. #34-1 000000193

Also attached hereto are substantive text files and

9/11 Law Enforcement Sensitive

Details: On August 7, 1998, terrorist cells linked to USAMA BIN

REQ. #34-1 000000194

the Kenyan Criminal Investigation Department (CID) searched the

The MIRA search took place on 08/20/1998. Investigators

Q119 - Q125 1B90, item 33 (7 disks)

During the same search, investigators seized a Daewoo

Processing Disks O119 - O137

NYO CART copied all materials on disks Q119 - Q137 to a

The following disks had no files in their respective

REQ. #34-1 000000195

All substantive text files contained on the 19 disks

9/11 Law Enforcement Sensitive

All substantive text files are written in Arabic, except those

Two residue files that contained recognizable English

REQ. #34-1 000000196

free.126 from Q126\RESIDUE

free.136 from Q136\RESIDUE

The remaining files are system files, executable files,

REQ. #34-1 000000197

FEDERAL BUREAU OF INVESTIGATION

Precedence: ROUTINE Date: 08/24/2001

To: New York Attrx: Squad 1-45

From:, New York

Case ID #: 262-NY-267856 (Pending)

Synopsis: To summarize computer and computer-related evidence

Reference: 262-NY-267856 Serial 4643

Enclosures: Enclosed for reference are the following Computer

CART FD-302 dated 07/18/2001, 262-NY-267856-302 serial 1721

LFS Lab Report dated 02/12/1999, 262-NY-267856 serial 3935

Details: On August 7, 1998, terrorist cells linked to USAMA BIN

REQ. #34-1 000000198

To: New York From: New York

LADIN bombed the United States Embassies in Nairobi, Kenya and

I. Mercy International Relief Agency (MIRA) , Daewoo Laptop

KENBOM 1B241; NYO CART item number Q118

On August 20', 1998, V^^HHHH^HH|| seized a Daewo°

The New York (NYO) Computer Analysis Response Team

A copy of the printable files from the laptop is

II. MIRA, Disks and Compact Disks (CD-ROMs), seized

A. KENBOM 1B47, item 12; NYO CART item number Q137

approximately one disk from the MIRA offices in Nairobi, Kenya. ^

NYO CART made a logical copy of all files (including

REQ. #34-1 000000199

A copy of the printable substantive text files from

B. KENBOM 1B90, item 33; NYO CART items Q119 - Q125

approximately seven disks from the MIRA offices in Nairobi,

NYO CART made a logical copy of all files (including

These disks do not contain printable substantive text

C. KENBOM 1B115 item 9; NYO CART item Q136