Exhibit D

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 1 of 22
1

DECLARATION OF SPECIAL AGENT RICHARD ROBINSON

I, Special Agent Richard Robinson, declare:

INTRODUCTION

1. I am a Special Agent with the Internal Revenue Service Criminal Investigation 

(IRS-CI) and have been so employed since 2004. During my law enforcement career, I 

have investigated multiple violations of federal law within the jurisdiction of IRS-CI.

2. From 2004 through 2017, I was assigned to the Phoenix Field Office. My primary 

responsibilities there included working on white collar crime investigations including, but 

not limited to cases involving allegations of: bankruptcy fraud, mail fraud, wire fraud, 

money laundering, and income tax violations. 

3. From 2017 through the present, I have worked as a Computer Investigative 

Specialist in the E-Crimes Section of IRS-CI. Prior to training for this position, I 

received my CompTIA A+ certification, which required demonstrating a basic 

knowledge of computer hardware and operating systems. I received six weeks of 

specialized training beginning in May 2017 in computer file systems and methods of 

acquiring, verifying and analyzing digital evidence. 

4. I have participated extensively in the investigation leading up to the indictments in 

United States v. Michael Lacey, et al, since 2016. This declaration is submitted in 

support of the government's report on the status of (1) various computer servers that were 

used to host the Backpage.com website, (2) servers used to host a Payment Processing 

Island system used to receive, track and apply payments of Backpage.com and related 

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 2 of 22
2

site users and (3) servers used to perform other functions related to Backpage.com. If 

called upon, I could competently testify as set forth below:

Backpage.com Website Servers, DesertNet and WG

5. Beginning on April 2018, I have corresponded with WG, the Chief Technology 

Officer of DesertNet regarding the computer servers that hosted the Backpage.com 

website. The physical computer servers that ran Backpage’s website were located in 

Tucson and Amsterdam, as more fully described below. While the computer servers in 

both Tucson and Amsterdam were owned by the same ultimate business owners who 

owned Backpage.com, the website itself used code owned by DesertNet and DesertNet 

had handled the administration of the servers since Backpage.com’s inception. I met WG

at the Login, Inc. data center where DesertNet administered Backpage’s servers in 

Tucson, Arizona on April 6, 2018, the day that another DesertNet employee came to the 

data center to shut down the servers that hosted the Backpage.com website both in 

Tucson and in Amsterdam. Based on all of my knowledge gathered throughout the 

course of this investigation, WG and his staff at DesertNet are the most knowledgeable 

people when it comes to the structure and operation of the Backpage.com website 

servers. 

6. After reviewing WG’s correspondence with Matt Frost of the FBI and exchanging 

several additional messages directly with WG, I drafted the document titled “Description 

and Roles of Backpage.com Website Servers” (attached as Declaration Exhibit 1) to 

provide a high level summary of the design of the website servers and their basic 

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 3 of 22
3

function. WG reviewed several revisions of the document and ultimately stated that he 

found it consistent with his memory of how the servers were configured and operated. 

7. The most relevant aspects of that summary at this time are:

A. The servers were designed to have identical data on all database servers and 

all image servers, so someone in possession of at least one database server and one 

image server would find no unique website content on any server that was not 

contained on those two machines. In other words, a single database server/image 

server pair would contain all content contained anywhere on Backpage.com.

B. No one server contains web pages as they were presented to the user when 

the site was active. Elements would need to be pulled from a database server and 

an image server for a web server to be able to generate an ad as it would have been 

displayed to the user. 

Payment Processing Island (PPI), Miscellaneous Computer Servers and CK

8. CK served from 2015 to April 2018 as the Chief Technology Officer (CTO) for 

Website Technologies, LLC, a company that had the same ultimate business owners as 

Backpage.com and handled the operations of Backpage.com. A part of CK’s duties as 

CTO included maintaining the servers that housed the Payment Processing Island or PPI, 

the Amsterdam-based system that received and tracked online payments for 

Backpage.com ads. While developers at Website Technologies would have handled the 

programming and data maintenance of different aspects of the PPI, CK had access to the 

administrative passwords for the system and maintained the structure that housed the 

system. 

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 4 of 22
4

9. CK also administered information technology in Dallas, including offsite storage 

backups in Dallas and systems to store files and e-mail messages from Backpage 

employees. Some of these machines that housed backups had very large storage, an issue 

which is discussed later in this declaration. CK was the former Backpage employee who 

provided information about these servers as was summarized in the government’s letter 

of March 7, 2019, and is the most knowledgeable person I know of with regard to the PPI 

servers and these other servers.

10. After a brief correspondence with CK, I drafted the attached document titled 

“Payment Processing Island Overview” (Declaration Attachment 2) to provide a highlevel summary of the structure of the PPI and other related machines. This document was 

based in part on a diagram, also attached to this document (Declaration Attachment 3), of 

the PPI as it was in 2014. CK reviewed the document, proposed some changes and 

indicated that to his knowledge the statements are accurate and that the descriptions and 

functions of the machines as summarized are substantially correct. 

11. The most relevant points of that summary at this time are:

A. All of the servers described are virtual machines, or VM’s, meaning that 

they are files that run in a program on another physical server, but behave as 

though they were physical machines themselves.

B. Even though the location of the VM’s had changed from Amazon Web 

Service to servers in the Switch Datacenter in Amsterdam, the basic structure and 

operation of the VM’s remained the same as it was in 2014. 

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 5 of 22
5

C. Once the physical machines are obtained, all of the payment data stored in 

the PPI will be found within the Master Database VM, which will be found on one 

of the physical servers. An Internal Application server VM used in connection 

with the Master Database VM would simplify accessing the data and likely allow 

running of reports from the PPI as an employee might have done prior to the PPI 

being shut down.

Matthew Frost of FBI CART and Status of Receipt and Imaging1 of Computer Data

12. Matthew Frost is an Information Technology Specialist Forensic Examiner (ITSFE) who has been a part of the the Computer Analysis and Response Team (CART) of 

the FBI for 10 years. Frost was selected for processing and analysis of the 

Backpage.com servers due to his specialization and experience in MySQL database 

systems, Linux-based servers and Z File System2 storage. Frost has corresponded with

WG and CK at various points to gain a better understanding of the servers and how to 

access the data on those servers. 

13. In view of the high degree of redundancy built into the Backpage.com website 

servers, Frost has not copied the data from all of the servers because copying duplicate 

data would waste limited time and resources. For example:

 1 In computer forensic science, the term “image” or “forensic image” is used to describe a verifiable 

representation of all data stored on a given storage device. The act of acquiring such an image is referred 

to as imaging. 

2 A file system is a method for storing and managing digital data on storage devices, such as hard disk 

drives. Z File System is a relatively new file system designed with features geared to storage pools for 

very large amounts of data. This is not a file system that would likely be encountered on a personal 

computer.

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 6 of 22
6

A. Imaging and verifying a single terabyte (TB) of data takes about 4 hours 

under optimum conditions.

B. Two of the backup devices [1B35 and 1B219]3 each have at least 120 TB 

of storage. Frost has no devices capable of storing 120 TB of data, and no storage 

device capable of delivering a copy of such data to the defense. (See Declaration 

Attachment 4). 

14. Two of the Desertnet servers from Tucson, Arizona were sent to Frost. These 

consisted of a Backpage.com image/picture server [1B41] and a Backpage.com master 

database server [1B60]. Frost imaged the two servers, and the images have been 

provided to the defense. (See Declaration Attachment 4).

15. Nine of the 40 Backpage.com website servers in Amsterdam were identified by 

WG as those that would contain data, specified as database servers, image servers and a 

backup server. The data from these nine servers (except for duplicate data and the backup 

device [1B219]) has been turned over to defense. (See Declaration Attachment 4). The 

other 31 website servers are expected to arrive in the U.S. in June 2019, but those servers 

are not expected to contain website data or images. 

16. An additional five servers expected to arrive from Amsterdam this month

including those that store the PPI system. CK provided a spreadsheet to Frost (and also 

sent a copy to me) showing the virtual servers4 that are on those five physical servers, 

 3 Numbers in square brackets and beginning with 1B refer to individual servers listed on Declaration 

Attachment 4.

4 See Declaration Attachment 2 footnote 1 for an explanation of a Virtual Server.

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 7 of 22
7

approximately 26 of which appear to be related to the PPI. Based on our understanding 

of the PPI provided by CK (see Declaration Attachment 2), the government plans to 

image the servers which contain the Master Database VM and an Internal Application 

Server VM. The government does not plan to image other PPI servers that would contain 

only duplicate data or stored no transaction data. 

17. Three of the servers from Dallas, Texas have been sent to Frost in Pocatello, 

Idaho. One of them [1B34] has been imaged, but copies of that image have not yet been 

provided to the defense. That server contained several VM’s whose functions (as they 

were briefly described in the March 7, 2019 letter to the defense) included antivirus 

servers, asset tracking/inventory software, a backup server, a web user interface and 

others. According to CK the two other servers included (1) a backup appliance [1B36] 

with a 120 TB storage capacity used to store e-mail and subpoena data preservation 

requests and (2) a backup appliance [1B36] with 35 TB of storage capacity that contained 

copies of the Dallas office file server [1B72] and VM’s hosted in the Dallas Colo [1B34] 

and at a facility for a company named PhoenixNAP. Neither of these last two servers has

been imaged. 

A. Two additional servers [1B37 and 1B72] were identified by CK as 

containing e-mail and documents from Backpage.com employees. 

B. These two servers were imaged by a FBI CART member in Arizona and 

those images have been provided to defense.

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 8 of 22
8

18. Frost has been able to identify database entries and images that were included in 

ads specified in the indictment in the form of database entries and individual image files, 

rather than rendered as a single coherent webpage. 

19. The government had hoped to preserve the servers in the Amsterdam Switch 

Datacenter to improve the possibility of being able to easier search and display ads as 

they would have appeared when the Backpage.com site was live. Dutch authorities 

refused to allow the servers to keep running there and indicated that they would be shut 

down. 

I declare under penalty of perjury that the forgoing is true and correct to the best of my 

knowledge and belief. Executed this 31st day of May 2019 at Phoenix, Arizona.

Richard Robinson, Special Agent – Computer Investigative Specialist

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 9 of 22
Attachment 1

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 10 of 22
Description and Roles of Backpage.com Website Servers 

Description of Two Data Centers 

The servers that stored and hosted the Backpage.com website were located both in the Switch 

Data Center in Amsterdam and the Login, Inc. Data Center in Tucson, Arizona. 

The live data in each of these sites was synchronized and designed to be fully duplicated in each 

data center so that the website could maintain continuity if one data center or the other failed at 

any time. 

When the Backpage website was seized and shut down on April 6, 2018 both the Tucson and the 

Amsterdam Data Centers had active servers for the Backpage.com website, broken down 

approximately as follows for each site: 

2 Master Database Servers

3 (or possibly more) Replicated Database Servers (redundant to the Master Database Servers) 1

3 Image Servers (redundant to each other) 

1 Backup Server (data backups of Master Database Servers and Image Servers) 

Various Web Servers – The remaining servers would be Web Servers or similar helper machines 

to help in the web serving process such as load balancers . 2 3

Description of Three Basic Server Types 

The servers at both locations can be divided into three basic kinds of servers: 

1. Database Servers - Contain databases for both central database and the market databases 

(discussed below). 

a. They do not provide any web services. They only contain the databases. 

b. These are divided into Master Database Servers and Replicated Database Servers. 

i. The master databases are the masters and where all database "writes"4

occur. 

 The system was designed with a great deal of redundancy in equipment and any data stored on the 1

equipment, both for purposes of continuity (in case one or more devices should fail) and capacity/

performance (ability to provide a larger number of users with faster delivery).

 Web serving is delivering requested content to the user over a network. 2

 Load balancing is division of web traffic and workload between redundant machines, improving 3

performance and reducing wear on individual machines.

 Writes are disk operations that result in changing of stored data. 4

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 11 of 22
ii. The replicated databases get near instant copies of these changes and are 

generally where the website "reads" occur. 5

iii. This was simply a load balancing method to keep the web traffic on the 

replicated databases, which can scale, and only on the master databases 

when a database write needed to occur (i.e. when changes were being 

made). 

2. Image Servers – Limited web servers used to store and serve images uploaded by users 

and linked to ads. The Image Servers: 

a. receive the images from advertisers, 

b. store the images on their disks, 

c. each contain a full set of the current images for the site. 

d. also serve the images. This makes them a limited web server, just images. 

e. are redundant and load-balanced. 

3. Web Servers - The Web Servers dynamically generate the pages of the site and 

communicate with the database servers to achieve this. 

a. They are a pool of servers handling web serving for all markets including central. 

b. The Web Servers were really just the workhorses. They didn't store the content or 

images but they did piece it all together and dynamically generate the requested 

page. 

c. Said another way, Web Servers currently contain zero unique data. 

d. They do not technically serve images and instead point to the images via HTML: 

(<img src="">). The images are served from the image servers. 

e. The web servers are extremely redundant and load-balanced. 

Overview of Basic Website Operation 

All three basic server types would be involved in a typical user interaction. For example: 

• A user creates an ad on an interface displayed by the Web Server, entering ad text and 

uploading image files to display in the ad. (1)Ad data and content are written to the 

Master Database Servers. (2) The images are stored on the Image Servers and (3) 

pointers or references to the images are written to the Database Servers and 

associated with the other data for that ad. 

• A user clicks on a link to view an ad, causing the Web Server to generate the page by 

(1) reading the ad content from the Replicated Database Servers including the text of 

the ad, and (2) serving the page with pointers to any images referenced in the 

 Reads are disk operations that result in accessing but not changing stored data. 5

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 12 of 22
database with the ad. (3) The referenced images would be served from the Image 

Server and appear on the page. 

Because of this manner of operation, any given ad is not saved on any of the servers as a user 

would have seen it. Viewing a page as it would have appeared would require interaction with all 

three basic types of servers. 

Additionally, because links and references to files and data within the servers were referenced 

based on the way that the servers were networked when the website was operational, restoring 

the website to a functional state would not necessarily be as simple as connecting any three 

servers of the appropriate types. Even though the any one of the Database Servers and Image 

Servers contain data for all Backpage.com ads at the time that the site was taken down, 

simulating the function of the website would require extensive time and expertise, if it is possible 

at all. 

Enough information is available in the Database Server to determine which images were 

displayed with a given ad, but the processes of identifying and locating the image are not 

automatic. 

Overview of Central Database vs. Market Databases 

• The central database, called “central_backpage” included data for all users who posted 

ads on Backpage.com. 

o This included a portion of, but perhaps not all of, the text of any ads stored on the 

web servers. In the case of moderated ads, it would include the ad text, but it 

generally did not include all of the data. 

o This database included the filters that were applied to ads. 

▪ Moderation changes or actions that would apply to all ads would be 

applied to this database as well as the applicable market database(s). 

▪ While moderator action logs were generated from changes made to this 

table, there was no “versioning” built into the system, meaning that 

changed text in an ad would not have a version saved from before the 

change. The changed text would be the new data. 

▪ Images that were deleted by a moderator could remain on the Image 

Server and remain associated with an ad but would be flagged to not be 

included in an ad when the page for that ad was generated. 

o This database included a Site table that listed each market, the addresses (URLs)6

for the market and the “jail” that each market database was grouped into. 7

 Uniform Resource Locators or URLs are addresses for locating a file or resource on the Internet. 6

 The market databases were lumped into groups called “jails” to reduce the administrative and 7

maintenance work that would otherwise need to be applied consistently to each database. Market 

databases could be moved between jails as needed. 

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 13 of 22
• Market databases were created for each state or region and usually named after the 

primary city or airport, such as “nyc_backpage” or "phx_backpage" These databases are 

the source of the ads and will contain everything an advertiser provided for that ad, 

except for the actual image files, which were stored on Image Servers. 

o When a user originally posted an ad, the language and content would be saved to 

these databases. 

o A new/edited ad would trigger a process to copy a portion of that ad data to the 

central database. 

▪ Only the data that “central_backpage” needed was copied there. 

▪ For example, data such as how many bedrooms/bathrooms in a real estate 

ad, or the price of a bicycle for sale in a buy sell trade ad would not be 

copied to “central_backpage” to reduce the data flow.

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 14 of 22
Attachment 2

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 15 of 22
Payment Processing Island Overview

System Overview

The attached diagram shows how the Payment Processing Island (PPI) was set up on the 

Amazon Web Services (AWS) network in 2014. All of the servers shown on the diagram were 

virtual servers1. In system in Amsterdam, all of the equivalent servers were also virtual servers. 

This was done for cost efficiency and flexibility2in operating and balancing the system and so 

that the system could be migrated, if needed.

 

The attached diagram is essentially how the PPI was configured in Amsterdam up through its 

shutdown in 2018. While the number of virtual servers on the Amsterdam servers is not the 

same as shown in the diagram, the functions that virtual servers perform are similar and the 

relationships between the virtual servers are similar. 

One part missing from this diagram was the cryptocurrency portion of the system which operated 

in the same environment. No diagrams that would give a more current layout are readily 

available. 

The PPI virtual machines and data were all transferred to the physical servers in the Switch 

Datacenter in Amsterdam. Any virtual machines or data that may have remained on AWS would 

not have complete sets of data, if anything was left on AWS from the old system. 

Overview of Virtual Server Types Used in the PPI

Some details of the functions of key virtual server types shown on the diagram are as follows:

MySQL3 Master Database Server (M1 on diagram) – This server housed the master database for 

the PPI. All transaction data, even cryptocurrency transactions, were stored in the master 

database on this server. Even if you had only the master database, you'd have all the transaction 

data in the PPI.

MySQL Slave Database Servers (S1, S2, S3 on diagram) – These servers were for redundancy 

and reporting. They contained duplicate data from the Master Database Server, but never held 

any data that was not also on that server. 

 

1 A Virtual Server is a form of a Virtual Machine (commonly referred to as VM), which is a simulation of a whole, 

independent computer within another machine. Several VM’s may be present in one physical server and can 

communicate with other VM’s on the same server or other connected servers as if the VM’s were physical machines 

connected in a network.

2 Running servers on VM’s provides cost savings in that operating several VM’s often costs less than operating the 

same number of physical machines that would perform similar functions. VM’s also provide flexibility in that a VM 

administrator can increase and manage the resources available to a VM (within the limits of the physical server) 

much more easily than upgrading a physical machine. 

3 MySQL is a commonly used open-source relational database management system. 

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 16 of 22
External App Red Hat4 Web Server (W1, W2, W3, W4, W5, W6 on diagram) – These servers 

ran web applications that presented data in the database to external users of Backpage.com and 

the various affiliate websites. Payments and other changes to data made by external users would 

be made using online applications hosted from these servers. 

Internal App Red Hat Web Server (A1, A2, A3 on diagram) – These servers ran web 

applications used by employees of Backpage.com and related companies to access and present 

data in the database files for functions such as reports and research5. Employees used these 

applications to pull, review and modify transaction data. 

Overview of Data Stored in the PPI Master Database 

All of the following types of transactions would have been recorded in the PPI Master Database:

 Purchases of Backpage credits that could later be used to pay for ads or ad upgrades made 

using:

o Credit cards or prepaid debit cards

o Bitcoin or other virtual currency

o Money Orders

o Gift cards for other businesses exchanged for credits

 Use of credits to pay for ads, ad upgrades or services such as reposting an ad.

 Direct payments using credit or debit cards or Bitcoin for ad upgrades or services

 Charges incurred on Send Me A Bill accounts (SMAB accounts) and payments made to 

those accounts

User payment data that was stored was limited by PCI industry guidelines6. For example, full 

credit card numbers were not stored, but rather the last four digits of the card number. 

Guidelines also limited the amounts and types of customers’ personal identification information 

(such as e-mail addresses, phone numbers, etc.) data that could be stored.

Backpage.com had a policy for purging transaction data after a given time, but particular details 

of that policy are not readily available. 

There was a way to associate ads or users with their related transactions in the PPI, but details of 

how that worked are not readily available. 

 

4 Red Hat is a variation of Linux, a type of computer operating system. (Windows and Mac OS are also types of 

operating systems.) The internal and external application servers in the old PPI on AWS ran using Red Hat, which is 

why their label on the diagram includes “Red Hat.” These application servers in the PPI that was running in the 

Switch Datacenter in Amsterdam through April 2018 ran on another Linux variation named CentOS. 

5 While these servers do not store/house any transaction data themselves, applications on these servers would 

simplify accessing and interpreting the data found in the database. The applications run from the W servers and A 

servers are analogous to terminals that would connect to old mainframe computers, where the database acts like the 

mainframe, (which houses the data, but not in a user friendly format). A user who is fluent in MySQL could 

perform these functions without these application servers.

6 The Payment Card Industry (PCI) Security Standards Council developed guidelines that limited the amount and 

types of payment and personal data that businesses were allowed store. 

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 17 of 22
Other Servers/Backup Appliances

Backup appliances located in Dallas included the following general types of data:

Backup appliance Unitrends switch Colo7128 TB Storage: This was the offsite backup appliance 

for the Switch (PPI) environment. It should contain the same data the systems in Amsterdam did 

but may not include the most recent data, since backups run on a schedule instead of real time.

Backup appliance Unitrends Dallas Colo 35 TB Storage: This was the offsite backup for the 

Dallas office file server and PhoenixNAP8systems (VM’s). This also contained backups of the 

systems (VM’s) hosted at the Dallas Colo.

Synology RS18016xs+ with 120 TB storage (CARTMAN Synology NAS): This was the storage 

device used to store email and for email subpoena data preservation requests.

 

7 Colo is a commonly used term for a colocation center, a place where several customers can have their computer 

servers stored and connected to the Internet, such as the Switch Datacenter in Amsterdam. 

8 PhoenixNAP is a company that offers colocation service and data hosting service. 

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 18 of 22
Attachment 3

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 19 of 22
Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 20 of 22
Attachment 4

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 21 of 22
Summary of Backpage Servers Imaged/Previewed to Date

Description of Server Origin Location Type of Server Imaged or Previewed Raw Storage O

1B34 HQP002098 Dell R730xd Server (VM Server) S/N:GLF4ND2 Dallas Colo Pocatello VM Server Imaged 

1B35 HQP002099 Synology RS18016xs+ S/N:1650N8N101000 Dallas Colo Pocatello Storage for e‐mail and subpoena (120 TB) Not imaged or previewed 

1B36 HQP002100 Unitrends Inc. S/N:C8260FF22N20190 Dallas Colo Pocatello Dallas File Svr/PhoenixNap Backup Not imaged or previewed 

1B37 (U) Dell R730xd Server S/N:7Q32GK2 Dallas Colo Arizona Includes Files and e‐mails (e‐mails and docs pulled)+ 

1B72 (U) DELL SERVER SERIAL NUMBER 4JJSSD2 Dallas ‐ Backpage Office Arizona Includes Files and e‐mails (e‐mails and docs pulled)+ 

1B41 HQP001875 Dell Power Edge R720 Service Tag: 4N99H02 Tucson Pocatello Image/Picture Server Imaged 

1B60 HQP001876 Dell Power Edge R920 Service Tag: 555YX12 Tucson Pocatello Master Database Server Imaged 

1B211 HQP001982 Dell R730 service tag 5Z8B642 Amsterdam Pocatello Master Database Server Imaged 

1B212 HQP001979 Dell R730 service tag 2Y8B642 Amsterdam Pocatello Master Database Server Imaged 

1B213 HQP001983 Dell R820 service tag J9SK9X1 Amsterdam Pocatello Slave Database Server Imaged 

1B214 HQP001981 Dell R820 service tag 2BSK9X1 Amsterdam Pocatello Slave Database Server Previewed in Amsterdam++ 

1B215 HQP001980 Dell R820 service tag 1BSK9X1 Amsterdam Pocatello Slave Database Server Previewed in Amsterdam++ 

1B216 HQP001984 Dell R720 service tag 1FSP9X1 Amsterdam Pocatello Image/Picture Server Imaged 

1B217 HQP001985 Dell R720 service tag 4FSK9X1 Amsterdam Pocatello Image/Picture Server Previewed in Amsterdam++ 

1B218 HQP001986 Dell R720 service tag 4FSN9X1 Amsterdam Pocatello Image/Picture Server Previewed in Amsterdam++ 

1B219 HQP001987 Unitrends backup‐server type 938S S/N: 938S‐700‐70049 Amsterdam Pocatello PII Backup Server Previewed in Amsterdam++ 

+Frost never saw these servers but was told they w

++Dutch authorities previewed these devices prior 

*Not turned over, but can be made available

**Not turned over as it was determined to be dup

Case 2:18-cr-00422-DJH Document 626-4 Filed 05/31/19 Page 22 of 22