Missing Minutes in Epstein Jail Video - How many minutes are really missing?

We're breaking down everything you need to know about the raw Epstein video. Are 3 minutes missing? Or are 6 minutes and 34 seconds missing?*

Epstein has been continuously in the news, and things got a little more heated shortly after the FBI memo that was released on July 7, 2025, shared links to download the "raw" and enhanced videos from August 9 - 10, 2005, documenting the final hours before Epstein's death. On July 8, 2025, Bondi explained the missing minute was due to a system reboot. On July 16, 2025, WIRED reported that 2  minutes and 53 seconds were missing from one of the two videos used to create the "raw" video. Finally, on July 21, 2025, WIRED released a podcast episode they said would explain their analysis of the video, but they didn't explain anything. WIRED failed to provide any details that would allow us to reproduce their findings.

Stacy Eldridge and Becky Passmore were not satisfied with the reporting on the metadata involved in this case, and we decided to conduct our own forensic examinations. You can hear all the details in our latest podcast episode Frames Don’t Lie: Epstein’s Missing Minutes on our podcast Parsing the Truth: One Byte at a Time. Why should you care? We're both former FBI Senior Forensic Examiners and we're here to share the facts. We also embedded the YouTube episode at the bottom of this post.




This blog post is going to walk you through everything we did.

We downloaded Video1.mp4 and Video2.mp4 from the links provided in the FBI memo. Based on an initial review of both videos, we were able to conclude that Video1.mp4 was the "raw" video. No hashes were provided in the memo. We also reviewed the OIG memo from 2023.

What you need to know about our review of the video and it's metadata...
  • Hash values for Video1.mp4 calculated with Hasher v.2.1.0.0
    • SHA256: AB4105A6DA3B053F217E432987AC63CD02AB8FFC9EE99532DEFF922491D79956
    • SHA1: I7BCGCZJRVO6B2XCUE7QNLPEZFHCMOHT
  • Video played with Media Player Classic v.2.5.1
  • Video played with VLC Media Player v.3.0.20
  • EXIF Data and Meta Data Extracted with ExifTool v.13.29
  • Frame and stream data extracted with ffprobe v. 2025-07-21-git-8cdb47e47a-full_build-www.gyan.dev 
Before we started our exams, we knew the following had been reported, such as the missing video from 11:58:58 until midnight, an additional 3 minutes of video were missing (from where - who knows?), modified and created dates of video1.mp4, names of 2 files that were used to create video1.mp4, a username directory, and Adobe Premiere was used to create video1.mp4. We set out to find this information for ourselves. Would we confirm these details? Would we find different information? We had no idea where this would lead, but we set out to find and report the facts.


HERE'S HOW WE WORKED THE CASE

GETTING STARTED
  • Calculated hash values
  • Reviewed the video beginning at 7:40 PM until Epstein leaves the view of the camera
  • Noted the start and end times displayed on the time stamps in the video
  • Review the video from 11:56 PM until 12:02 AM to view the reboot
  • Gathered metadata with ExifTool and ffprobe
  • Confirmed the modified and created dates of the video project, username directory, and the names of the files used to create Video1.mp4

EXIFTOOL COMMANDS
  • exiftool -k -a -u -g1 E:\Epstein\video1.mp4 > video1_mp4_exiftool.txt
  • exiftool -ee3 -U -G3:1 -api requestall=3 -api largefilesupport E:\Epstein\video1.mp4 > video1_mp4_exiftool_ee3.txt  

  • exiftool -k -a -u -g1 -ee3 -U -G3:1 -api requestall=3 -api largefilesupport E:\Epstein\video1.mp4 > video1_mp4_exiftool_ee3_k.txt 


ACCOUNT FOR ALL TIME IN THE VIDEO
Any good digital forensic examiner will account for all the space in the digital evidence, whether it's bites and bytes or in this case time. That's what we did.

    • Video Start Time (via timestamps) 8/09/2019 7:40:00 PM

    • Video End Time (via timestamps) 8/10/2019 6:40:00 AM

    • Duration according to time stamps is 11:00:00

    • Duration (EXIF Metadata) 10:52:24

    • Video missing due to reboot 00:01:02

    • Nightly reboot start (timestamp) 8/09/2019 11:58:58 (last number appeared)

      • Duration of first video section from 7:40:00 PM to 11:58:58 PM is 4:16:23.317

      • Ends at Frame 461,039

    • Nightly reboot end (timestamp) 8/10/2019 12:00:00 AM (first number reappeared)

      • Starts at duration 4:16:23.350

      • Starts in Frame 461,040

      • Time remaining indicates 6:36:00.00

      • Ends at Duration 10:52:23.838

      • Ends in Frame 1,173,142

      • Based on the time remaining the clock should end at 6:36:00. But instead the video ends at 6:40 AM. 

        • Four minutes of video missing after midnight.


  • Video should end at 08/10/2019 6:33:26 AM based on
    • 08/09/2019 7:40:00 PM (start time) +
    • 10 hours 52 minutes 24 seconds (Video content duration) +
    • 1 minute 2 seconds (missing due to reboot) = 08/10/2019 6:33:26 AM

  • Difference between video end time displayed and calculated 

    • 8/10/2019 6:40:00 AM – 08/10/2019 6:33:26 AM = 6 minutes 34 seconds


  • Is there an additional 6minutes and 34 seconds not accounted for???

Let’s assume the first video capture was captured in time order, so it starts at the first time stamp displayed in video1.mp4 and then ends at the missing 62 seconds due to the nightly system reboot.

  • 8/09/2019 11:58:58 (last timestamp before reboot) - 

  • 8/09/2019 7:40:00 PM (video start time stamp) =

    • 4 hours, 18 minutes, and 58 seconds should be the duration of the video, according to the time stamps displayed in the video

  • However, according to the video length, the duration at that point in time is only 4 hours, 16 minutes, and 22 seconds

  • This is a difference of 2 minutes and 36 seconds (wired is reporting a difference of 2 minutes and 53 seconds)


STACY AND BECKY WATCH THE VIDEOS
Now we have to watch the video to see if we can literally see when time starts to disappear from the displayed time clocks because the math isn't adding up right.


THERE IS NO VIDEO MISSING FROM VIDEO1.MP4
We watched the entire video. There are no additional time jumps. We do NOT find that any additional video is missing from video1.mp4 outside of the jump from 11:58:58 to 12:00:00.


HOW CAN WE ACCOUNT FOR 6 MINUTES AND 34 SECONDS MISSING?
What about the frames? Are the cameras simply dropping frames between the recordings and the DVR?

  • 1,212,196.5900037 frames in video
  • 6 min & 34 seconds = 11,808.18 frames potentially missing
  • Loss rate = 11,808.18 / 1,212,196.5900037 = 0.0097411427 = 0.97% loss rate
The loss rate is less than 1%. What's an acceptable loss rate for analog videos being recorded to DVR systems? Between 1% and 5%. A loss of 11,080.18 frames during a nearly 11 hour video is an acceptable loss. Let's also remember that when we watched, we didn't find any more missing time stamps.


WHAT ABOUT THE NEARLY 3 MISSING MINUTES REPORTED BY WIRED?
To address this, we have to continue to review all of the metadata embedded in the video. Let's walk you through that below. I'm providing snips of the data recovered with the EXIF tool.

  • Creator Tool is Adobe Media Encoder, which is the tool’s encoding engine that performed the export of the final video
    • Adobe media encode is used with both Premiere Pro or After Effects
      • To determine if it’s Premiere Pro or After Effects you’d need a file name
        • Premiere Pro files are .prproj
        • After Effects files are .aep or .aepx


    • Now you see a file name mcc_4.prpoj
    • This is a Premiere Pro Project
    • Bonus you have a partial username
      • Mjcole~1
      • Could be mjcole with any number of other things following
      • But why is the path an old windows 8.3 shortfilename directory?

Reviewing the times
    • Duration divide by 60 seconds. Divide by 60 minutes =
    • Duration = 10 hours and 52 minutes, which matches the time duration displayed by the video player


Reviewing the track data
    • Track duration = Duration from above (10:52)


    • What is duration value?

      • Internal time units for Adobe. Need to use the Duration scale to convert.

      • 3,522,945,426 × 1.11111111111111e-05 = 39,137.160288888826 seconds

      • Convert to HH:MM:SS = 10:52:17.160 (Length of video)

    • Tracks Markers Start Time of 464017 

      • What is it?

        • A marker, which can include a comment. No comment is displayed in this metadata.

      • What is the value in?

        • 464017 is in frames. Divide by 29.97 fps:
          464017 ÷ 29.97 = 15,479.28 seconds

        • Convert to HH:MM:SS:  = 4 hours, 17 minutes, 59 seconds


  • Below is metadata for the file 2025-05-22 21-12-48.mp4

  • Below is metadata for the file 2025-05-22 16-35-21.mp4

    • What is Pantry Duration?

      • Pantry duration states how long the file is. The scale in this case indicates milliseconds. Take duration value multiplied by duration scale to calculate lengths.

  • Calculations
  • We're finding 0:2:59.540 minutes of "missing video," which is slightly higher than what WIRED reports.

  • Where was that marker at anyway?

    • The marker was at 4 hours, 17 minutes, 59 seconds, which is 1 minute and 17 seconds before the end of the pantry duration. 

    • Even adding 1 minute and 2 seconds, we are only up to 2 minutes and 20 seconds

      • That means we're still missing 39 seconds of video


CONCLUSIONS
  • This is not a "raw" file. It's not evidence. It's WORK PRODUCT. Something someone would make for easier viewing and sharing.
  • There is no video missing from the "raw" file outside of the 62 seconds due to the reboot.
  • Dropped frames account for the missing 6 minutes and 34 seconds we thought we discovered. Loss rate is less than 1%
  • The 3 minutes not accounted for from the file 2025-05-22 16-35-21.mp4 was likely cut from the beginning of the file. This is an assumption based on time calculations based on the metadata we were able to retrieve. This is not definitive as we do not have the original videos that were used to create video1.mp4
  • Since video1.mp4 was created from 2 separate video files the stream and frames data recovered by ffprobe couldn't provide any additional insight to any missing videos or times.

If you have any additional details or data that you've recovered, please contact Stacy Eldridge or Becky Passmore, as we want to get the facts out there.




*The findings and conclusions presented in this report are based on the information available to us at the time of the analysis and my professional knowledge as of this date. New evidence or information may alter these conclusions.

Location: Lincoln, NE, USA

Comments

Post a Comment

Popular posts from this blog

The Rising Cost of Mobile Forensics

Image
The cost of mobile forensics is increasing, and it's not just the price of the software to blame. As mobile phones continue to become more complicated and capable of doing more super cool things, the ability to retrieve and analyze data takes longer because it's all become more complicated. Gone are the days of the quick, 16-hour examination of an iPhone. If your client only cares about the content of texts, emails, and pictures, then, sure, you could grab that for them in 16 hours. But if you need anything more in-depth (and you will), it will take a lot more analysis and time than that. Things change in every update, which means the examiner must spend more time analyzing, testing, and validating the data. Even IF something has NOT changed with an update, many mobile device exams require some testing and validating of the data. All of this increases the prices passed to the clients in three ways. First, the cost of the software is passed along. Second, the longer it takes t...
Read more

Time is the longest distance between 2 points

Image
 "Time is the longest distance between two points."   These words by Tennessee Williams resonate deeply, considering the fragility of our memories and the challenges they pose in crucial moments. Imagine finding yourself on the witness stand, desperately grasping for recollections from the distant past. In this crucial moment, the true weight of time becomes evident.   The importance of detailed case notes cannot be overstated in legal proceedings. They are a vital link that connects our present selves with our past actions. Without them, our memories may falter, we have nothing to refresh our memory, and the quest for truth becomes an arduous struggle.   Case notes are the guardians of our actions, meticulously capturing what we did, discovered, what we found, and even what we didn't. They are the tangible records that safeguard the integrity of our recollections, preventing them from slipping away into the abyss of time.   Picture yourself in ...
Read more

How AI & Deepfakes lead to Sextortion

Image
Buckle up, and prepare yourself for the dark side of technological progress because AI is no exception to the rule. Imagine a world where scammers wield the power of AI to create mind-boggling deepfakes, exposing you in compromising situations. These sextortion scams have reached a whole new level of maliciousness. Let me shed some light on two prevalent ways these scams are executed: Picture this: someone close to you possesses naked pictures of you and shamelessly uses them to manipulate you into doing something you'd rather avoid. It's a terrifying thought, especially considering the perpetrator's familiarity with you. OR Picture receiving a random email that boldly claims to have a treasure trove of your intimate photos. Your disbelief drives you to click the link, only to realize you've fallen into a trap. As a result, your online accounts and even your beloved devices become vulnerable to compromise. I worked several sextortion cases in the FBI; some were your ave...
Read more