GitHub - randallscott25-star/epstein-forensic-finance: Epstein Financial Forensics Automated forensic financial reconstruction from 1.48 million DOJ EFTA documents + 503K cataloged media items

Epstein Financial Forensics

Automated forensic financial reconstruction from 1.48 million DOJ EFTA documents + 503K cataloged media items

What This Is

This repository contains the methodology, findings, and documentation for a computational forensic analysis of the U.S. Department of Justice's Epstein Files Transparency Act (EFTA) corpus.

I built this project as a solo effort — writing all extraction code, designing the database schema, developing the financial classification pipeline, and performing the forensic analysis myself, with AI assistance for development acceleration and quality assurance. The underlying methodology draws from my professional background in multi-affiliate financial reconciliation, budget variance analysis, and automated exception reporting at institutional scale.

To my knowledge, this represents the first systematic attempt to reconstruct the complete financial infrastructure visible in the EFTA corpus using quantitative forensic methods — moving beyond narrative analysis of individual documents to model the full network of fund flows, entity relationships, and shell trust hierarchies at scale. For the girls.

📌 Start Here

🔺 New: Blueprint of a Financial Machine

I audited $2.1 billion in Epstein financial records. Here's every name the money touched. 123 nodes, 313 financial links, 8 shell entities, 12 key persons, 8 operators, 5 banks — mapped across the full $2.146B corpus. Season 1 finale.

→ Read Narrative 19 · Interactive Visualization · Offshore Architecture (N18) · One-Way Money (N17)

19 data narratives reconstruct how $2.146 billion moved through 14 shell entities across 8+ banking institutions. Every claim is anchored to specific court exhibits and bates stamps.

→ Read the Data Narratives · Explore the Interactive Network · View the Forensic Workbook

The Database

8.03 GB | 36 tables | 26.6 million rows | 19 datasets

Note: The largest narrative repo's 1,380,937 figure counts individual pages as records; their unique PDF file count is ~519,548. My 1,476,377 are unique files each with a distinct DOJ URL or registered serial, plus 503,154 separately cataloged media items from DS10 evidence photos and videos. Multiple projects in this space are doing valuable, complementary work — narrative forensic reporting, searchable archives, community preservation. This project's lane is systematic financial reconstruction at scale.

Headline Results

⚠️ All findings are navigational tools derived from automated extraction. They have not been independently verified and should not be treated as established fact. See COMPLIANCE.md for full professional standards disclaimers.

Four-Tier GAGAS-Aligned Confidence Framework

Why T1–T3 Exceeds 100%

The SAR benchmark ($1.878B) represents only transactions banks flagged as suspicious. The EFTA corpus contains the complete financial record — including legitimate, non-suspicious transactions such as Sotheby's auction proceeds ($11.2M), Tudor Futures investment returns ($12.8M), Kellerhals law firm settlements ($23M), and Blockchain Capital VC investments ($10.5M). Total financial flows should exceed the suspicious subset. Standard forensic accounting: SAR ⊂ Total Financial Activity. The T4 (Unclassified) tier is excluded from the SAR comparison because those transactions lack sufficient entity resolution for classification.

The Money Circuit: 4-Tier Trust Hierarchy

See full annotated flow diagram: NETWORK.md

TIER 1 — HOLDING TRUSTS (received external deposits)
  Southern Trust Company Inc.        $151.5M in  ← Black, Rothschild, Narrow Holdings
  The 2017 Caterpillar Trust          $15.0M in  ← Blockchain Capital

TIER 2 — DISTRIBUTION TRUSTS (redistributed internally)
  The Haze Trust (DBAGNY)             $49.7M out → Southern Financial, Southern Trust
  The Haze Trust (Checking)           $21.8M in  ← Sotheby's, Christie's
  Southern Financial LLC              $14.0M in  ← Tudor Futures
  Southern Financial (Checking)       $32.0M in  ← Haze Trust

TIER 3 — OPERATING SHELLS (paid beneficiaries)
  Jeepers Inc. (DB Brokerage)         $51.9M out → Epstein personal account (21 wires)
  Plan D LLC                          $18.0M out → Leon Black (4 wires)
  Gratitude America MMDA               $6.3M out → Morgan Stanley, charities
  Richard Kahn (attorney)              $9.3M out → Paul Morris, others
  NES LLC                              $554K out → Ghislaine Maxwell

TIER 4 — PERSONAL ACCOUNTS (terminal destinations)
  Jeffrey Epstein NOW/SuperNow        $83.4M in  ← Jeepers, Kellerhals, law firms
  Darren Indyke (estate attorney)      $6.4M in  ← Deutsche Bank

All amounts are (Unverified) automated extractions. See FINDINGS.md for detailed analysis.

Money Flow Direction Analysis

SAR Benchmark (Public Record, Independently Verified)

Sources: U.S. Senate Permanent Subcommittee on Investigations; NYDFS Consent Order (2020); JPMorgan USVI Settlement (2023)

Database Schema (36 Tables)

See full database architecture diagram: SCHEMA.md

This is not a search index. This is a relational forensic database. 8.03 GB, 36 tables, 26.6 million rows.

Financial Analysis (13 tables)

• publication_ledger — 6,310 deduplicated transactions ($2.146B) with four-tier GAGAS classification (T1–T4), payment type, source exhibit
• fund_flows — 23,832 directional money movements (entity_from → entity_to, amount, date, confidence)
• fund_flows_audited — 7,355 classified flows (5-tier: PROVEN/STRONG/MODERATE/WEAK/VERY_WEAK) with FinCEN/ICIJ match flags, composite scoring, entity classification
• verified_wires — 185 court-exhibit authenticated wire transfers (dates, bates numbers, exhibits)
• verified_bank_statements — 1,202 multi-bank statement transactions from 13 institutions with statement dates and balance context
• financial_hits — 81,451 financial content extractions across 19 categories and 3 verification tiers (C1/C2/C3)
• financial_redactions — 2,395 recovered dollar amounts near redaction markers with confidence scoring
• fincen_transactions — 4,507 FinCEN suspicious activity report transaction records
• fincen_bank_connections — 5,498 bank-to-bank SAR relationship mappings
• entity_aliases — 186 raw text → canonical name resolution rules
• entity_roles — 74 classified entities with total inflow, outflow, net position, wire counts, and exhibit references
• payment_type_registry — 10 classified payment types (wire, CHIPS, SWIFT, bank statement, check, etc.)
• dedup_audit_log — Deduplication decision trail for publication ledger assembly

Entity Intelligence (3 tables)

• entities — 11,438,134 extracted entities with NLP classification (PERSON, ORG, GPE, MONEY, NORP, FAC, LOC, LAW)
• poi_rankings — 2,000 persons of interest scored by multi-axis corpus frequency (file count, financial count, flight count, redaction dollars, direct dollars)
• evidence_index — 1,077,516 evidentiary chain records linking documents across datasets with bates numbers, checksums, and source types

Redaction Analysis (3 tables)

• redaction_recovery — 157,984 content fragments recovered from under redaction overlays (with financial/names/dates flags and interest scoring)
• redaction_markers — 140,060 systematic redaction position records across corpus
• redaction_summary — 131,860 aggregated redaction analysis per document

Corpus Infrastructure (4 tables)

• files — 1,476,377 file records with 30 columns: metadata, classification, dates, extraction status, doc types
• extracted_text — 2,866,239 page-level text records with classification and extraction method
• dates_found — 2,411,188 temporal references extracted across entire corpus with context
• media_evidence — 503,154 DS10 image/video catalog with custodian, doc_type, confidentiality markings

External Cross-Reference — FAA Aviation (7 tables)

• faa_master — 309,849 active aircraft registrations
• faa_dereg — 381,869 deregistered aircraft records with cancellation dates
• faa_acftref — 93,521 aircraft type/model reference
• faa_engine — 4,743 engine type reference
• faa_dealer — 12,485 aircraft dealer registrations
• faa_reserved — 126,504 reserved N-numbers
• faa_docindex — 11,440 FAA document index

External Cross-Reference — ICIJ Offshore Leaks (6 tables)

• icij_entities — 814,344 offshore entities from Panama Papers, Paradise Papers, Pandora Papers, and other ICIJ investigations
• icij_officers — 771,315 officers/directors of offshore entities
• icij_relationships — 3,339,267 entity relationship records
• icij_addresses — 402,246 offshore entity addresses worldwide
• icij_intermediaries — 25,629 shell company formation agents
• icij_others — 2,989 other offshore entities

Pipeline Architecture

Phase 1    DOJ EFTA Scraper + Community Gap-Fill → 1.48M files + 503K media registered
Phase 2    Download & Verify → local corpus with integrity checks
Phase 3    Extract, Classify & Enrich → text, doc types, dates
Phase 3B   Entity Extraction (spaCy NLP) → 11.4M entities, 734K persons
Phase 5A   Person-of-Interest Network → news-filtered, multi-source scoring
Phase 5B   Operational Cost Model → confidence-tiered financial extraction
Phase 5C   Entity-to-Entity Fund Flows → directional A→B with 5-axis scoring
Phase 5D   Payment-Travel-Victim Correlation → temporal pattern analysis
Phase 5E   Redaction Map → navigational tool for document analysis
Phases 14-24  Wire Transfer Extraction Pipeline → 382-wire ledger, $1.964B
Phase 5I   Entity Resolution & Bank Expansion → 481-wire ledger, $973M entity-resolved, 14-bank coverage
Phase 5J   Multi-Bank Statement Parser → 1,202 verified transactions from 13 banks
Phase 5K   Payment Type Expansion → CHIPS, SWIFT, checks, bank statements beyond wire transfers
Phase 5L   Publication Ledger Assembly → 6,310 unique transactions, $2.146B, four-tier GAGAS framework

Financial Extraction Pipeline (Phases 14–5L)

Full phase-by-phase details: METHODOLOGY.md

Financial Methodology: 5-Axis Forensic Scoring

Every financial record is independently scored across five axes:

Classification Tiers:

• PROVEN (≥12): Bank statement language, multi-axis confirmation, ctx_txn ≥ 2
• STRONG (8-11): Good signals, minor gaps
• MODERATE (5-7): Mixed signals
• WEAK / VERY_WEAK / REJECT: Insufficient evidence or known noise

Validation: v6.2 spot-check achieved 93% accuracy on top-30 PROVEN transactions (28/30), with 0% balance contamination (down from 47% in v5).

GAP Analysis

What's Still Missing

Only one gap ($5-15M excluded tiers) has a credible dollar estimate. The others are real information gaps with unknown values. I am not going to put specific ranges on things I cannot measure.

Data Narratives

→ Read all Data Narratives

Source workbook: Forensic Workbook · Interactive Shell Network

Every claim anchored to specific wire transfers, entity classifications, and court exhibit references from the master ledger.

Repository Contents

├── README.md                              ← You are here
├── docs/
│   ├── METHODOLOGY.md                     ← 25-phase pipeline, 9 bugs, 5-axis scoring, limitations
│   ├── FINDINGS.md                        ← GAP analysis, 8 key discoveries, recommendations
│   ├── COMPLIANCE.md                      ← Professional standards, GAAS conformance, legal disclaimers
│   ├── SCHEMA.md                          ← Database architecture diagram
│   ├── NETWORK.md                         ← Trust network flow diagram
│   └── SOURCE_APPENDIX_TEMPLATE.md        ← Standard template for source appendices
├── narratives/                            ← 18 forensic data narratives with source appendices
├── data/
│   ├── publication_ledger_phase5l.json    ← 6,310 transactions, four-tier (publication dataset)
│   ├── master_wire_ledger_phase5i.json    ← 481 wires (wire-specific subset)
│   └── entity_classification.json         ← Entity → type mapping (228 entities)
├── visualizations/                        ← Interactive shell network diagram
└── tools/
    ├── narrative_sql_tools.py             ← SQL query functions for all 18 narrative data sources
    ├── linkify_efta.py                    ← Auto-link EFTA IDs → DOJ PDFs in .md files
    ├── convert_links_new_tab.py           ← Convert external links to target="_blank"
    ├── inject_efta_source_table.py        ← Add source document tables to narratives
    └── append_source_appendices.py        ← Append source appendices to narratives

Visual Guides

• SCHEMA.md — Full database architecture showing how 36 tables, 11.4M entities, and 1.48M files feed into the 6,310-transaction publication ledger
• NETWORK.md — Annotated trust network flow diagram with dollar amounts on every edge

Forensic Workbook v9

What Makes This Different

I didn't read the documents. I audited the money.

Other projects in this space build search engines, write narrative reports, or create browsable archives. All valuable work. This project applies the same methodology I use in professional public-sector financial auditing — multi-affiliate reconciliation, exception reporting, variance analysis, confidence tiering — to computationally reconstruct the financial infrastructure visible in the EFTA corpus.

The question I set out to answer isn't "what do the documents say?" It's: "Where did the money go, who moved it, and what did the DOJ redact around it?"

Why Findings Only — No Source Code or Database

This repository publishes methodology, findings, and summary data. The underlying source code, database, and raw extraction pipeline are not included. This is intentional and consistent with forensic accounting standards:

• AICPA SSFS No. 1 (Statement on Standards for Forensic Services) establishes that forensic practitioners maintain control over working papers, proprietary methodologies, and analytical tools. Work product privilege protects the analytical process.
• AICPA AU-C §230 (Audit Documentation) provides that audit documentation is the property of the practitioner and should be retained under the practitioner's control. Sufficient documentation is provided for a knowledgeable reviewer to understand the work performed.
• Chain of custody: The 8.03GB forensic database represents a consolidated analytical environment. Releasing it in fragments could enable miscontextualization of intermediate results without the full pipeline logic that produced them.
• Reproducibility through transparency: The methodology documentation, scoring weights, classification rules, and dedup logic are fully described — enabling independent replication without distributing the tooling itself.
• Ongoing analysis: The database and pipeline remain active analytical tools. Premature release could compromise the integrity of forthcoming data narratives and follow-on investigations.

The master wire ledger (481 wires) and entity classification data are published in full in the data/ directory. These represent the final audited outputs and are sufficient for independent verification of all published findings.

Author

Randall Scott Taylor Director of Finance Administration, large municipal government agency BS Network & Cyber Security, Wilmington University MS Applied Data Science, Syracuse University

I built this project — every line of extraction code, every database table, every classification rule, every phase of the pipeline — as a solo effort. AI tools (Claude, Anthropic) were used for development acceleration and quality assurance, the same way a solo practitioner might use a calculator or reference library. The analytical judgments, methodology design, and forensic interpretations are mine.

Professional background: multi-affiliate financial reconciliation, budget auditing, automated classification and exception reporting systems, and large-scale fiscal operations for institutional financial data.

Ethical Standards

• Victim protection: No victim names, identifying details, or testimony content is stored, published, or extractable from any output. Victim-adjacent redactions are noted by proximity only.
• SSFS alignment: All outputs include frozen Row 1 caveats, (Unverified) column tags, and navigational-tool disclaimers consistent with professional standards.
• No attribution of guilt: Financial flows are documented as they appear in DOJ documents. Appearance in this analysis does not imply wrongdoing.
• Open methodology: Every extraction rule, scoring weight, and classification threshold is documented and reproducible.

Disclaimer

This analysis does not constitute an audit, examination, or review performed in accordance with GAAS, GAGAS, or AICPA SSFS No. 1. See COMPLIANCE.md for a detailed discussion of applicable professional standards and how this analysis relates to them.

All financial amounts are (Unverified) automated extractions unless explicitly noted otherwise. Entity classifications are based on OCR text extraction with automated normalization and may contain errors. Shell entity designations are analytical classifications, not legal determinations.

Citation

Taylor, R.S. (2026). Epstein Financial Forensics: Automated forensic financial
reconstruction from 1.48 million DOJ EFTA documents. GitHub.
https://github.com/randallscott25-star/epstein-forensic-finance#readme

License

This work is licensed under Creative Commons Attribution 4.0 International.

The underlying DOJ documents are U.S. government publications in the public domain. This repository contains only metadata, extracted analysis, and methodology — no copyrighted source material is reproduced.

Project Timeline