Keith Ablow’s Unallocated Space in Hunter Biden’s Memory

In the third part of Gus Dimitrelos’ report* on the laptop attributed to Hunter Biden, he examines what he could find in the unallocated space of the laptop — the place where deleted files go on computers until they eventually get written over. He does it, in laymen’s terms, to prove that there was someone at the keyboard of the laptop, deleting individual files by hand, which he claims (falsely) is proof that, “Robert Hunter Biden is in control of the MacBook Laptop.”

He shows remarkably little interest in what got deleted.

At least two of the files deleted from the laptop pertain to the therapist from whom the President’s son was getting Ketamine treatment during the period his digital life appears to have been taken over, Keith Ablow, and in whose office the DEA discovered different laptop owned by Hunter Biden in 2020.

According to two people familiar with the matter, a different Hunter Biden laptop landed in the custody of the DEA in February when they executed a search warrant on the Massachusetts office of a psychiatrist accused of professional misconduct. The psychiatrist has not been charged with a crime.

Hunter Biden was not a target of the search or the investigation, and his lawyer ultimately got his laptop back. It’s not clear why his computer was left in the doctor’s office.

Who is Keith Ablow?

One enduring mystery about the “Hunter Biden” “laptop” affair is why the son of a top Democrat ended up doing Ketamine therapy with a Fox personality just weeks short of allegations that the shrink had sexually harassed patients, an accusation that would lead to his suspension.

Ablow’s career on Fox extended back years by the time in 2018 when Hunter Biden got involved with him. He made obnoxious comments both about the Obamas and marriage equality and a ludicrous pitch in favor of Newt Gingrich. There’s no reason a Democrat should ever have trusted him.

And then, shortly after the time when Hunter Biden’s digital world appears to have been taken over by his droidhunter Gmail, several lawsuits accusing Ablow of sexual harassment went public.

The women allege that Dr. Keith Ablow, an author who was a contributor to Fox News network until 2017, abused his position while treating them for acute depression, leaving them unable to trust authority figures and plagued with feelings of shame and self-recrimination.

“He began to hit me when we engaged in sexual activities,” wrote one plaintiff, a New York woman, in a sworn affidavit filed with her lawsuit. “He would have me on my knees and begin to beat me with his hands on my breasts,” she wrote, “occasionally saying, ‘I own you,’ or ‘You are my slave.’”

The malpractice lawsuits, two of them filed on Thursday in Essex Superior Court and a third filed last year, paint a picture of a therapist who encouraged women to trust and rely on him, then coaxed them into humiliating sexual activities, often during treatment sessions for which they were charged. When the New York woman had trouble paying her therapy bills, she said, Ablow advised her to work as an escort or stripper because the work was lucrative.

The three lawsuits were settled. But as a result Ablow’s medical license was suspended. As noted above, for some reason the DEA searched his office a year later, where they found yet another Hunter Biden laptop left behind.

Update: Here’s a picture of Ablow speaking at a Trump rally in MA on March 4, 2017.


Deleting Ablow

In fact, the accusations against Ablow were one of two things that Dimitrelos found in the unallocated space of what would have been the laptop.

On February 25, 2019, Hunter Biden texted someone else a link to the BoGlo report on the accusations, which had been published four days earlier. “My psychiatrist,” Hunter Biden explained in a follow-up text. “I can’t catch a break,” he said in the third. If authentic, these texts appear to capture Hunter’s immediate response to the abuse allegations, and the four-day delay in his discovery of them.

That someone would delete those is interesting enough.

But I’m far more interested in the other file Dimitrelos found. It was a December 10, 2018 invoice, sent by iChat. It reflected the following psychotherapy sessions with Hunter, which were identified as “New Incident”:

  • November 10, 2018: 90 minutes
  • November 11, 2018: 90 minutes
  • November 12, 2018: 30 minutes
  • November 14, 2018: 60 minutes
  • November 14, 2018: 60 minutes
  • November 15, 2018: 60 minutes
  • November 16, 2018: 60 minutes

It was a three page invoice, but Dimitrelos only shows the first page, so there could be more sessions in the weeks between November 16 and December 10, 2018. All sessions were paid by credit card within days.

But even just that single page shows that Hunter was spending time with Ablow in the period when he obtained new devices — including the laptop believed to be the one that ended up in John Paul Mac Isaac’s shop.

It’s easy to see, then, how and when Ablow might have come into possession of a Hunter Biden laptop and Hunter Biden might have started using the new one that would end up becoming a big political hit job.

[Update: I corrected my timeline here. Hunter Biden started using the laptop believed to be the one brought to Mac Isaac’s shop in October, not November.]

Baystate or Bluewater

Dimitrelos says the invoice, “correlates [with] email communications with Keith Ablow and the Practice Manager.”

But the invoice doesn’t. It differs with the emails we see with Ablow and his practice manager, a woman named Tiffany Bartholemew, as they appear in the BidenLaptopEmails dot com collection, in at least one key respect. The bill is from “Bluestate Psychiatry.” But Bartholomew writes from “Bluewater Wellness.”

The discrepancy may arise from a difference in treatment: and therefore also payment schemes. Of the emails related to Ablow sent by Hunter, about a dozen had to do with accommodations, including:

  • Emails Bartholomew sent on December 4, 2018 (and so before the invoice) about payment for “this week” at Plum Island Rental
  • The confirmation for that reservation, sent the same date as the invoice, to the rhbdcicloud and cc’ed to Bartholomew, followed by one sent on January 3, not cc’ed to Bartholomew, providing instructions for getting in
  • An email sent on January 26 from the “manager of Dr. Ablow’s cottage”
  • Seven emails from a guy who seems to have made himself Hunter’s Chief of Staff at a meeting on January 24, all of which pertain in part or in whole to finding a new place in Newburyport, MA

Those were all sent to the rhbdcicloud. Another email from Bartholomew, sent to the same email, alerted Hunter to a rescheduled Yoga session while in Massachusetts.

There were several other more curious emails involving Bartholomew:

  • An email sent on January 5, 2019 to rhbdc at, seemingly asking Hunter for advice about how to deal with an insane temp leaving adverse reviews on Google
  • An MP4, dated January 8, 2019, titled Neverending story, sent first via Google Drive from a Gmail account, then forwarded the next day from her Ablew email account, both times to the rhbdcicloud

In this same period, Hunter paid someone with the last name Bartholomew but a different first name, via Venmo, for purchases at CVS, using his rhbrspdc account.

Guys are you getting my emails?

But several of the emails demonstrate Hunter’s communication woes during this period.

The very first email from Hunter Biden to Ablow in the Marco Polo set, sent on January 3, 2019, was misaddressed, and bounced. It was sent again, with the subject line “yyyy.”

While no body of that text appears in the Marco Polo set, Ablow responded to it, adding a third person, Rock, and asking for help getting a doctor to review Hunter’s daughter’s x-rays from a bad skiing accident.

Hunter responds, saying he is attaching the x-rays (and reply emails show jpg attachments):

I am attaching the X-rays and would so much appreciate your helopmputting [sic] them in the right hands.

Hunter and Ablow exchange two emails among themselves.

Then Ablow responds to his own email, which this time is marked [External], noting that “His [apparently meaning Hunter’s] email is screwed up,” and then saying he had texted Rock.

From: Keith Ablow <kablow[redacted]>
Sent: Thursday, January 3, 2019 11:40 AM
To: Positano [redacted]; rhbdcicloud
Subject: [EXTERNAL]Re: From Keith

CAUTION: External Email.

His email is screwed up

I texted you

The doctor responds — happy to help — and provides his contact. Ablow thanks him. Hunter responds to that, plaintively,

Guys are you getting my emails?

And though neither of the external interlocutors ever said a thing directly to Hunter, Ablow says, yes, suggesting they had gotten his emails, then instructs Hunter to contact the doctor and “send him the x-rays,” even though in the original email Hunter already sent 2 jpgs.

Hunter then tried to email the doctor directly, using the same email included in Ablow’s email (possibly even using the link from the doctor’s own email), and it bounces, “RecipientNotFound; Recipient not found by SMTP address lookup.”

At least based on the Marco Polo set, Hunter Biden didn’t send much between then and January 15 (though I may return to what he did send; he had important exchanges with his lawyer George Mesires).

Then he had another communication failure with Ablow’s team, though apparently of a different type.

On January 15, 2019 at 11:13AM, Hunter sent Ablow’s practice manager, Bartholomew. an email from his droidhunter account, asking “Schedule?” The email itself appears in the MarcoPolo collection, but any other body of the email is not preserved.

Bartholomew responded, on January 15 at 11:19PM, to the droidhunter account, describing his schedule for both “today” (seemingly meaning January 15) and “tomorrow,” his Ketamine treatment on January 16.

Then, just under 3.5 hours later, she sent that same email again, to both the droidhunter and rhbdcicloud with the message:

Below is the response I sent within minutes of receiving your email.

I called you this morning
Both Keith and I texted – I, multiple times, both on the group text and solo
I tried calling
I had Jodi text and call and you did not answer until 2pm

I texted you after sending the below email and mentioned adding yoga on for tomorrow – I did not receive a response and I will not waste people’s time booking them if you do not stay in touch

Bartholomew appears to have attributed this to Hunter’s mental struggles, and it may well have been (though it is notable since it is the sole exchange with her involving the droidhunter email).

The reason people love my Dad Chris iOS because he’s the son they hope to raise

The questions about whether Hunter was communicating externally — to say nothing of the effect of the Ketamine treatment, which by context would have been January 16 — makes me really uncomfortable with what happened with a statement Hunter Biden shared for this Vanity Fair story on whether Hunter’s problems were leading Joe to hesitate about running.

The exchange starts with Hunter forwarding an email he sent to Doug Brinkley on his rosemontseneca email to Ablow, using his rhbdcicloud email, with his long and very rough draft of a statement.

Ablow asks if he wants edits.

I could also make a few other edits, with humility. Would you like me to?

Hunter responds by saying it needs both edits and to be more concise. So Ablow promises to do it overnight.

I can make it all happen by 8 am.

Not to worry.

This is my thing.

Stay tuned.

As that exchange was happening, Hunter sent the statement to his lawyer, George Mesires, via his rhbdcme address. Mesires responded saying, “I can’t stop crying,” but providing no edits.

Hunter sends two snide comments to the journalist to his attorney George Mesires, from the rosemontseneca email, ccing Ablow.

Then ultimately he sends the statement as rewritten by Ablow to Mesires.

“FIXED A FEW OF MY TYPOS . . .” Hunter said of the statement substantially written by Ablow. Mesires would have no way of knowing that Ablow had made all the changes.

Vanity Fair removed one paragraph about Hunter’s own background as well as this significantly edited snide comment to him:

I hope that answers your question, Chris. I would ask this one of you: Are your talents best used as a tabloid journalist? If you were willing to endure more pain to make a more powerful contribution to our shared world, what would you do? What has stood in your way? My father would tell you this: Don’t let it. Reach deep down and deliver the gifts you were meant to give to others. And that’s the message Americans will see come to life in 2020.

At a time when Hunter Biden was in a communications vacuum, just days off a Ketamine treatment, and probably getting his life hacked irreparably, to become the non-stop political hit job of those trying to take down his father, Keith Ablow replaced Hunter’s statement with his own.

In the process Ablow replaced this fairly amazing paragraph about Joe Biden … [I’ve left all typos, including the charming, “iOS” instead of “is.”]

The reason people love my Dad Chris iOS because he’s the son they hope to raise he’s the parent they hope to be he’s the brother and friend we all look up to. They love him Chris because he is as real an American as they are and they all want to be. He’s not perfect’ he’s got a horrible temper, he spoils his grandkids, he loves my Mom almost too much and he still thinks he can still make me angrier than anyone on earth sometimes. There’s nobody I want to make more proud of me than my Dad and there’s no-one that I know can ever be more proud of me and my whole family. May Dad never has asked anyone of us to be less human he’s just taught us all what it means to be a good man in hard world. He taught me what his mom and dad taught him “Always remember no man is better than you and you are no better than you.”if er to break I m certain they would all say —no one will ever know you better than your brothers and your sisters you always take their side no matter how badly they screwed up. Every Biden kid knows there’s nothing that they could do to make anyone in this family to stop loving you. And finally always be kind to the people in pain (unless they hurt your grandmother your mom your aunt or your sister- then you’re free to beat the shit out of them if your sister hasn’t beat you to it.)

With this one:

I believe that my father has become an ongoing symbol of what it means to keep on fighting for what is good in oneself, in others and in our country. I can tell you that I wouldn’t be alive today, if my dad hadn’t kept fighting for me, too, through my darkest days. So the idea that tragedy or tough times or any number of trials would dissuade a Biden from serving his fellow man—whether a friend or a fellow citizen—could not be more misguided. My dad has proven, ag ain and again, that he is (as Teddy Roosevelt once said of himself) “as strong as a bull moose” and that America “can use [him] to the limit.”

There’s no sign Brinkley ever responded to Hunter’s email. Instead, Hunter sent him three emails — one, responding to an email Brinkley sent him in July 2018, saying,

Obviously I didn’t send that stream of conscience rant with personal attacks and 7000 grammatical spelling and plain unintelligible errors made tons of edits and cutout 80%.

A minute later he sent two more responding to the email he had actually sent Brinkley, quoting just the bolded part of this last line of his own second paragraph.

And its made us understand that the one thing that binds us all not just my family everyone you will ever meet is what it is to feel pain and how the even the smallest gesture of genuine kindness and love can make you hope for a better day.

That line about small gestures of kindness, like much else from Hunter’s own statement, had been removed.

It’s not yet clear what happened between Ablow and Hunter — or whether Ablow’s awareness of Hunter’s technical communication problems went further than that single email.

What is clear is that, in the process, Ablow managed to replace Hunter’s own, heartfelt words about his father and his own struggles.

* At least the first of Dimitrelos’ reports is on Scribe. He sent me copies, but would only permit me to repost them (which would take far more redactions) with some kind of indemnity for ongoing privacy violations. I instead reached out to Hunter Biden’s attorneys for permission to share it privately with some experts but have heard nothing.

129 replies
  1. Rugger_9 says:

    Well, it would appear the RWNM is quite thorough when they try to take down someone. Does Ablow have any connections to Project ‘Veritas’, Karl Rove or Roger Stone? This is right up their alley.

    I do concur about not trusting any GOP type, but I suspect this is like how HRC was maintaining connections to the GOP side for a very long time in the Senate. Ds are remarkably (and foolishly these days) patient about their rivals’ motives. W’s arrival on the scene really started the hardening of sides away from the times where the parties would have an annual game to where BS claims that the Clintons removed all the W keys from the computers when George W Bush moved into the WH.

  2. Ravenclaw says:

    Lots to digest here; thanks as always! I can make just one meaningful contribution:

    The Plum Island in question is probably the one in Massachusetts, just north of Cape Ann. It is said to be a remarkable beauty spot and would be a perfect place to engage in some serious self-reflection in the off-season.

    11/10/18 – 11/16/18 fits exactly with a Saturday to Saturday rental (typical of Massachusetts beach communities). Hunter was probably staying with Dr. Ablow in a cottage and receiving treatment there. (This fits with the hour-plus of therapy time each day; practically nobody was doing telehealth at that time.)

    We know Ablow administered ketamine therapy to Hunter. This was before eskematine (the intranasal form) received FDA approval, but the modality was attracting lots of attention as an off-label use. (At that stage, though, most were still using intravenous infusions.) There are a few schedules for delivery of this treatment. One popular at the time was a single hefty dose. There would be preparation beforehand and a lot of processing afterward. That would have been on the afternoon of Monday the 12th or perhaps on Tuesday the 13th (the only day when there was no “session” held).

    Whether this was a “command performance” for Hunter alone or a “retreat” for a group of 3-5 patients is unclear. If the former, very very expensive! Even in the off-season. But Hunter had been burning through as much as $200K per month earlier that year, and other than talking with his doctor there wasn’t much to do with your money on Plum Island!

    So my guess (pretty confident about this) is that the series of daily therapy sessions ends here.

    Does anyone know whether Hunter’s behavior/affect improved toward the end of 2018?

    P.S. Sorry for long post.

    • emptywheel says:

      Plum Island is in MA. The major treatment took place in January. The Ketamine treatment was January 16, per emails noted above.

      The other sessions in November may have been office visits.

      • Ravenclaw says:

        There is also a Plum Island in New York, but Ablow was Boston-based and the MA one is more of a “destination.”

        Ketamine treatment is often repeated. Nowadays the norm would be 3-6 treatments over the course of 2-3 weeks, but things were more ‘in flux’ in 2018. “Boosters” after a month or two are also common. I don’t know what Dr. Ablow’s version looked like. It’s certainly possible that a November retreat was purely for psychotherapy, but it also could have been a first foray into psychedelic-assisted treatment with 1-3 “trips” in the beach cottage.

      • Ravenclaw says:

        It is, to say the least, chilling to contemplate this badly wounded man in the hands of a pseudo-therapeutic Svengali who would abuse patients for pleasure and profit.

        • retired railroad switchperson says:

          “Ketamine can trigger a cascade of biochemical, structural and functional changes in the brain. It’s believed that ketamine works by essentially making the brain more malleable and receptive to therapy or alternate ways of thinking.” (Rachel Zimmerman, WaPo). Administering ketamine would be useful for an abusive control freak like Ablow.

        • emptywheel says:

          It would also be useful for getting the children of a politician to say things that might benefit their opponent.

        • Ravenous hoarde says:

          With the juxtaposition of the abused women, the svengali angle is what I was thinking but I don’t have the expertise to speculate.

          But what you’re saying sounds perfectly reasonable to me.

          “ One enduring mystery about the “Hunter Biden” “laptop” affair is why the son of a top Democrat ended up doing Ketamine therapy with a Fox personality just weeks short of allegations that the shrink had sexually harassed patients, an accusation that would lead to his suspension.”

          He really does seem to have a lot of interactions with “opposition” adjacent people. Is that a product of small pool of rich kids or were some purposely gravitating to him?

          I tried to explain why I don’t care about the HB laptop to someone. By the time I reached Ablow, their eyes were glazed over and looking at me funny. Part of the frustrating thing about this stupid laptop is how convoluted it is but salacious at the same time. Even if ultimately inconsequential to voters imo.

        • Rugger_9 says:

          Perhaps some of the attraction is that ketamine was a ‘next big thing’ like pet rocks, cryptocurrency or horse paste before the bad news came out (for the last two anyway). Hunter would be attracted by the novelty and the price. If it’s expensive it has to be good, amirite?

          How many ketamine practitioners were around then?

        • Ravenclaw says:

          Since it was not yet an FDA approved treatment for depression, not very many. And most, I think, were operating out of medical schools – running clinical trials. It would be interesting to check on Dr. Ablow’s training/experience with the protocols in place at those trials – whether he was an “insider” so to speak as opposed to a daring “wild west” practitioner.

      • David_AutoMod_13JUL2023 says:

        Why would a patient leave a laptop with a psychiatrist? That part never made any sense.

        [MOVING TO PERMA-AUTOMODERATION. You changed your name in your 06JUL2023 comment from “David” to “David in NYC” which complies with the site’s standard. Future comments will remain in auto-moderation until you return to a site compliant username. Refer to your comment dd. 11JUL2023 2042h for previous warning. /~Rayne]

    • Christene says:

      Oh this is definitely in MA. I lived on Plum Island. My house was down the street from Keith. His son was in my daughter’s preschool class, and our daughters went to the same dance studio. So strange that he is connected to Hunter!

    • zscoreUSA says:

      Interesting info about the ketamine market and MA Beach hospitality.

      Seems safe to say Hunter’s behavior did not improve at the end of 2018. Seems like early May 2019 when he met his now wife in LA is when he turned things around.

  3. engprof733 says:

    > He does it, in laymen’s terms, to prove that there was someone at the keyboard of the laptop, deleting individual files by hand, which he claims (falsely) is proof that

    I’m not a hard drive recovery expert but I am also no ludite…ignoring the fact that the evidence he asserts does not prove the claim he asserts, I don’t think this that is even provable. Again, may be wrong, but I am doubtful that macbooks log keystrokes with that level of fidelity, if they log them over the long term at all.

  4. Jeff Stewart says:

    Suggestion: The first-draft email sounds as though it was voice-to-text. The iOS suggests iPhone text edit or drafting.

  5. harpie says:

    That Update!

    Update: Here’s a picture of Ablow speaking at a Trump rally
    in MA on March 4, 2017. [3/4/17]

    • harpie says:

      That actually links to a VIDEO of Ablow’s speech…he’s talking about having Hillary Clinton, Barack Obama and Elizbeth Warren in for sessions at his office.
      Someone in the crowd is waving a Three Percenter flag.

  6. DaveVnAz says:

    Sounds like we now have another conspiracy angle: Dr. Keith Ablow was a honeypot used to entrap Hunter.

    I can not understand how legal and medical details of a personal laptop, discarded or not, can be legally disseminated to others than the authorities. I’m hopeful Hunter’s lawyer will be looking into this.

  7. confucious_way says:

    Howdy, delurking here (been reading wheeler since the firedoglake days); I think I’ve never posted on before.

    I’m fully dubious about this claim:

    > he examines what he could find in the unallocated space of the laptop — the place where deleted files go on computers until they eventually get written over.

    My reasons being that solid state drives (SSDs), at least apple SDDs in apple laptops, don’t work that way. The above quote seems to reference the days of spinny electromechanical hard drives (HDs) consisting of plates coated in purified rust. On the HDs it is true that when you delete a file, your data is still physically there on the HD and may be retrieved using appropriate operating system-bypassing utilities. But with SSDs that support the TRIM command (which is almost all of them since at least 2015), what happens instead is that when “freeing” a block the SSD wipes it with a hardware erase command that zeros the whole block in one step, then adds it to the list of free blocks. The reason for this is write performance: for SSDs it is significantly quicker to write data to clean erased blocks than ones where it has to overwrite old data. For the case where only part of a block is erased (eg. a small file is deleted), the SSD reads the old block into cache, zeros out in cache the deleted file, does a hardware erase on the block, the flushes the cache back to the SSD. So for the small file delete scenario, the file’s data still gets wiped from the SSD.

    Now, one *could* stick an old mechanical hard drive in a newer apple laptop–the form factors match up, in at least all the ones I’ve dealt with. But why would anyone do that? FWIW, the TRIM SSD feature is enabled by default in apple hardware if you’re using an apple OEM SSD. Otherwise you have to enable it manually using a sudo command. I don’t have a 2017(?) macbook pro to check, but I looked at a 2015 MBP with an apple SSD, and yes, the TRIM feature is enabled. Hunter Biden does not strike me as the sort of person who would go buying a bigger aftermarket SSD to swap into a laptop that was getting full–he’d just buy a new laptop.

    Perhaps Dimitrelos is referring to emails marked for deletion, but not yet purged from the email client?

    • Rayne says:

      That’s a super helpful technical explainer, thanks very much. Welcome to emptywheel’s commentariat community.

        • Rayne says:

          Since I can’t read tweets in that dying bird site and ErrataRob hasn’t posted to his blog, I have no idea.

          What confucious_way says makes sense to me as an Android user because SSD technology works in about the same way in Android. There’s only one other concern wrt SSD drives and that’s the limited number of times to which it can be written, but I don’t know that this is a factor here in any way.

        • Rayne says:

          Thanks for sharing who is the weakest security link here, though. ~eye roll~

          p.s. don’t ever tell me I’m cramming my opinion about a particular social media platform down anybody’s throat.

        • bmaz says:

          Lol, you are the only one here not still on Twitter. So saying I am the weakest link is pretty rich. Hope you enjoy the article!

        • Rayne says:

          You just shared the likelihood you’re using a burner account, which means there’s likely more data available to Twitter and whomever relies on Twitter for data collection.

          Oh, and thanks for the link to yet another techbro who can’t spell Cellebrite.

          Signed, Not-The-Weakest-Link

        • confucious_way says:

          The only thing in my post that is inconsistent with that rob graham post is my claim that would be feasible (but weird) to install an old HD in a 2017 MBP. As I indicated, I do not have access to a 2017 MBP, so did not know about that unusual one-off drive connector.

          His post does also raise problems with doing a legit forensic investigation: normally one would remove the drive from the subject computer, and stick it in an external drive enclosure that has a physical read-only switch enabled, plug the external drive into a running booted computer, and image away (mount it read-only just for safety redundancy). But I’m not gonna find any off-the-shelf external drive enclosures compatible with a 2017 MBP drive, so it makes sense to buy a second 2017 MBP and use that as the enclosure, as it were. If I were feeling diligent I would actually buy *two* extra MBPs (or at least two 2017 drives), so I could do a full rehearsal run of being able to boot the MBP from an external drive without modifying any files on the internal drive. You get only one shot to get it right before your forensic investigation is unclean.

        • bmaz says:

          Well, that is kind of the one that stuck out to me, so yes. I do not6 pretend to be overly educated about computer structure and software, but I can identify things that stick out. That did, and seems important.

        • Rayne says:

          Thanks. I wasn’t aware Nitter was back up after Elmo rate limited and crashed Twitter over the last two weeks. Won’t use the app but the browser option instead.

      • confucious_way says:

        That is plausible. Apple in its inimitable way does *not* enable TRIM by default when you install a non-apple SSD in your laptop. You have to do it yourself. But of course, it couldn’t be Hunter Biden deleting files from the copy drive, right?

        • emptywheel says:

          Sorry: To clarify: What if this was all saved onto an external drive after “Hunter’ received his iCloud content on January 25, and deleted from there?

          There was an access via the web after that, and I think at that point someone could have downloaded onto a Linux drive or something.

        • engprof733 says:

          > Sorry: To clarify: What if this was all saved onto an external drive after “Hunter’ received his iCloud content on January 25, and deleted from there?

          not the original poster, but I think I can potentially clarify this. The operative component of the hard drive explanation above is about the physical operating principle of the hard drive on which data is stored (i.e., whether or not it is a spinning disk drive or solid state drive). To the claims that Dimitrelos is making, it is irrelevant whether that drive is installed inside or outside of the computer. If it is a solid state drive – the type of analysis he claims to be applying is likely not possible to perform. Because they store memory using a different technology. For an analogy – he’s claiming he used a hammer to install a screw.

          I don’t know if samsung still makes mechanical (spinning disk) hard drives or not…I don’t know my apple laptops well enough to know when/if they stopped selling them with with high confidence but my memory and a quick google seems to suggest it was prior to 2017.

          additionally, if anythign (icloud contents or just files) had been transferred to a new hard drive, none of the information that Dimitrelos is saying he analyzed would have been included – I can say that confidently. He is saying he analyzed information that was on the hard drive, but that the computer didn’t ‘see’ as information. If a comment was given to the computer to ‘transfer all your information to a new computer’ it wouldn’t have sent anything from the unallocated space with it – because it thinks its blank.

          as always, thanks for all the hard work. similarly long time lurker finally delurked because this finally hits on something I can sort of digest and comment on technically rather than just absorbing the firehose of details you lay out for us :)

        • Shadowalker says:

          It depends on how MacOS uses the trim command. SSD memory is organized in pages (each contain memory cells), these pages are contained in blocks. The drive cannot just write to a used page which has to be deleted first (zeroed out), but it can only erase at the block level, so if it needs to write to only a single page in a block, the drive has to copy all the other pages in that block before it can delete. This is called Write Amplification. This is where the trim command comes in, the OS issues a trim command for any block(s) no longer needed so the drive can do all the necessary work ahead of time. Another factor is the drives write to all the cells first before recycling, this way they spread the write cycles out. It could be the slack space is that which the OS has marked not needed but the drive itself hasn’t reached the point where it needs to trim.

        • confucious_way says:

          Like I said, if the external drive is of non-apple make and the laptop user doesn’t know to turn on TRIM (likely doesn’t), then the SSD could have deleted file fragments lying round. I haven’t tried exploring an SSD directly myself, but I read that it is harder than with an HD, because the SSD has no obligation to keep related blocks in adjacent locations, and indeed has an imperative to do the opposite: to distribute related blocks all over the place in order to evenly “wear down” the blocks, which have a finite number of write cycles before they fail. So, even the operating system doesn’t have visibility into which actual blocks its files were written into. The SSD virtualizes that away. Perhaps there are tools that make navigating this fairly seamless for an experienced user. I just don’t know. I do have my hackles raised when I see a description of exploring an apple SSD’s “deleted but not really” files, as if this were a hard drive from the 1960s-2010s.

        • Shadowalker says:

          The SSD doesn’t need to distribute in sequential blocks because all blocks are equally accessible for the whole disc, unlike the older HDD magneto drives which required the read/write head(s) to physically reach the area on the platter in order to perform a read/write operation. Which is why optimization of these drives could produce speed improvements since the heads didn’t need to travel as long especially when the data was spread all over the platter before optimization.

      • Ken Muldrew says:

        “In great mathematics there is a very high degree of unexpectedness, combined with inevitability and economy.”
        G.H. Hardy.

    • emptywheel says:

      And welcome. You’re our second since-the-FDL-days lurker speaking up. It really makes me happy to hear that.

      • confucious_way says:

        Alas, I don’t remember what username I chose back then. If I engaged with you it was likely on trying to puzzle out some minor detail of a current event.

    • Rugger_9 says:

      Glad to have you in circulation here. Now, if the process is to clear / defragment the blocks as you’ve described here, how does that affect the process if there is no fragments left to be picked up? Does that point to someone adding in their own 2 cents?

      • confucious_way says:

        The process is not to clear/defragment, indeed the SSD by design does the opposite of defragmentation, instead scattering files across any blocks without regard for their physical adjacency, deliberately preferring to maximize use of whatever blocks have the least cumulative wear on them. Obviously, if the file fits on just one block, you use only one block.

        The “clear” step for a block marked as available for reuse is a vital performance optimization, since otherwises that “clear” step would have to be done when the block is next written to.

    • bradford says:

      This is a good explanation of what goes on at the drive itself; I think however that the “trim” instruction, with the list of unused blocks, may not get sent from the filesystem layer to the drive all that often. The actual block erase takes a long time to accomplish, and so these tend to get queued so as not to slow everything else down. “man fstrim” in a recent-ish Ubuntu suggests doing it weekly. I’m not familiar with how MacOS does it, but everything is constrained by the block erase taking a long time; the filesystem can’t afford to do that before or after every write.

      So it’s possible that old versions of data might still be accessible for some time (days) after deleting from the file system, even with TRIM enabled.

      (I’m not at all a frequent poster, but may have posted under this handle with a v***.com email address in the past, and perhaps with a three-letter handle, which I won’t use anymore)

      [Welcome back to emptywheel. Very sorry about this request for additional effort, but please use a more differentiated username when you comment next as we have several community members named “Bradford.” BTW, I can see a comment back in 2012 (!?) with a 3-letter name but same domain on email which isn’t v***.com. Thanks. /~Rayne]

      • confucious_way says:

        > So it’s possible that old versions of data might still be accessible for some time (days) after deleting from the file system, even with TRIM enabled.

        How do you go from millisecond level operations to days? Millisecond delays on write time are unacceptable. On delete time, who cares? Tell the user the file is deleted, park the block in a queue that’s gonna be processed for wipe before the next time the user blinks, and declare success. Any sidechannel attack going after deleted blocks in the millisecond queue, you’d be asking, if you knew you were interested in that to-be-deleted file, why didn’t you read it straight-up a few seconds earlier?

    • RipNoLonger says:

      Do the i-thingees have the same concept as other OS’s which is a Trash or Recycle Bin which holds “deleted” items until it is cleared? Perhaps this is what is being referenced. When techies start to talk about looking at “unallocated” space they might mean a whole lot of things that don’t disappear completely.

    • Spooky Mulder says:

      Thanks for the insight on how SSDs are overwritten. I didn’t know that!

      Using the serial # from Marcy’s earlier HB laptop post I looked it up on everymacdotcom (a site I’ve used for years and is very reliable). It comes up as a 13-Inch “Mid-2017” MacBook Pro (without Touch Bar). The site explains that despite the advertised Apple Specs saying that the storage isn’t upgradeable, this model turned out to be unlike later models that had the dreaded Touch Bar. So, swapping out for a larger SSD was possible and likely very simple to do.
      From your comment…**Now, one *could* stick an old mechanical hard drive in a newer apple laptop–the form factors match up, in at least all the ones I’ve dealt with. But why would anyone do that?**

      Why is a good question. It would be weird and dumb to do that. But I’m researching whether it is even possible to swap a mechanical drive into this MacBook. You may be correct. If I find otherwise, I’ll update this.

    • timbozone says:

      Uh, modern SSDs with MacOS use “snapshots” to record “images” of the data files periodically. This data is retained on the SSD in the file structures and can help retrieve “deleted” files entirely if the snapshots are not actively being erased. One way snapshots may be erased is if scheduled backups to TimeMachine or iCloud storage happens. This technology was implemented in OS X 10.13, back in 2017. Any SSD in a 10.13 or later system would have these snapshot images on the SSD, although you would need to know how to access that data to retrieve info from it. These snapshot images are immune to TRIM afaik, although early implementations in 10.13 and 10.14 were definitely buggy.

  8. confucious_way says:

    One other major (to me) inconsistency:

    > the place where deleted files go on computers until they eventually get written over. He does it, in laymen’s terms, to prove that there was someone at the keyboard of the laptop, deleting individual files by hand

    If this is referring to someone deleting files by using the “rm” command* typed in (keyboard) from the command line, it may be referring to the fact that by default, your command line shells on OSX are configured to keep a rolling history of the last 1000 commands you typed in. Super-useful feature that among other things lets you pull up and re-execute recent commands by just hitting up-arrow a few times. But it also means that you may be inadvertently maintaining a history of the last several months (or years) of what you’ve been doing on the command line. But it sounds a lot more impressive to talk about using techno wizardry to examine undeleted files directly from the bare metal, than it is to say, “oh, I just typed in “cat ~/.zsh_history and there it was”.

    *do not use “rm” from the command line unless you really, really know what you’re doing. The delete is immediate and permanent. There is no intermediate “move to trash”, then “purge trash” step. But again, inconsistency: the rm is a *more* powerful deletion mechanism than pushing around a mouse to move stuff from Finder to Trash.

      • Dave_McC says:

        Don’t even write that line!! Not funny. OK. You actually left a prefix command out, but still.

      • confucious_way says:

        That makes a lot more sense. Also, many applications keep a hidden N-1 copy of whatever you were working on in that application, in case you totally screw up and need to revert to something that’s older but still useable. So you think you’ve deleted your work, but the N-1 copy is still lurking. That’s something one would look for automatically when “investigating” a laptop.

        As I mentioned previously, assuming a local email client as opposed to webmail, emails marked for deletion but not yet purged would still be there, along with their attachments. The default apple email client behaves this way, even when you hook it up to a webmail system like gmail. Or, if the local email client is really sloppily written, even deleted and “purged” emails might still be there: shown to the user as deleted and purged, but still there in the email client’s storage filesystem in space flagged as available for reuse.

        • CJCJCJCJ says:

          > Also, many applications keep a hidden N-1 copy of whatever you were working on in that application, in case you totally screw up and need to revert to something that’s older but still useable. So you think you’ve deleted your work, but the N-1 copy is still lurking.

          There are also now on-laptop Time Machine backups, kept for a week or two if the laptop hasn’t backed up to a Time Capsule or equivalent. I don’t remember how many years ago that rolled out, though, but it’s relatively new for Mac OS.

    • Buzzkill Stickinthemud says:

      From a shell command line, I’ve done the extremely stupid when deleting files. Say from a directory with a large number of files I wanted to delete every file with “stupid” in the file name. What I should’ve typed is

      $ rm *stupid*

      but instead I fat fingered it and typed in

      $ rm * stupid*

      which means delete EVERYTHING and then delete all files starting with “stupid”. If you learn from mistakes, you don’t do that ever again.

      • P J Evans says:

        On a PC, that’s like del *.*, and yeah, only once, unless you really really need to do it.

  9. Jenny T says:

    Wow – sometimes I think some of these Hunter posts are just spit balling and sometimes (like this one) seem genius.

    Thanks for always reminding us of the value of wading through all known data and setting up timelines

    • emptywheel says:

      Honestly, they’re all intertwined. If I’m right that his digital life was unwound in January 2019, then it depended on him being cut off, which this post helps to show he was, so he wouldn’t see that.

      It doesn’t help that I’m working secondhand throughout, and I haven’t put together pictures.

      Hopefully I’ll pull it all together though.

        • earlofhuntingdon says:

          Your analyses must be getting close to sensitive spots. I suspect you’re also a popular target for rightists to aim at. But the quibble is not exactly a criticism of the, “When you strike at a queen, you must kill her,” variety.

        • emptywheel says:

          Oh, Rob and I are chummy. I have no problem with his criticism. Eventually I’ll convince him and in doing so the effort will have been more than worth it.

  10. Savage Librarian says:

    Like your post yesterday (about Andrew DeFilippis,)John Kerry also merits another mention in Keith Ablow’s story. That’s because in 2010, Roger Stone “asked him to consider running for Kerry’s senate seat in 2014.”

    Also, Stone wrote the forward to a PR type book for Trump that Ablow and Christian Josi published in the summer of 2020.

    • Ravenclaw says:

      Ablow had strong educational credentials (Brown, Johns Hopkins medical, Tufts residency), moved in elite circles, was a bit of a celebrity as doctors go (author of popularized books, television pundit), and most important, was an early adopter of ketamine treatment. Oh, and also a good salesman/self-promoter. Hunter was a riches-to-rags depressed druggie flailing around for help & who heard about the hot new therapy. We’re talking a moth who needed a star to be guided by and found a citronella candle.

      • Rayne says:

        But there’s also the VPOTUS/POTUS candidate’s son who had a childhood brain injury which may also have marked him a likely target well before Beau’s cancer.

      • earlofhuntingdon says:

        The scientifically underwhelming Florida Surgeon General and chief public health officer has an MD and PhD from Harvard, taught medicine at NYU, and had tenure at UCLA before going to Florida. Not that one would know that from anything Joe Ladapo has done in Florida.

  11. OnKilter says:

    Aren’t the multiple and various discussions of the Hunter Biden laptop(s) saga an utter waste of time?

    If not, why not?

    • Rayne says:

      If your point with this question is to police the number of posts published here related to a topic, you can take a seat in the shade and chill out.

      This site doesn’t have to justify itself to you. It’s obvious to most of the commenters here why this subject merits multiple threads just as so many other subjects at this site have deserved multiple threads, some as many as the hundreds.

      Let’s spell this out as simply as possible, though, because thicc as the kids say: POTUS’s son may have been targeted as part of foreign and domestic influence operations to affect the outcome of the 2020 election, and possibly the 2024 election.

      I’ll also note you haven’t piped up in your 22 comments to date to complain about the multiple and various discussions about the foreign influence operations to affect the outcome of the 2016 election, or the multiple and various discussions about the other influence operations, foreign and domestic, to shape the outcome of the 2024 election.

      • OnKilter says:

        OK, now I get it!

        Thanks for telling me “POTUS’s son may have been targeted as part of foreign and domestic influence operations to affect the outcome of the 2020 election, and possibly the 2024 election.”

        Russians and Republicans ginning up some scandal around Hunter Biden to try to get at Joe Biden! How completely novel!

        No, but seriously Rayne, the laptop(s) have no value at all due to their compromised condition. A melange of possibly accurate, possibly manipulated and possibly completely false data on computers that have been around the block a few too many times, in Rudy Giuliani’s hands, in some computer shop for months, and who knows where else.

        What’s the point of the brilliant and elite legal minds that inhabit the EmptyWheel universe discussing at length a couple of compromised laptops of no actual value other than as conspiracy theory props?

        • bmaz says:

          I’m sorry, again, do NOT, EVER, deign yourself a voice to troll and try to control our content. The next time may be your last time. I don’t know. Seriously, who the fuck are you to do that?

        • Rayne says:

          Oh honey, no. Not here. You’re out of your league if you don’t understand what’s going on with no tolerance for minutiae. You would think by now you would have twigged that a site with the weediest research some of which is outlined in the Timeline Collection‘s tens of thousands of entries is going to go deep into the weeds about the ways in which an influence operation worked.

          Seriously, sit on your hands or hit the Back button and exit. We’re not forcing you to read this stuff or holding you hostage.

          If you need help leaving, just say the word.

        • earlofhuntingdon says:

          Your troll-like behavior suggests you don’t get much of anything at all. “Don’t discuss it because I think it’s nonsense,” sounds like something one would find in the same basket as sending out voting notices with the wrong date. Life’s not that simple or obvious.

    • bmaz says:

      Yeah, people used to try carping that bunk as to sports, music and cooking posts. If you don’t like our content, move along, we write what we want to write.

        • Rayne says:

          There are about two dozen different recipes for a Whiskey Tango Foxtrot, not all of which call for bourbon.

          But let me try to make my own version with some Weller:

          – 2 ounces Weller bourbon
          – ice in a rocks glass

          Pour the bourbon over the ice. Whisper, “What The Fuck” before sipping.

        • bmaz says:

          Yeah, that works for me too. After another day of home reconstruction, that will likely be necessary.

        • earlofhuntingdon says:

          Yea, good luck with that reconstruction. Have you read Eric Foner? I prefer Pretty Good House and The Well-Built House.

        • tmooretxk says:

          Double the portion and queeze a quarter lemon over it and it becomes “The Cure” in conjunction with a barely bearable hot bath.

        • Rayne says:

          The Cure might be better suited to a well bourbon or one’s day-to-day favorite.

          I think I’d feel worse if I put a quarter lemon over my Weller Antique.

          Wonder, though, if a cure could be had with an aged tequila and a quarter lemon while ensconced in a barely tolerable tub? *adds to my To-Do List*

  12. zscoreUSA says:

    typo/error (I think. I am pretty confident its an error, but this whole thing is a mess with Apple ID’s and emails and time zones going every which way, I don’t want to say I’m 100% I might be wrong)

    Right after the Ablow minutes billed starting 11/10/18, you write that Hunter began using the Macbook on 11/21/18. This should be 10/21/18 (from a Pacific Time Zone timestamp, indicating, Hunter or whoever purchased would be on the west coast) based on your article a couple days ago, and also consistent with the Apple coverage website indicating the laptop was purchased in October 2018.
    Serial Number of the Mac Isaac laptop: FVFXC2MMHV29

    This article is amazing coverage. I have been looking into the Ablow timeline as well. I haven’t had an opportunity yet to look at all of my notes in a linear timeline yet.

    Off the top of my head, here are a couple other details that seemed interesting, that people following the Ablow laptop might be interested in.

    * as you pointed out there was Bartholomew emailing Hunter about that temp employee which was weird, like Hunter is now an employee. There was also a text by Bartholomew to Hunter chastising him for missing an appt w Ablow, on 1/14 or thereabouts, followed by asking him to come over for dinner. And in “Laptop From Hell” book, there were texts on 2/6/19 btw Ablow & Hunter indicating they plan to record a podcast together.

    * Brad Birkenfeld wrote a book called Lucifer’s Banker Uncensored, published on 9/30/20. He says Ablow reached out through a friend and told about laptop Oct 2019. In this edition of the book, on the last 2 pages, there is info on Hunter/Ablow, like he wrote it in an hour before he gave it to the publisher (he gets the DEA raid date wrong, says its 2/14/20 Valentine’s Day). There is a picture (Credited to Ablow friend Walt Pavlo) of Hunter with an NYPD hat smoking a cigarette w Ablow in front of the Ablow Cottage. On the Marco Polo website, there is a photo, of Ablow and Hunter in same dress, location (but a different photo, most likely taken by Bartholomew) dated 1/13/19.

    * Birkenfeld was interviewed on the Opperman Report 12/6/20 [available on Patreon]
    In the interview he describes being notified by a friend of Ablow about the Hunter Biden laptop in Oct 2019. He claims that when he spoke to Ablow, he wanted $2M for the laptop. Birkenfeld later goes to Sen Grassley about the laptop on 2/11/20. Then the 2/13/20 Ablow raid by DEA. [Giuliani associate Kerik just happened to be pardoned on 2/18/20] Birkenfeld also went to Sen Johnson around the time of his book launches in DC, 10/22/20 & 10/29/20

    * Daily Beast covered some of this, Kerik, Giuliani, Dietl, Pavlo, Kiriakau (who has since said the price of a pardon for Trump was $2M) all show up at a 10/22/20 book launch by Birkenfeld (who now works with Ziegler/Marco Polo), where Hunter and Ablow are discussed

    * Ablow writes “Trump Your Life” published 6/2/20, with a forward by Roger Stone. [it should be noted that Roy Cohn, a mentor/associate of Roger Stone gave quotes about people in tabloids in exchange for favors of value]

    There is plenty more here, to raise an eyebrow at regarding the Ablow/Hunter situation. Great article.

    • emptywheel says:

      Thanks so much. I had fixed the timing error–outright error, you are correct.

      I guess I do need to go read Birkenfeld’s book. I don’t understand why he joined in with these creeps.

      The NYPD thing is interesting bc one of the only other things Hunter was sending in that time period was a picture from some woman at NYPD which I haven’t accessed yet.

      • zscoreUSA says:

        That nypd email from the droidhunter88 account.. really bizarre, i havent seen the image yet either. If someone else was accessing the account, maybe they were sending an image that had a kid, to get an Anthony Weiner type search warrant.

        If you listen to Birkenfeld interview on Opperman, it’s clear that he is an Uber Trumper. Obama/Hillary/Biden are in the control of the Cabal and keep their Swiss bank accounts hidden for the cabal donor masters. And of course he spent time in jail when he blew the whistle on the Swiss bank accounts, even though he was later rewarded by IRS $100M for recovering tax money. So he blames them for him being jailed. He now lives in Malta. His 2 DC book launch events were at the Capitol Hill Club, which is by the RNC headquarters (where the pipe bombs were located later on Jan 6, as opposed to inside the actual RNC).

        He really talks up that Hunter was with Ablow for 3 months, and in the Summer of 2018. But 100% false on the date. So either Ablow lied to him, or he is part of a cover story.

        I am curious his current roll w Ziegler/Marco Polo and will look at that when I get a chance.

        • Shadowalker says:

          “ maybe they were sending an image that had a kid, to get an Anthony Weiner type search warrant.”

          I think that’s why all the noise with the dickpics. I also read a report that the agent sent to take custody of the drive (the copy, not the laptop which was subpoenaed later) was an agent out of the Newark, New Jersey field office who was the childporn specialist. Rudy was also claiming there were images of underage girls in various states of undress on the drive. By that time, no one was paying attention to anything he said.

        • emptywheel says:

          To be clear, I’m not sure when Hunter first reached out to Ablow. If that invoice really does mark the FIRST they met — in November 2018 — then deleting that might align with Birkenfeld’s story that it was earlier.

          Earlier, I would expect the Russian escort service to have done the compromise, but that’s just bc it’s so obvious.

          Re: Birkenfeld, one thing that’s infuriating is that Grassley was a great advocate for whistleblowers when Birkenfeld (and others) were legit whistleblowers. So those people all have missed what a crank he has become and still think he’s a good faith actor.

        • zscoreUSA says:

          Re: Grassley/Johnson
          According to Mac Isaac in American Injustice, when he submits a whistleblower complaint on their Senate website, they give his number to John Solomon immediately. And when they finally call him to discuss the Hunter laptop, they pass the phone to NSA agents.

          So it is possible to me that after Birkenfeld contacted them, they contacted DOj, which oversees DEA. Ablow was already suspected of being inappropriate with clients and abusing prescription process by that time. It could also just be a coincidence.

          Glancing through the timeline, it looks Hunter first met w Ablow 11/10, while staying in general area in MA, not necessarily at The Cottage. At some point a few days later he writes “blue water wellness” in the memo of a check to an escort. He stays at a rental on Plum Island, whose account manager also books The Cottage, where he is booked 12/16 to 12/23, but not clear to me yet if he was actually there or not, and went back to DE by 12 /20.

        • emptywheel says:

          Note, he was in DC, not DE, I think. But of acute interest to me is the collision report sent him on ~2/6/19, the same day his phone and iPad are getting backed up to iTunes, the password for which has recently been changed. The collision was in DC, right on K Street. But in that same period Hunter was texting his assistant about getting his ski boots sent to someplace in MA.

        • zscoreUSA says:

          Collision report? interesting havent seen this yet.

          2/6/19 1:46am located at Fairview Inn in Delaware, which was a frequent location; and sometime during the same day has atm charges in Wilmington
          [source: Marco Polo Report]

          DC and DE pretty close though

          Last evidence I have seen that he was physically located at Ablow’s was at 2/3/19 1am

  13. zscoreUSA says:


    One more tidbit, is that in Mac Isaac’s book American Injustice, he describes the laptop as 2016, with a soldered in hard drive.

    But when you search the serial number (FVFXC2MMHV29), it shows as a 2017 MacBook Pro, model A1708, which does not have an Apple Touch Bar and has a removable hard drive

    What do you make of that?

    And, another question, the external hard drive that Hunter allegedly brought to Mac Isaac on 4/16/19, had a 3 year warranty which expired on 5/2/22. Does that mean that Hunter, or someone else, completed the warranty registration on 5/2/19? (While in custody of Mac Isaac)
    Serial number of hard drive subpoenaed from Mac Isaac: WX21A19ATFF3

    Outside of my technical abilities, hopefully a tech person knows what to make of this. Thanks anyways.

    • Shadowalker says:

      May not mean anything

      Re: Touch Bar

      “ 9/1/18: Your Apple ID (rhb@rspdc com) was used to sign in to iCloud via a web browser.
      Date and Time: September 1, 2018, 10:42 AM PDT

      9/2/18: Your Apple ID, rhb@rspdc com, was just used to download Hide2Vault from the Mac App Store on a computer or device that has not previously been used.

      9/2/18: Welcome to your new MacBook Pro with Touch Bar.”

      What notebook is Apple talking about here? It doesn’t appear to be the same one the FBI did the forensic disc image of because that had a connector, more importantly, no Touch Bar.

      • zscoreUSA says:

        It doesn’t appear to be the same one that Mac Isaac had. Perhaps it’s the laptop that will eventually be left at Ablow’s in February 2019. Or maybe the laptop he had as of May 2019 that his new wife made him stop using.

        • Shadowalker says:

          Pure speculation on my part, but that could be Hunter setting up a new MacBook Pro and he uses Hide2Vault to quickly install critical files and data instead of having Apple take 5 days to create a downloadable disc image with everything in place.

          “ 1/25/19: The data you requested on January 20, 2019 at 5:40:26 PM EST is ready to download. [Sent to both Droidhunter88 and rhbdc@icloud com]”

      • emptywheel says:

        Based on the serial number of the laptop, it has to be the November 21 one, not the September 2 one.

        One hypothesis I have right now is that someone started the November 21 one in advance, planning to swap it with Hunter Biden’s touch bar one during an Ablow session (with or without his awareness).

        For several reasons the one the DEA found with Ablow is likely the touch bar one.

        Perhaps there’s a third, earlier one, that Hunter ended up with in 2019, and so didn’t notice he had been pwned.

        • zscoreUSA says:

          I know you corrected the date as 10/21/18 and not 11/21/18.

          A question I have is, Hunter has left LA and back in DE as of 10/21. [He buys a gun on 10/13 in DE and Hallie throws the gun in a trash on 10/23].

          Why is the 10/21 notification about the new usage of iCloud on new MacBook Pro with a Pacific Zone Timestamp? Did he click on that time zone when logging in the first time to the laptop because thats where his heart is? Is Mac headquarters CA and that’s the default timezone for the notification? Was he actually in LA on 10/21 which would have been a short trip?

          Hunter definitely had another laptop. While the one laptop is with Ablow, he has another laptop in May 2019 in LA which his new wife makes him not use. So either he already had that one when he got pwned, or being a crack addict, just decided to buy a new one and not worry about where the old one was.

        • Shadowalker says:

          Devices with location services enabled use the time zone where the device is located. It looks like when a browser is used to make changes to the account, the time zone of the server is used.

        • emptywheel says:

          That’s one thing I need to do. I have to believe his iCloud password, at least for the iCloud account, was thoroughly pwned by August at the latest. So from that point forward, anyone could be starting new devices on the account, especially if they can be sure Hunter doesn’t get notice of it.

        • zscoreUSA says:

          Based on text messages sent the following day, Hunter had a laptop stolen the previous night August 4, 2018, while in Las Vegas
          [Marco Polo Report p 628]

          on 12/26/18, Hunter texts an escort accusing her of looking through his phone, laptop, and computer. I’m not sure where/when that intrusion would have occurred

        • Shadowalker says:

          Hunter does seem to go through a lot of computers and devices.

          Three laptops were brought in to Isaacs shop, one was beyond repair, second was replacement of keyboard and repaired (both returned that day), the third (with the payload) was data recovery. It’s a very good possibility that Isaacs was being used as a patsy and he really believed that it was Hunter who came into his shop. And when he saw all these copies out in the wild with stuff added he never saw, he distanced himself from it, and instead of just talking to the FBI, claimed agents threatened him.

        • zscoreUSA says:

          That’s assuming it was indeed Hunter who walked into Mac Isaac’s shop.

          It is interesting that Giuliani’s associate Bo Dietl stated Giuliani drove w Kerik down to the Mac Shop and collected 3 of Hunter’s laptops.

          “On September 25, 2020, Wang Dinggang—who at the time was a Guo ally with a YouTube channel called Lude Media that was featured on GTV—announced, falsely, that Chinese sources had sent US officials “three hard disks” of material related to Hunter Biden.”

        • Shadowalker says:

          I’m 99.99% sure that Hunter has ever been in that shop. I’m not 100% sure because Hunter has stated he can’t say definitively he wasn’t.

          It was obvious at the outset that this was a smear campaign aimed at Hunter’s father. So far nothing I’ve seen off the “laptop” is even remotely illegal, and barely politically damaging if mainstream media picked it up. Which is why I think the plan was for the FBI either announce an investigation or at the least leak some of the investigation. Which would have been a bigger deal politically. When that failed, they went with plan B that they cooked up in the last month before the election.

  14. RawBob says:

    I knew Keith Ablow in college.

    Once a creep, always a creep.

    [Welcome to emptywheel. Please choose and use a unique username with a minimum of 8 letters. We are moving to a new minimum standard to support community security. Thanks. /~Rayne]

    • Rayne says:

      Perhaps you didn’t notice but this is not Twitter; these comment threads are not for merely drive-by shit posting.

      Bring something factual which can be validated instead of trolling.

  15. zscoreUSA says:

    A few observations after looking through the timeline;

    * some of the spy apps/devices, 10/29 or 11/21, are plausibly Hunter purchasing to control Hallie

    * Ablow messaging Hunter his emailed is screwed up, doesn’t look that nefarious. Hunter’s emails are received by Ablow and 1st Dr, Hunter receives Ablow’s emails, but Hunter doesn’t receive emails from the doctor (the ones labeled external) from his hss. edu email, nor Hunter from, the other doctor at hss. edu account. Hunter emailed the 2nd doctor on Hunter’s behalf after the 1st doctor rec. Ablow then contacts the 2nd doctor realizing the email issue, but Hunter still receives Ablow’s emails. Comes across as a normal email issue and Ablow stepping in to help a friend, no reason to suspect account hijacking here, imho.

    Notable though, in the middle of these emails, Ablow sends formal invitation to The Cottage, and the day prior, Hunter texted Ablow, Joe is running for president, and that he will be coming to Ablow’s like Moses to the burning bush. No doubt Ablow’s appetite whetted.

    * possibly major relevant info: on 1/15/19, in the same few hour window with the “schedule?” emails and Hunter no-showing to scheduled wellness appts, Hunter’s Microsoft account has password changed from the 73.61 IP address, and Hunter texts he’s in his room at the Cottage.

    This is the same IP address as the last heartbeat, seems relevant, and seems to confirm that the last heartbeat of the Mac Isaac laptop occurred while on Ablow’s property.
    (Source for all of above: Marco Polo Report/emails)

    Question: is there a date provided for the last heartbeat by the forensic report? Or a way to determine the date of last heartbeat by looking at the data?

  16. zscoreUSA says:

    A couple more observations and typo

    * typo in the other article, with the deleted Mac
    1/17/19: n (from lcl8980 @ gmail .com)
    this should be from droidhunter88 to ulcl8980, an email that Hunter previously Zelled money to in Sept 2018
    (Marco Polo Report p 272)

    * what exactly is weird about the Hunter drafts to Brinkley, Mesires, and Ablow? Besides of course trusting Ablow in the first place. Mesires is his attorney, and Brinkley appears to be a long term friend. Hunter gets contacted by the Vanity Affair reporter, then drafts a rant response to Brinkley, then later says he obviously did not send that rant to the reporter.

    * Bartholomew is interacting with Droidhunter88 gmail because Hunter used it first to contact her. It’s named “Robinson Hunter” close enough to his real name so she knows who he’s dealing with. If you look at the Safari search history file from the Marco polo website, Hunter was on porn sites the entire morning, so possibly just emailed from the account he was actively using at that minute. And probably not interested in going to the wellness treatments scheduled. And created a Droid8892 profile on a porn site.(Marco Polo Report).

    [FYI — blank spaces added to email address to deactivate it. /~Rayne]

  17. DinnerAtAntoine’s says:

    So much to chew on here & the other posts, it’s so refreshing to read a review of the forensics. More thoughts later but from now about Ablow:
    – DC can be a remarkably small community. So many names intersect in stories like this. As a reminder HB was once friends with Tucker Carlson. That’s not a slur, the point is that in DC politics & related business people know each other. Given HB’s specific issues there are probably a limited number of treaters & maybe he just knew someone who referred Ablow. That HB fell into Ablow’s lap might’ve been shocking to Ablow, someone working for Ablow, or someone in Ablow’s circle or venned circles such as Steve Bannon.

    However IMO even more beyond coincidental is JPMI’s uncle (IIRC) being a Fox News producer? Is this correct? All of the weirdness is too much, but that if correct (NY Magazine IIRC) is too, too, too much.

Comments are closed.