July 21, 2024 / by 


In Bid to Withhold Laptop and Hard Drive Forensic Reports, Derek Hines Misstates Hunter Biden’s View on Authenticity of Data on Laptop

As I noted in this post, I wrote a letter to Judge Maryellen Noreika asking her to release several documents, the more interesting of which are the forensic reports on the laptop attributed to Hunter Biden and the hard drive with John Paul Mac Isaac’s purported copy of the laptop.

Abbe Lowell had no problem with the release of the forensic reports.

Mr. Biden has no objection to the release of either item requested by the journalist—the motion for miscellaneous relief at DE 167 and/or the expert disclosure of Michael Waski at DE 120-2.

Derek Hines did. He said that because he never filed the forensic reports, they are not judicial records before Judge Noreika.

However, his disclosure was never filed with the Court because the defendant agreed that the information derived from his laptop was authentic. Therefore, the expert disclosure was not included as an exhibit for ECF 120 because the certification itself sufficiently supported the motion. Moreover, since there was no dispute about the authenticity of the information derived from the defendant’s laptop, the government did not call Mr. Waski as an expert witness at trial. Accordingly, the expert disclosure is not a judicial record and is not a record before this Court that the Court could unseal.

There are several problems with this response.

First, as I wrote in my letter, nothing in the certification mentioned the laptop or hard drive it certified.

Mr. Waski’s certification, as docketed, does not by itself certify that the laptop was among the devices extracted. While the MIL describes that Mr. Waski’s certification pertains to, “two backup files from laptop and hard drive” (DE 120 at 3), Mr. Waski’s certification itself mentions neither. Instead, it references a “Digital Forensics Report and [an] Extraction Report,” singular. Compare Robert Gearhart’s certification at DE 120-1, which lists the four iCloud backups described in the MIL, “Apple Backup 1, Apple Backup 2, Apple Backup 3, Apple Backup 4,” which in turn match the warrant. (20-mj-165 DE 3 at 2) To confirm that Mr. Waski’s certification pertains to the laptop and hard drive incorporated into the summary and described in the warrant (19-mj-309 DE 3) requires inspecting the Disclosure.

There is no way the public — or Judge Noreika herself — can be certain that the “Digital Forensics Report and Extraction Report,” singular, mentioned in the certification describes the forensics of both (or either!) the laptop and the hard drive. We need to see the description of that report in the Disclosure itself.

The certification relies on the Disclosure to even identify what it is certifying.

More importantly, Hines blatantly misstates Hunter Biden’s view on the authenticity of the data on the laptop. In Abbe Lowell’s response to Hines’ motion to bypass any expert witness, he specifically debunked that claim.

Defense counsel has numerous reasons to believe the data had been altered and compromised before investigators obtained the electronic material from Apple Inc. and The Mac Shop, such that the Special Counsel’s claim that the underlying data is “authentic” (id. at 4) and accurately reflects “defendant’s Apple Macbook Pro and [] hard drive” (id. at 2) is mistaken.

Mr. Biden’s counsel told the Special Counsel on May 10, 2024 it agrees not to challenge the authenticity of the electronic data the Special Counsel intends to use with respect to it being what law enforcement received on December 9, 2019 from John Paul Mac Isaac (owner of The Mac Shop), and from Apple on August 29, 2019 and in a follow-up search on July 10, 2020. (Mot. at n.3.) However, Mr. Biden cannot agree this electronic data is “authentic” as to being his data as he used and stored it prior to Mac Issac obtaining it.

He pointedly did not agree that the data derived from the laptop (and hard drive, which I suspect has more irregularities) was “authentic” as to being his own data.

One reason I’m interested in the hard drive is because Hines himself revealed that the “backup” of it is 62% bigger than the laptop of which it purports to be a copy. Understanding why that is so might go a long way to explain anything John Paul Mac Isaac did with Hunter Biden’s data.

As I noted in my letter to Judge Noreika, Congressman Dan Bishop suggested in a deposition on the laptop last year that if the FBI, “has conducted a forensic investigation and has suppressed the results,” people shouldn’t defer to the FBI. This was an opportunity for the FBI to show it’s work.

It — or at least, David Weiss — doesn’t want to.

Update: Corrected misspelling of Hines’ last name. My apologies to him.

Update: Judge Noreika has now docketed my reply. Among other things, I noted that the creation date for the PDF of Waski’s certification post-dates the day when it was sent to Hunter Biden’s team on April 24.


The other certification is dated April 23.

Update: Judge Noreika has, unsurprisingly, granted the request to docket the Hallie Biden related filing, but denied the Disclosure on the laptop and hard drive.

ORAL ORDER re: D.I. [247], IT IS HEREBY ORDERED that the Sealed Motion (DI [167]) is hereby unsealed. The expert disclosure of Michael Waski is not part of the record of this case or in the Courts possession. IT IS HEREBY FURTHER ORDERED that the Court will not address further informal requests made by letter rather than appropriate motion. Ordered by Judge Maryellen Noreika on 7/18/2024. (as)


Copyright © 2024 emptywheel. All rights reserved.
Originally Posted @ https://www.emptywheel.net/tag/abbe-lowell/