The Technical Oddities of the FBI’s Exploitation of Hunter Biden’s Laptop
I wrote about the memorialization of an October 22, 2020 meeting about the Hunter Biden laptop that Gary Shapley did here.
Shapley is using it to wind up the frothy right, which as is true of all things Hunter Biden, has worked like a charm.
He has used it not only to make false claims that the FBI has validated the laptop and all its contents, but also to claim that Whistleblower X was being denied access to some of the materials on the laptop. As I noted, by his own description, Whistleblower X saw contents from the laptop, as released by Rudy Giuliani, at some point in the investigation, even though investigators had been instructed not to view publicly available materials out of taint concerns.
But the meeting wasn’t held 8 days after the Rudy laptop had been made public so Whistleblower X could air his complaints. It was held as CYA, to make sure DOJ documented the chain of custody that had just been rendered suspect by the disclosure that a source the FBI had basically trusted had turned the laptop into an election season hit job.
Authentication
The frothy right is either lying or ignorant when they claim this report authenticates the laptop and all contents. Indeed, the report makes it clear that, over a year after first learning of the laptop, the FBI still hadn’t validated every file on it.
But it did do some authentication, some of which could have been faked. That includes:
- Financial records showing Hunter Biden made a purchase in a cigar shop on the “same day” (could easily be faked, particularly since anyone with his laptop had images of his credit cards)
- “Other intelligence” showing he was in the area
- Phone records showing at least two calls “around this time” (but may not reflect later calls Mac Isaac claimed to have made)
- Device number registered to Hunter Biden’s iCloud account
- October 2020: Discussion of tracking data creation dates on laptop
Forensic Process
From the description of the memo, the hard drive was easy to access. It was imaged within days of receipt and sent to the regional forensics lab in Philadelphia. Even there, though, by March there were concerns about the quality and completeness of what got imaged from the hard drive.
For some reason, however, to access the laptop, the FBI obtained a new PowerBook and installed the hard drove from the Hunter Biden laptop in the new laptop, which “the computer guy” in the meeting said “returned [the laptop] to original.” It took three months to get this image.
Furthermore, there were problems with exporting the results. Even in October 2020, the team were joking that anyone else who wanted to access the laptop would need to buy their own laptop and review the discovery on that.
Here’s what the memo said about this:
FBI determined in order to do a full forensic review a replacement laptop had to be purchased so the hard drive could be installed, booted and imaged.
[snip]
Josh Wilson stated that (while laughing) so whoever [people wanting to review the laptop] are they are going to have to buy a laptop to put the hard drive so they can read it.
As noted, at that point in October 2020, the FBI had not checked the laptop for any alterations made while in Mac Isaac’s custody. Of particular concern given what I’ve heard about the hard drive is whether the computer access email updates during the period it was at the shop (not least because in that period, Burisma was hacked). Shapley said nothing about any validation that happened after this point.
- Replacement laptop purchased, hard drive installed, booted, imaged
- CART images external hard drive
- 12/19/19: Regional Computer Forensics Lab receives image of har drive
- 3/6/20: FBI receives image of laptop
- 3/10/20: RCFL receives laptop image
- 3/31/20: email about quality and completeness of imaged/recovered from hard drive (not shared with agents)
- No list of when files created
Legal Treatment
Before the government took the laptop, they checked with Apple (what might be a subscriber report) to make sure the laptop in question was registered to Hunter Biden’s iCloud account. The FBI did two telephone and one in person interview with Mac Isaac (curiously, Shapley refers to his as John Paul rather than Mac Isaac). They then served a subpoena on Mac Isaac to take custody. The Office of Enforcement Operations approved the warrant. The IRS then used a Title 26 (tax) search warrant, with search protocols, to access the content.
There are two references to LTFC, which I suspect is the filter team.
- Order to Apple to verify computer
- Two telephone and one in-person interviews of Mac Isaac
- Subpoena for laptop (12/9/19, but not recorded in doc)
- 12/12/19 OEO approval for search warrant
- 12/13/19 T26 Search Warrant approved with filter protocol
- Some grand jury process relating to iPad backup
- LTFC [?] emails 1/23/20 about data imaging
- 4/10/20: thumb drive (from laptop?) to LTFC
Discovery History
As noted, the hard drive was easy to access; the laptop was not.
The forensic team first started describing the contents of the hard drive 24 days after obtaining the search warrant (with Christmas in between), and first obtained messages from the hard drive in February.
The investigators didn’t get content from the laptop until April, and it was deduped from the hard drive (though there seems to have been stuff on the laptop that was not on the hard drive).
Whistleblower X kept complaining about not getting a Cellebrite report on the devices. It’s unclear whether that pertained to some of the forensics challenges.
Shapley mentioned that there had been an error when the FBI tried to upload the laptop to USAfx, a discovery platform. That’s weird because USAfx is really finicky. Problems uploading it would be unsurprising. Problems uploading it that remained an issue in October, six months later, would be.
- After 1/6/20: Emails about “body parts, file names”
- 1/15/20: Email with file extensions
- 1/27/20: DE1 and DE2 provide file extensions, provided on USB drive
- 2/27/20 DE3 All messages from hard drive provided on USB drive (includes iPad and MacBook messages, not iPhone messages)
- After 2/27/20: iPhone messages decrypted with password obtained from business card
- 4/7/20: DE4 first evidence from laptop (de-duped from hard drive)
- 4/17/20: Uploaded files to USAfx, receive error (many file types)
- 4/20/20: Zip file with PDF and HTML files of cell phone records, and redacted Cellebrite file
Investigative treatment
The most interesting aspect of the investigative treatment of the laptop is that a filter team withheld information from the Mac Isaac 302 from investigators. I wonder whether he told them what he has said publicly–that he has no idea whether Hunter Biden really was the one who showed up in his shop.
- 10/16/19: Richard McKissack calls the FBI Albuquerque
- 10/17/19: Baltimore Field Office receives lead from FBI Albuquerque
- 11/3/19: Unnamed person reaches out to McKissack for contact information for Mac Isaac
- 11/6/19: Josh Wilson calls Mac Isaac
- 11/7/19: FBI interviews Mac Isaac, 302 not shared with prosecution team
- 11/21/19: Follow-up phone call to clarify Mac Isaac claims about timing of abandonment
- 12/3/19: Whistleblower X starts drafting search warrant
- 12/9/19: Took property of laptop, external hard drive, and receipt (redacted information about subpoena)
- 12/12/19: OEO approved search warrant for laptop and hard drive
- 12/13/19: Whistleblower X obtains T26 Search Warrant
- 1/6/20: Forensic analysis begins
- 2/10/20: Filter review completed, scope review begins
Update: Added link to DDOSecrets report.
Wait, I haven’t been following this so I may be slow. Mac Isaac is different than McKissack but the same as John Paul?
Yes.
The most obvious way to connect the actual laptop to Hunter Biden would be to track the serial number of the laptop to its lot number of distribution to the retailer that sold him the unit and to the sales receipt that would show method of payment. I have yet to see info on where and when Hunter Biden purchased that particular laptop. If they wanted to prove it belonged to Biden, that is what they should do.
The other thing that always bothered me is the tip to the FBI. What background does Mac Isaac have in forensic accounting to spot “evidence of possible white collar crimes”? He’s a hardware tech with failing vision looking at data files. Did the FBI agent question Mac Isaac on what suspicious activity he saw on the hard drive, as opposed to what he saw on Breitbart and Fox Nation about Burisma and Hunter Biden?
Excellent observations. Thanks.
It seems like the problem that Marcy mentions above, that there’s uncertainty around HB’s credit card log. It seems to me that that’s something that Biden’s legal team could suss out without an act of congress (an only slightly unreal pun). Is there an undebunkable finding they’ve presented from their camp to that effect yet?
You are seriously going to pratter on about Hunter’s “credit card”?
To be fair, that was just a smattering of prattering.
That this subject is even part of our national political dialogue is bad enough, so consider me all prattered out.
Re your first paragraph, would the serial number be on the sales receipt? I wouldn’t think so. If not, you could track the serial number to a store, and then prove that Hunter Biden bought a similar laptop from that store. But that doesn’t prove he bought *this* laptop from the store. Am I missing something here?
Completely agree with your second paragraph.
My experience is that when I buy an Apple device in-store, the salespeople register the device for me for warranty purposes. If the store did that for Hunter, or if he registered it himself, then Apple will have a record that ties him to that particular device.
True. Even if he bought it at Best Buy, or Costco, or perhaps online, there should be some way to link the physical laptop to the point of sale. It sounds more like the agents tied a drive to Biden’s iCloud account, but not necessarily the laptop Mac Isaac claims belonged to Hunter Biden to some retailer who might prove it was bought by Biden. Knowing the where and when it was purchased could fix that.
I’m not sure how much information is contained on the scan code, but it should be enough to match a unit to a sales receipt even if the serial number doesn’t print out. Most inventory systems can track specific units. If not, it would at least give another something to verify Hunter Biden was the laptop’s owner, or possibly eliminate him as the owner.
I read 3rd of Marcy’s links: Washington Examiner-paid analysis of drive. The analyst has excellent credentials and repeats throughout his report Hunter was owner and exclusive user.
There are … problems with the analysis.
Thx.
To echo Marcy’s understated criticism, that would be true of virtually everything produced by the Washington Examiner, a “conservative” tabloid owned by the arch-conservative Philip Anschutz, 83-year old scion of generations of wealth and and one of the richest men in America.
One of the problems is that they can’t tie this computer to anyone. The stuff on the drive could have been added in the shop, or later. Mac Isaac didn’t get contact information, can’t recognize the person who brought it in, and apparent decided it was Biden based on a sticker on the case.
And that is the kind position on it. It is just nuts.
There were calls exchanged between Mac Isaac and Hunter Biden’s phone.
As the owner of multiple Apple products over time, when I got my new product I would then go register it for Apple Care, their warranty program as you can only buy in shortly after the purchase.
I assume most owners of Apple products get Apple Care because they are ridiculously expensive to repair. So wouldn’t the easiest way to see if the serial number matched to HB would be to see if he registered for Apple Care rather than trying to track down receipts and credit cards? I mean, maybe he didn’t sign up, but it still seems like the least convoluted way to find out.
It just doesn’t seem like someone trying to spoof tying HB to a laptop or hard drive would bother with signing up for Apple Care.
Did they ask him WHY he was looking files on a computer/disk drive that didn’t belong to him, instead of following his own house rules about dealing with unclaimed property?
I’m still not clear about what exactly was allegedly dropped off for repair. Was it one laptop or 3. There is a reference to one laptop, one hard drive and a second hard drive brought in by someone (Hunter?) to transfer the data from the laptop to save it. Was the first hard drive just the hard drive removed from the laptop? Were the 3 devices 3 laptops or one laptop and two hard drives, one external and one removed from inside the laptop? Which hard drive is being put into the new laptop? Did they remove it from the laptop they got from the shop or was it already removed?
Are you confused yet? MISSION ACCOMPLISHED! This is a standard MO for the Republican Party. See also: yellow cake uranium and aluminum tubes.
Seriously, just wait until they confuse the hell out of everyone about whose bag of cocaine was found at the White House in recent days…
It was Don Jr in the Rest Room with the Non-Biodegradable Straw.
My (possibly flawed) understanding is that it was a single laptop. The other equipment was bought and used by the FBI for forensics. I think because the original was not working?? (Presumably there was something wrong with it, which would be why it was at a repair shop to begin with?)
One laptop allegedly dropped off by Hunter Biden. A hard drive is different from a laptop. The laptop contains a hard drive. As Marcy stated the FBI purchased a NEW laptop in order to review the hard drive from the original laptop allegedly dropped off for repair to Mac Isaacs by Hunter Biden. :). That’s what I have determined. I’ve not heard of 3 laptops
[Welcome back to emptywheel. Please choose and use a unique username with a minimum of 8 letters. We are moving to a new minimum standard to support community security. Please also use the *same* email address each time you comment. You have used two different ones which the system interprets as different users. Thanks. /~Rayne]
Rayne – Is this the other email. I couldn’t remember if I had used this or the other one?
[Thanks for updating your username to meet the 8 letter minimum. You’ve used an i* address 12 times and a g* address four times. There doesn’t seem to be a pattern as to which one you use. We don’t even care if the address is active unless you need to hear from us some time, but we need consistency in the address used. /~Rayne]
Thank you. I will stick with this email.
[Thanks. /~Rayne]
that makes no sense from a security perspective
[Howdy, ninecharacters-from-an-IP-address-in-Maryland, no one here asked you. We’re also not going to explain to a first-appearance username with likely fake AOL email address how our security works, either. Scram. /~Rayne]
Oh, it makes about as much sense as the chan verification codes, but only visible behind the scenes: You input something “secret” that validates that comments are from the same user, which allows the moderation team to build an opinion of you without forcing everyone to register (with all the implied privacy concerns).
[Moderator’s note: Please focus on the topic of this post. We’re not going any further into the site’s security in this thread. /~Rayne]
Apologies Rayne, it was meant as praise for your methods.
The purported store receipt says “Attempt data recovery from 3 macbook pros,” and the FBI receipt says 1 MacBook Pro laptop and 1 Western Digital external hard drive. Clearly those are not consistent with each other. Not a fan of Fox, but this has copies of both: https://www.foxnews.com/politics/hunter-biden-emails-documents-alleged-signature-fbi-paperwork
“The three laptops, Mac Isaac recalls, were all liquid damaged. One was dead. One was easily revived. The third, a 13-inch MacBook Pro, had a sticky, ruined keyboard. But Mac Isaac thought he could still salvage its data”…
It goes on to say Isaac began transferring data to “an” external drive and that “blurry” Hunter Biden came back a few days later with an external drive for the data to be transferred too,
“On December 9, 2019, according to the date on a copy of the grand-jury subpoena, the agents came to Mac Isaac’s shop and took away a MacBook, serial number FVFXC2MMHV29, along with the external drive provided for the data recovery.
Two things about Hunter return trip to Isaac’s shop “a few days later”
1. It would make sense that while he was there, he’d pick up the laptop that was “easily revived”
2. It appears Hunter’s porn had made quite the impression on Isaac, if, while dropping off the external drive, Biden figured out Isaac had been peeking, it could explain why he never went back to pick up the data.
These folks do a good time line
https://ddosecrets.substack.com/p/release-hunter-biden-emails-36-gb?s=r
I’m looking at page 119 of the whistleblower interview. Exhibit 6. It says the store took in 3 laptops. Hunter was contacted to bring in an external hard drive to transfer the data. He brought one in. The FBI obtained one laptop and 2 hard drives (3 devices) That is what the exhibit says. One of the hard drives presumably is the one Hunter brought in for the transfer. The other one is what? From the laptop? What happened to the other 2 laptops. If the only problem with the least damaged laptop was a sticky keyboard, why not just replace the keyboard. Why would that require a copy of the hard drive? Why would the hard drive be removed or looked at at all?
Here’s my best attempt at a transcript of what Mac Isaac (who referred to himself at the time as John Paul) told CBS News journalists in October 2020, from the recording at https://soundcloud.com/rptrbnd/mac-shop-10-14-cm:
“The customer came in with three products, three liquid damaged MacBook Pros. One was a complete write-off and I diagnosed that at the counter and said 2016’s a newer model where you can’t do a data recovery if there’s substantial liquid damage to the logic board. Apple solders the drives to the logic board and makes it impossible and this machine can’t, there’s just no way, it’s a write-off, this machine is a write-off, so I handed that back to him. The second machine had just a keyboard issue where it was preventing him from typing in, some of the keyboard wasn’t responding. It also had liquid damage. So I gave him a keyboard and said when you come back in bring back the keyboard, you can borrow this [inaudible]. The other machine I needed to disable some hardware inside of it that was liquid damaged and corroded that was causing it not to boot, so that required it being disassembled, turning it on, getting it to boot up off [?] by [not?] working it manually transferring the data to the store server and that’s what we agreed on as the initial check in for the [inaudible]…The third computer was the actual, the only computer that I checked in.”
This whole laptop “recovery” process doesn’t make sense. I read where MacIssac said the laptop was water damaged and wouldn’t keep running so he recovered the files from the laptop by starting it, copying as many files he could until it rebooted, and repeated it over and over. You know what will make a hard drive unreadable? Unexpected, improper shutdowns and crashes. If he did what he said, that hard drive could have been scrambled good. To recover data files, which was supposedly the purpose of the repair visit, any good tech would have seen the laptop wouldn’t run, immediately removed the hard drive, placed it in an external drive bay of another desktop computer, and imaged it from there. After a backup image of the disk was performed, you could simply mount it and browse through the image and pick and choose files all day long. You don’t need the “laptop” or any other laptop to create a disk image. At least not in my 25 years.
[Welcome back to emptywheel. Please choose and use a unique username with a minimum of 8 letters. We are moving to a new minimum standard to support community security. While this username is an improvement over previous usernames “Peej” and “PJ,” it is still too short. Thanks. /~Rayne]
“FBI determined in order to do a full forensic review a replacement laptop had to be purchased so the hard drive could be installed, booted and imaged.”
Wait a sec… That’s insane.
1) You do not need a new laptop to create an image of a storage device
2) In any normal situation you can’t even have a device booted to take an image of it. Booting is an extra step that is unnecessary.
3) I am no expert in forensic review but I am sure a forensic review should never involve booting the original drive. Even booting it will change the content slightly even if you do nothing with it. And of course, booting will give whoever is using it access to the material on it before it can be preserved. More to the point, there is no need or purpose to boot the original because you are making an identical copy with the imaging process! You do your work on the copy (or a copy of that copy), that is the copy’s purpose!
If it were me I would have taken the original drive and made an image from it without booting it and then put the original in a safe. Now we have a master image. The master image is a perfect copy of the original drive. I would use the master image to create a duplicate of the original hard drive onto a new hard drive. The new hard drive could be mounted as a secondary storage device (not booted to its OS) and the files on the new drive could be reviewed. I can’t see a case where booting that new drive would gain you anything. So the original drive is exactly the same as it was found. No alterations are possible, image creation is read-only. The master copy backs up the original. Any needed work can be done on the new drive.
I just can’t think of a good reason why you’d want to boot to it.
If you have a crime scene you don’t just let people rummage around in it.
That’s why I did this post. There are several things described here, with the access to the laptop most of all, that makes no sense.
Like real misconduct no sense.
!!!!
aletab42: Even booting it will change the content slightly even if you do nothing with it. And of course, booting will give whoever is using it access to the material on it before it can be preserved.
Do we know the date for booting?
What would those people who now [at the time of the booting] have access to that material be able to do with it?
> What would those people who now [at the time of the booting] have access to that material be able to do with it?
Anything you can do with files on a running computer. You could make your own copy of some or all files to an external device. Open, view and modify them. Add brand-new files. Delete files. You could install malicious software.
> Do we know the date for booting?
It would be logged. I don’t work with Mac often but in Windows and every OS a log file(s) keeps track of details when booted, logins, etc. It would be relatively easy to ID when it was used and possibly to some extent what was done with it. If a program on it was used, the program may leave some traces of how it was used separately from the OS as well. So smart enough, determined person could find out a lot, if they wanted to.
I’m going out on a limb with my knowledge with this next part but most modern file systems have a journal or something similar so changes to files would leave some records on the storage device itself independently of the operating system. I am not sure what it would take to cover one’s tracks at that level but it is write-able so someone could potentially but that’s probably not easy. Mac’s file system is APFS and not journaled but it has some kind of “crash protection”: so it must have some way to track changes to files built in.
Everything that aletab42 said!
As a PC/Mac tech with nearly 20 years of experience with laptops, I can confirm aletab42 is completely on point. Buying a new Powerbook, especially for data recovery purposes, makes absolutely no sense whatsoever. It is not only preferred but almost always necessary to recover data from a hard drive by making it the secondary drive to a functioning computer’s primary drive.
A computer’s operating system is configured specifically for the machine it was installed on. If the new machine had ANY chipsets or hardware that differed from the original laptop – even if only by version number – that would require a special recovery boot which would then install the latest OS over the existing one. The installation would wipe out all existing system files, (usually, but not always) leaving documents and personal files intact.
Also, to clarify about Mac filesystems,
Older OS (pre-Mojave): Mac OS Extended (Journaled), Mac OS Extended (Journaled, Encrypted), Mac OS Extended (Case-sensitive, Journaled);
Newer OS (Mojave and later): APFS;
Windows compatible (USB drives, SD cards, and external HDs): exFAT
Then that might be the point of buying a new laptop: “to wipe out all existing system files.” It would also explain why the Washington Post analysts said there was stuff missing and that meant there was a lot which they could not verify.
It might also be yet another reason why DOJ didn’t want to prosecute: because the key piece of evidence was compromised.
Any storage media that has been controlled by various people is suspect. That includes installed drives (rotating rust or solid state), even the BIOS can be changed. External drives are the same. Boot dates and other operating system logs are changeable by any good technician. You can make any laptop look like it was last booted in 1776 by Benjamin Franklin.
I wasn’t going to go out on a limb to say what you wrote, but from experience I know what you say is true. I had an IT business for about 20 years, ending in 2011. We did stuff like this hard drive thingie many, many times.
The point of what Marcy is illustrating is, however, not that any single ‘occurrence’ (like what we’re talking about in this sub-thread) is in and of itself damning. Rather that the whole HB process, from even before ‘Hunter’s laptop’ came to public view, to now, with witnessX/Shapley and their incongruent statements… all put together it doesn’t look anything like a professional investigation. More like a barely functioning jalopy made out of spare, rusted, time-expired parts.
Maybe I missing something, but it seems very obvious to me that no one who believes in fact checking for journalism, or authenticating evidence for a lawsuit, would take the contents of the laptop seriously, since it’s so difficult to verify that the contents haven’t been adulterated.
[Thanks for updating your username to meet the 8 letter minimum. /~Rayne]
Sometime in 2019: IRS supervisor documents Sixth Amendment problems with case, collects Trump’s tweets
March to April 2019: DOJ Tax reviews Whistleblower X’s lead
[As early as] 4/13/19 MAC ISAAC begins “accessing what he claims he had in his possession as Mr. Biden’s data” [Abbe LOWELL] https://storage.courtlistener.com/recap/gov.uscourts.ded.81708/gov.uscourts.ded.81708.11.0_1.pdf
October 16, 2019: First lead on laptop
December 9, 2019: FBI takes property of laptop
December 13, 2019: Search warrant for laptop
Wondering how this analysis by Thomas Fine fits into this timeline: https://mstdn.social/@[email protected]/109672657366454387
He was looking at the laptop’s warranty expiration date based on his experience working with Macs: “…endDate I get out of it is 2019-10-13.”
ADDER: Fine has done quite a bit of digging into the laptop’s history.
https://mstdn.social/@[email protected]/109672657366454387 warranty end time (see prev above)
https://mstdn.social/@[email protected]/110030424213829955 network map of files copied around
https://mstdn.social/@[email protected]/109867576750053465 zip file times
https://mstdn.social/@[email protected]/109672883025453676 purchase date
This is interesting Rayne, thank you.
Regarding the zip files, Fine’s opinion:
“So we already knew the data was passed around through multiple hands and is just forensically a disaster. This is largely just further confirmation of that fact.
But I do think that the fact that the zip file was created somewhere like Venezuela or Bolivia or Brazil is kind of interesting.”
https://social.linux.pizza/@thomasafine/109879588697129492
Feb 17, 2023, 05:24
And later in that thread is the bit quoted above by Jimmy Anderson
1] I’m really slow with the technical stuff, but when was the zip file created?
2] How far out from the coast of Connecticut would GUO’s superyacht have to be, in order to be in that time zone?
https://en.wikipedia.org/wiki/Time_zone
Well, that rules out Bermuda because it’s the only location in Atlantic Time Zone which observes DST.
https://en.wikipedia.org/wiki/Atlantic_Time_Zone
Could have been in Canada, too, since some of the easternmost provinces observe UTC-4.
There are some other dates in a small TL at this comment, including [below]: https://www.emptywheel.net/2023/03/15/guo-wengui-arrested/#comment-984936
Also, see more TL info here:
https://www.emptywheel.net/2023/02/02/james-comers-dick-pics-hearing-just-became-an-alleged-stolen-laptop-hearing/#comment-980756
…including [from this post by Marcy]:
https://www.emptywheel.net/2023/01/20/the-primary-thing-eric-herschmann-remembers-from-january-6-is-that-cassidy-hutchinson-is-wrong/
8/3/20 Eric HERSCHMANN [Friend of KUSHNER] begins work at WH as Senior Advisor to TRUMP [He remains until 1/20/21]
Is there a chance that the Hunter Biden laptop might have some type of security installed (for specific software) which might be common protocol for family members of, say, former VPs?
One thing seems really strange: why would anyone take a MAC to a small, independent shop and not a AppleStore? Anyone who has had MAC(s) and been through non-trivial repairs knows this is not smart (for a bunch of reasons). Apple repairs are pricey, but (in my experience) always done right and fast.
Other thing: seems HB had comprehensive iCloud backup. So why bring in other hard drives? If the computer couldn’t be salvaged, he could buy a new one and Apple could restore from iCloud as part of setup. We know he previously had other Mac’s, so he would know this.
I don’t know date HB “cleaned up”. If it was during this time (eg. dropping off laptop to Isaac’s joint) that could explain some major nonsensical behavior. If not, … ???
Why would he take it to Delaware, when there are Apple stores in L.A., where he was living at the time?
Speaking as someone in LA who travels to MA a lot, MA Apple people are much faster than LA. It’s not even close. Maybe the service time is faster in Delaware.
Jeebus. That’s a good fucking question. Everything was on iCloud.
Everything.
I have only used Macs since the mid-90s I think. One thing I will say about Apple doing the repairs is that once it is out of warranty, it’s really not necessary to go to Apple for fixing. How one decides where to go at that point is another matter. I have a go-to now that I love. They do everything and refurbished a couple of MBPros for me recently. I would not go to some place where I did not trust the workers for sure, even though I don’t have anything I’m trying to hide. Password access is not necessary, but at some point it is useful to the repair people. I suppose they might snoop around, but I don’t really think under most circumstances they would bother. I had them copy the contents of an old Mac eyeball onto a thumb drive and left the machine with them to do what they wanted with it whether recycle or perhaps for some collector. I noticed one in the background of a photo of an interior that I was looking at for design features. I’m sure it was just a collector’s item.
Touching on what you posted, I use an “Apple Authorized” independent repair shop.
I have always wondered if Mac Issac’s shop was Apple Authorized. If it were then it might make some sense if HB did in fact use his services.
Now I’m going to go and read the threads Rayne posted to see if they help make any sense out of what seems like a total clusterf*ck around this whole thing.
I have a question.
This is from the Washington Examiner analysis of the hard drive.
Item #55 says the laptop was authenticated and connected to Hunter’s icloud account one day after the user account was created on the MacBook Pro on 10/21/2018.
Why was a 2017 laptop not used until 2018 and then dropped off at a repair shop 7 months later?
Then there’s this :
The Secret Service said Monday it’s “aware” of a potential hack of an iCloud account owned by Hunter Biden, the son of President Joe Biden, after some of its alleged contents were posted to the online forum 4chan.
[Welcome to emptywheel. Please choose and use a unique username with a minimum of 8 letters. We are moving to a new minimum standard to support community security. Thanks. /~Rayne]
We know Hunter’s icloud account was hacked and we also know the time frame for when the laptop was purchased, somewhere around 10/21/18 ( from the Examiner analysis) as that was the day the user account ” roberthunter” was created on the Macbook Pro.
With the serial number and dates why can’t it be conclusively linked to Hunter?
[Welcome to emptywheel. Please use the same username each time you comment so that community members get to know you. “SB317overthere” is your second user name; you published a comment earlier as “SB317.” Pick a site standard compliant name and use it consistently as changing usernames constitutes sockpuppeting which is not permitted. Thanks. /~Rayne]
Personally, I think the chain of custody is compromised and this is all pointless. There’s no telling who did what to that drive before law enforcement got custody of it.
Just saying.
… or after the FBI got hold of it, by the look of Marcy’s post.
Exactly. Chain of custody not only compromised, but there never was any “custody” before Isaac started wrenching on it.
So many interesting links posted here. I have some thoughts:
During two semesters of business law in college, I learned a little bit about bailments and the rights of bailors and the responsibilities of bailees. I learned that by charging a fee for services, Mac Isaac is held to higher standard of care over the property in his possession. My classes were long before cloud-based data storage was a thing. I don’t know if recent statutes have dealt with the issues of personal property located elsewhere but accessible on a physical device. Maybe someone knows current cases.
Now to my point. Hunter Biden seems to have, allegedly, obtained the laptop in question around 2018. The contents include items much earlier that were saved to his iCloud account. Stretching the rules of abandoned property to the extreme, it would seem that at best the bailee would only be legally entitled to contents which originated on the allegedly abandoned device. Let’s say I leave my wallet in some dry cleaning that I never pick up. The cleaners may be entitled to the cash in the wallet but they should not be able to max out all of my credit cards and use my social security card and drivers license to open more credit accounts.
Obviously, Hunter Biden did not use that one Mac Book to send all of his emails and take all of those photos and videos. Mac Issac is personally profiting off of content WAY beyond what originated on the laptop. I compare it to a valet parking attendant using another key on my key chain clean out everything in my house.
Sorry about the long post.
There is also the idea that the repair guy made two copies of the data he retrieved from Biden’s laptop during the original recovery process, I’m having a hard time imagining that being done in good faith.
“Let’s say I leave my wallet in some dry cleaning that I never pick up. The cleaners may be entitled to the cash in the wallet …” No, at least not immediately.
The concept of bailment would protect the laptop and its contents, and the wallet and its contents.
If the argument is abandonment – after a “reasonable” time, but more particularly where there is a specific agreement (say, through a [repair or dry-cleaning] contract) that states the bailee takes ownership of the abandoned item, *e.g.*, a wallet in the pocket of an abandoned suit, they can do with the wallet as they please, and its contents, which would include the cash as money, a condom as a condom. They could also make guitar picks or shims out of the credit cards, but not use them *as* credit cards or the information they access – same for, say, a drivers license, or a blank or a wages check. (An interesting question for a law school exam might be what use of any pictures therein.)
Further *e.g.*, re a laptop, they can use the laptop as a laptop or as a doorstop, could even scavenge parts from it and use, say, the hard drive as a spare drive. They cannot, however, use the info contained thereon.
And of course, not only the laws of bailment, or any specific contract(s), but other legal issues such as privacy are implicated – whether pictures in a wallet or on a hard drive, or any other information.
Here’s what I know: in 2016 two planes parked near each other in Denver. The candidate’s husband got out of one and paid a visit to the person in the other one, who happened to be AGUS. The resulting uproar caused her to (stupidly) recuse herself from the candidate’s email “scandal” and even more stupidly give her authority to the FBI Director and not the Deputy AG. Said FBI Director then, for reasons of “optics,” reopened the investigation and probably caused said candidate to lose, against all expectations. The rest is history, God help us.
Moral: the GOP and its enablers are relentless and you cannot kill them. In politics the “butterfly effect” is real and the GOP knows it.
No one should take their eyes off this for a minute, no matter how far fetched it seems now.
That happened in Phoenix.