Where Derek Hines Claims to Have Gotten the Hunter Biden Dick Pics He Sniffed
Even if Judge Maryellen Noreika threw out the gun charges against Hunter Biden today, I’d be grateful for the recent squabble over Hunter Biden’s motion to compel, and not just for the endless amusement of seeing an experienced drug prosecutor like Derek Hines claim sawdust on a table saw is cocaine.
That’s because by providing what he thinks is solid proof that Hunter was an addict in 2018, Hines has revealed a bit about where such evidence exists among the digital evidence he has in hand and where it doesn’t.
Most significantly, for this case, it appears Derek Hines relied exclusively on the laptop to get the texts surrounding the period immediately after Hunter Biden bought a gun. Particularly given the turmoil in Hunter’s access to his devices in those precise days, without validation of the texts in an Apple database, that would make the texts far harder to use at trial.
As a reminder, the Apple data at issue comes from three places:
- An initial warrant dated August 29, 2019 to obtain all the contents of Hunter Biden’s iCloud account
- The December 13, 2019 warrant to access all the contents of the laptop obtained from John Paul Mac Isaac, which investigators used to access devices backed up to iTunes on it
- A follow-up warrant dated July 10, 2020 to access the backups of four devices saved to Hunter’s iCloud account, described in a fourth warrant as:
- iPhone X (Apple Backup 1)
- iPhone 6S (Apple Backup 2)
- iPad Pro (Apple Backup 4)
- iPhone XR (Apple Backup 11)
In December, Hines got a warrant to search the existing data for gun crime evidence, but did not go back to obtain a warrant to access any backed up devices — if they exist — that would be more appropriate to the gun charges.
Hines claimed, in his response to Hunter’s selective prosecution bid that, “the results of the search” of the laptop “were largely duplicative of information investigators had already obtained from Apple.” In his response to Hunter’s motion to compel, he claimed that, “Many of the same messages, photographs, and information that were obtained from the iCloud warrants were also located on the defendant’s laptop,” but made no representations about the reverse — whether all the messages present on the laptop were in the iCloud production.
It appears they were not.
This table shows my rough transcription the 28 items included in Hines’ exhibit of gun-related evidence. Let me know of errors, particularly with my time conversations between UTC and “Hunter time,” which I’ve assumed was PT for the earlier texts and ET for the later ones. I’ve bolded those instances where “Hunter time” is the day before UTC time. My transcription of the hex identifiers, where Hines included them, are especially likely to have errors (and only include the first identified hex for each item).
These items include:
Items 1, 26-28: Four pictures, all of which he has presented without hex identifiers or EXIF metadata. Two come from iPhone backups obtained from Hunter’s iCloud (one being the iPad on which items 28-25 were found); two (including the sawdust picture) come from what is described as an iPhone 11 backed up to iTunes, apparently found on the laptop; I’m aware of no public record of Hunter owning an iPhone 11. Note: for the reason zscoreUSA notes below, Hines’ label of the sawdust picture as an iPhone 11 must be an error, as those were first released on September 20, 2019, too late to be on the laptop, and only possible to be included in the iCloud returns if Hunter got one the day they were released and backed up everything to an iPhone 11. So it may be a typo for iCloud backup 11, which would be an iPhone XR.
Items 2-10: Nine texts, dated between May and July 2018, obtained from iCloud Backup 1, which the warrant return describes as an iPhone X. Six of those, items 5 through 10, appear to record a drug transaction arranged over the course of a half hour overnight on July 25-26. While this backup is associated with an iPhone X of uncertain vintage (Hunter went through at least three iPhone Xes in 2018), seven items were obtained from a device called XRNASHUA, an iPhone XR; Apple did not introduce the iPhone XR until October 2018 and Hunter is not known to have obtained his first one until spring 2019, in New Haven, not Nashua. The only two communications obtained from an iPhone X, Items 3 and 4, used an unknown phone number. Item 2 is a WhatsApp text.
Items 11-17: These texts, showing exchanges between Hunter and Hallie Biden on October 13, 14, and 23, derive from what Hines describes as an iTunes Backup. Hines doesn’t identify of which phone — not even the device type — nor does the metadata included identify which phone Hunter used. Just one of the texts Hunter sent, item 13, is described as “delivered” after it was “sent.” I’ll return to these below.
Items 18-25: These texts came from an iPad Pro called “Robert’s iPad” which, based on the serial number included in Gus Dimitrelos’ report, was purchased in November 2015.
iPad Pro 12.9-inch (1st generation) Wi-Fi
Purchase Date: November 2015
Serial Number: DLXQL4EUGMLD
Emails released on BidenLaptopEmails dot com show someone logging into Hunter’s iCloud, Facetime, and iMessage with an iPad Pro on November 11, 2015, the same day Gus Dimitrelos shows it — named as Roberts, no apostrophe, iPad — logging into Hunter’s iCloud account. The next day, a pricy iPad pencil was ordered from Apple, though it was on backorder until January 2016. On May 20, 2016, Find my iPad was used to play a sound on an iPad called “iPad 206” twice. The process of signing into iCloud, then Facetime and iMessage with an iPad Pro, was repeated on September 11, 2016, what Dimitrelos describes as the first access by iPad 206, the one already associated with Hunter’s account earlier that year. On October 26, 2016, Find my iPad was disabled on iPad Pro 206 and on November 13, 2016 the cards were removed and the device was deleted — presumably, given that Find my iPad had been disabled, in person. Those same publicly released emails show no other iPad Pros logging for the first time into Hunter’s account, though in August 2018, an iPad (not identified as a Pro) was deleted, with that process completing in September 2018. But Dimitrelos shows four other iPads named either “Robert’s” or “Roberts” iPad logging into Hunter’s account (February 19, 2013, August 24, 2017, October 21, 2017, January 21, 2018). Of the texts included in Hines’ exhibit, which were sent between November 8 and December 27, 2018, just one, item 20, was marked as delivered and read, and it wasn’t one of the ones sent to probable family members.
I’ll leave the technical discussion there, in case anyone understands how Apple tracks iMessage texts or the difference between texts saved in ChatStorage and SMS.
But several general conclusions stick out. First, it’s likely that two of the devices for which Hines got a new warrant for drug crimes in December 2018, iCloud Backup 2, a 6S, and iCloud Backup 3, seemingly a different XR, had no communications pertinent to the year in question, 2018 [update: unless the explanation for Hines’ error in labeling photos as iPhone 11 is a typo for iCloud backup 11]. That will be of interest if Abbe Lowell ever gets to file a suppression motion, since there could be no probable cause to obtain content from an unrelated period. Second, it’s not clear that any of these devices were the devices on which the communications in question were sent. Hines’ best evidence of a drug purchase — those texts from July 25-26, 2018 — would probably have been sent in an iPhone X and then synched onto an iPhone XR purchased quite a bit later. As with all the other digital evidence Hines seems not to have thought through, given how often Hunter lost devices with access to his iCloud account and how rarely he reset it, it’s not enough to show that texts saved through Hunter’s iCloud showed evidence of a drug purchase. You would have to show that the phone on which those texts were originally sent was in Hunter’s hand at the time the texts were sent.
And this problem is especially fraught for those October 13-14 texts sent between Hallie and Hunter in October 2018, by far the most important evidence for his case. Here’s how they fit in with the timeline I laid out here, showing how Hunter responded after realizing he had misplaced both his main phones on October 11. The two main texts (in bold below) appear to have been sent before Hunter first logged into his new replacement iPhone and before he changed his password, even while people were clearly trying to break into some of his accounts. So prosecutors would have to prove that those texts weren’t sent by whoever inherited the phones Hunter had just lost.
Timeline
October 12, 12:56PM: As you requested, your temporary [AT&T] password is: ****** Use your user ID and temporary password to sign in to your account.
October 12, 12:56PM: Looks like you recently updated the AT&T password.
October 12, 12:57PM: Critical security alert for your linked Google Account, Sign-in attempt was blocked for your linked [RosemontSeneca] Google Account [device not specified]
October 12, 3:25PM: Thanks for using your AT&T Device Protection Plan! Your claim [ending in 431] has been started
October 12, 3:32PM: Thanks for using your AT&T Device Protection Plan! Your claim [ending in 431] has been started
October 12, 3:38PM: Thanks for using your AT&T Device Protection Plan! Your claim [ending in 579] has been started
October 12, 3:40PM: Your [AT&T] insurance claim [phone ending in 96]
October 12, 3:44PM: Your [AT&T] insurance claim [phone ending in 13]
October 12, 3:49PM: Thanks for using your AT&T Device Protection Plan! Your claim [ending in 701] has been started
October 12, 3:55PM: Please complete and return your claim documents Wireless Number: **94
October 12, 3:57PM: Thanks for using your AT&T Device Protection Plan! Your claim [ending in 799] has been started
October 12, 4:03PM: Please complete and return your claim documents Wireless Number: **29
October 12, 5:35PM: Hello. Review your AT&T order
October 12, 6:22PM: Good news. Your replacement device [grey Apple iPhoneX] has shipped. [phone ending in 13]
October 12, 6:24PM: Phone [email from Joey]
Hey, You left your phone and other things. Tried to reach you at 202 and 302 all day but no luck. Let me know where to overnight.
October 12, 7:20PM: Good news. Your replacement device [iPhone 8] has shipped. [phone ending in 96]
October 12, 8:00PM: Verify your Samsung account [accessing Hunter’s iCloud]
October 12, 11:31PM: Someone Just Checked Your Background Report
October 13, 7:10AM: (Email) You left your phone. How do I get it to you?
joey
October 13, 7:26AM: (Email) You left your phone. How do I get it to you?
joey
October 13, 11:13AM: Let’s setup your AT&T replacement device [phone ending in 13]
October 13, 12:35AM: Someone Just Checked Your Background Report
October 13, 2:00PM: Hello, Review your AT&T order [changes to wireless]
October 13, 9:17PM: Your [RosemontSeneca] Google Account was just signed in to from a new Samsung Galaxy Note 9 device
October 13 10:30PM: I’m now off MD Ave behind blue rocks
October 13, 11:36PM: Wells Fargo Has Registered Your Mobile Device
October 14, 5:37AM: I was sleeping in a car
October 14, 2:24PM: Your Apple ID password has been reset
October 14, 2:24PM: Your Apple ID was used to sign in to iCloud on an iPhone X
October 14, 3:28PM: Wells Fargo card added to Apple Pay
October 14, 3:36PM: Verify your Samsung account [on iCloud]
October 14, 7:48PM: (Email from Joey) “Overcoming myself”
When you have a minute, read ….
Open my shared note:
A reminder to all new and existing community members participating in comments:
— We have been moving to a new minimum standard to support community security over the last year. Usernames should be unique and a minimum of a minimum of 8 letters.
— We do not require a valid, working email, but you must use the same email address each time you publish a comment here. **Single use disposable email addresses do not meet this standard.**
— If you have been commenting here but have less than 1000 comments published and been participating less than 10 years as of October 2022, you must update your username to match the new standard.
Thank you.
iPhone 11? Those were released September 10, 2019. Interesting
https://en.m.wikipedia.org/wiki/IPhone_11
Good point.
It’s not IMPOSSIBLE that’s accurate. Remember that the warrant was served on Apple on August 30, 2019, but there was some delay — Apple may have challenged the gag, for example — so the data wasn’t turned over until September 25, 2019.
But then it couldn’t be on the laptop, given what we know.
It must be an error. It’s probably the iPhone XR backup.
It would have to be TWO errors. Because it explicitly says iTunes Backup. So it would be both leaving out “iCloud” and adding in “iTunes”.
Unless there are 11 or more iTunes backups of iPhones that were found on the laptop? (Could it be multiple backups of the same phone – no actually Apple says they store only one iTunes backup per device.)
And as a reminder, this is where he got the photo of the table saw and sawdust he claims is cocaine.
I’m not sure the 11 really refers to a phone. The backup had to be made through a lap/desktop. It could have been made with iTunes 11 (versioning number) or could be the OS number of the laptop (?Do we know the laptop configuration for the laptop through which the backup was made?) or, (if it were a manual backup) just a use choice (though this seems unlikely). Too many cards hidden right now to be too certain about what the 11 might mean.
Does Marcy have a post/page with links to data sources? I’ll go look of course, but if I can save myself time that Marcy already spent … I see where she got the hex numbers.
After reading the relevant ECFs on the docket, HRB is correct to continue to press for compelled discovery. If they’re using a photo of a photo of a bandsaw and sawdust as evidence of drug paraphernalia and drugs, well then one just has to see what other shit they pulled to scare the grand jury.
The last version of iTunes 11 released was in 2014. While it is possible that iTunes 11 was involved here, it is unlikely.
ref https://en.wikipedia.org/wiki/History_of_iTunes#iTunes_11
Note that you can look at the history for iTunes 12 (and other much older versions) using the left column at the wiki page
Here’s some information about the phones being used, hopefully relevant to this discussion.
During the July time frame, Hunter had 3 phone numbers: DC, LA, DE based on area codes; the DE phone is Joe’s old phone so people receiving calls might think Joe is calling when they look at caller ID
When you say Hunter lost his 2 main lines on October 11, I’m not sure which 2 phone numbers those are. I’m not sure where Joey Hernandez is located, whether in LA or on the East coast, but he has the LA phone. I think it’s possible that phone was lost while Hunter was still LA, so a week prior.
The October 13-14 text conversation mentioned was on a DC phone number that was used by the family previously, including a daughter and his ex wife (so when people see it in the caller ID they might think it’s his ex wife calling). Hunter started using this due to losing 1 or 2 of his other phones. Hunter begins using this phone 10/13 around 8am. This phone might be backed up to the laptop, as this text conversation is the first message on the PDF of iPhone Backup that Ziegler included in his screenshot tweet.
From this time forward, until the time frame of data on the laptop published by Marco Polo, Hunter used 3 phone numbers: the same previous DC & DE numbers and a second DC number which was the one that had previously been used by family members, the LA number appears to be not used again
Also, around this time, Hunter did leave a laptop in his family’s house, per texts about retrieving it. I’m not certain the date it was left or the date it was retrieved.
Is the 2nd DC number the one saved in encrypted form to iTunes, do you know?
I’m not sure. I’m not very knowledgeable on the technology, but because this conversation is the first that appears on that backup file on Marco Polo so I’m guessing maybe it was the one that was backed up.
It’s possible someone with the technology experience could figure out a more definitive answer to your question.
Looking at your chart again, I believe the messages 10/14/18 to 10/24/18 Device labeled “NA” were sent from the ex wife’s former phone number. I don’t know what hex means and I don’t know why the first ones say NA and last 3 say Hallie, as they were all conversations with Hallie. During this window, this number is added as Apple ID trusted number. Dimitrelos reports that an iPhone XS was backed up on laptop 2/6/19. Dimitrelos lists Hunter’s only currently Trusted phone device an iPhone XS accessing Apple ID 1/13/19, but checking serial was actually purchased October 2018. On 11/2/18, an iPhone XS signs into his Apple ID, but for some reason Dimitrelos does not record.
10/13/18 8am texts Hallie “I’m using this [phone] until my other phone arrives by mail”, I don’t know if he means by mail from Joey or a new phone from AT&T. This message is worded like he’s only going to use the phone number for only a couple of days but based on other text messages I believe he continues to use for months.
4/4/18 Joe’s Number added as Apple ID trusted number, DC Number 1 removed (rspdc email)
7/28/18 DC Number 1 added as Apple ID trusted number (rspdc email)
10/17/18 DC Number 2 added as Apple ID trusted number (rspdc email)
1/9/19 Joe’s Number removed as Apple ID trusted number (rspdc email)
1/22/19 DC Number 1 removed as Apple ID trusted number (rspdc email)
2/9/19 DC Number 1 added as Apple ID trusted number (rspdc email)
[Note: DC Number 1 appears on the Mac Isaac invoice]
2/9/19 Apple ID (iCloud email) signs into iPhone 6s right before droidhunter88 password changed
2/28/19 purchase iPhone XR, uses DC Number 1 as billing info requesting to mail Give Back shipping box to a DC mailing address to ship back iPhone 6s, which probably doesn’t get shipped back
At some point, I think January, Hunter places a phone under Hallie’s car seat to monitor GPS services. I don’t know which device, or which phone number, or I suppose could be a phone without a mobile number.
2/5/19 Hunter’s friend reports back the phone is missing from Hallie’s car
2/6/19 iPhone XS extracted onto Mac Isaac laptop
2/7/19 Hallie texts that she dropped off a phone at Joe’s house, unclear to me if left on porch, or with security guard, or to Joe/Jill or if Hunter gets it back during this time
3/15/19 Wells Fargo Card added to Apple Pay, Device Name: XRNashua, Device Number: DC Number 1 (iCloud email)
I should also add, a couple of data events in the hours after the Apple ID connecting to the iPhone 6s on 2/9/19.
Something called Call recorder for iPhone is downloaded from iTunes Store to a device not previously used.
And per Dimitrelos, a Burisma document from 9/3/18 with Hunter’s signature is saved in a nested folder on the laptop. I don’t know if all files in that folder were saved at that time (right after midnight 2/9/19) due to some unexplained process. Or if a person accessed that specific file. No explanation is given why Hunter would open and save that file, but theoretically someone not Hunter could be interested to study a recent signature if they were concocting a plan to launder the laptop to investigators via a Mac repair shop.
Hmmmm, just noticed something really interesting. This article may help explain when Hunter placed the phone under Hallie’s car seat.
10/11/18: Hunter has lost 3 phones (DC 1, Joe’s, LA); Hunter takes 49 screenshots of Hallie’s phone records
10/12/18: use AT&T/Asurion to replace DC 1 and Joe’s Number; email from Joey about LA phone; buys gun
10/13/18: early morning begin using DC 2 as primary number; new AT&T devices should have arrived by mail later in day
Mystery Date: Hunter places phone under Hallie’s car seat
1/26/19: first mention of putting device under Hallie’s seat
2/5/19: Hunter and friend discuss phone missing from Hallie’s car, she must have discovered
2/7/19: Hallie says she dropped a phone off at Hunter’s parents house
Maybe the Mystery Date of planting the phone was October 11, the date he has lost 3 phones, and the day before he uses the AT&T insurance to replace 2 of his phones. And also the date he takes the photos of Hallie’s phone records. I had thought it was most likely to be early January just because its closer to when the phone was mentioned in texts & discovered by Hallie, and when he would have physical opportunity to do such activity.
Minor error: I think in your table you have the year wrong in the date for Item 7: should be 18, not 16.
https://bsky.app/profile/nycsouthpaw.bsky.social/post/3klienxw72v2n
Feb 15, 2024 at 4:53 PM
Brad Heath on new indictment of FBI informant in this case:
https://bsky.app/profile/bradheath.bsky.social/post/3klidz3japr27
Feb 15, 2024 at 4:41 PM
Marcy writes about this here:
https://www.emptywheel.net/2024/02/15/the-gaps-in-leo-wises-belated-indictment-of-alexander-smirnov/
Here’s a side by side comparison of the Joey email in your timeline and my interpretation in context with all of the other available data I have seen
Interpretation:
This was the same day Hunter bought the gun. And the day after Hunter scrolls through phone and took 49 screenshots of Hallie’s call records. The 49 screenshots is per Laptop From Hell, and I’m not sure what device he used to take the pictures, if it was one of his phones or not, and if it was did he lose it the later the same night after photos synched. I think I saw such images on Marco Polo’s site but I am not certain as the images there are all over the place and timestamps often have dates that can’t be the original.
Cocaine is often cut with baking soda; not a circular saw.
Just sayin’ ;-))