emptywheel Writes Letters: The FBI Extraction of the Hunter Biden Hard Drive Is 62% Bigger than the Laptop

As I did in January, I’ve written a letter asking Judge Maryellen Noreika to liberate two documents, the more interesting of which are the forensic reports FBI did of the Hunter Biden laptop and the hard drive John Paul Mac Isaac made of the laptop. (Yes, I know it has my personal information.)

In a key passage explaining the significance of the two forensic reports, I noted that the extraction of the hard drive that purports to be a copy of the laptop is 62% bigger than extraction of the laptop itself.

In the motion in limine in support (“MIL”) of introducing those communications via summary report (DE 120), SCO relied on the expert certification of Michael Waski, a Senior Digital Forensic Examiner who, as a Forensic Analyst, was involved in exploiting the laptop in 2019. Accompanying the MIL, SCO provided Mr. Waski’s certification, which in turn incorporates by reference his expert Disclosure. (DE 120-2) The only reasons given why SCO did not docket expert Disclosures themselves were, “because those documents are voluminous and because the defendant agrees these files are self-authenticating.” Nevertheless, Mr. Waski’s certification describes his Disclosure as, “attached hereto.” 

Mr. Waski’s certification, as docketed, does not by itself certify that the laptop was among the devices extracted. While the MIL describes that Mr. Waski’s certification pertains to, “two backup files from laptop and hard drive” (DE 120 at 3), Mr. Waski’s certification itself mentions neither. Instead, it references a “Digital Forensics Report and [an] Extraction Report,” singular. Compare Robert Gearhart’s certification at DE 120-1, which lists the four iCloud backups described in the MIL, “Apple Backup 1, Apple Backup 2, Apple Backup 3, Apple Backup 4,” which in turn match the warrant. (20-mj-165 DE 3 at 2) To confirm that Mr. Waski’s certification pertains to the laptop and hard drive incorporated into the summary and described in the warrant (19-mj-309 DE 3) requires inspecting the Disclosure.

Beyond that issue of completeness, Mr. Waski’s Disclosure holds additional significant public interest: (1) it would reaffirm the integrity of these proceedings, (2) it might address concerns raised in two separate Congressional investigations incorporating Mr. Biden’s devices (3) it would provide insight into derivative hard drives that have been the subject of controversy for years.

Some background explains why. The FBI obtained the two devices referenced in the MIL from computer repairman John Paul Mac Isaac. (19-mj-309 DE 3) One device, introduced into evidence as GTX16, is a MacBook Pro. The other device, a Western Digital hard drive, purports to be a copy that Mr. Mac Isaac made of the laptop; that copy is, in turn, the source of a number of other hard drives disseminated publicly, including to Congress, since 2020.

Because the hard drive purports to be a copy of the laptop, the content on those devices should substantially match. Yet the MIL suggests it may not. According to SCO, the “backup file” of the laptop (the original source) consists of 4,198 pages (DE 120 at 5). The “backup file” of the hard drive derived from the laptop (the purported copy) consists of 6,801 pages (Id.). In other words, the extracted copy made of the laptop is 62% larger, measured in pages, than the extracted original source. SCO’s office provided no response to an inquiry regarding the significant size difference in these backup files. [my emphasis]

Judge Noreika has asked the two sides to weigh in on these requests by end of day.

ORAL ORDER re Letter ( 247 ): IT IS HEREBY ORDERED that, by the close of business today, the parties shall provide the Court with their respective positions on the request for the unsealing of the two documents referenced in the letter. ORDERED by Judge Maryellen Noreika on 7/17/2024. (mdb) (Entered: 07/17/2024)