https://en.m.wikipedia.org/wiki/Hunter_Biden_laptop_controversy
Forensic analysis
In March 2022, The Washington Post published the findings of two forensic information analysts it had retained to examine 217 gigabytes of data provided to the paper on a hard drive by Republican activist Jack Maxey, who represented that its contents came from the laptop. One of the analysts characterized the data as a "disaster" from a forensics standpoint. The analysts found that people other than Hunter Biden had repeatedly accessed and copied data for nearly three years; they also found evidence that people other than Hunter Biden had accessed and written files to the drive, both before and after the New York Post story.[4] In September 2020, someone created six new folders on the drive, including with the names "Biden Burisma", "Big Guy File", "Salacious Pics Package" and "Hunter. Burisma Documents". One of the analysts found evidence someone may have accessed the drive contents from a West Coast location days after The New York Post published their stories about the laptop.[4]
Using cryptographic signatures, one analyst verified that 1,828 of the roughly 129,000 emails on the drive came from the indicated email accounts of origin, suggesting they were authentic and had not been tampered with. The other analysis verified nearly 22,000 emails using similar methods, after overcoming technical issues the first analysis could not resolve. The analysts said emails from Burisma, where Pozharskyi was an advisor, were likely authentic but cautioned that if Burisma had been hacked, it would be possible for hackers to use stolen cryptographic signatures to forge emails that would pass as authentic. The New York Times reported in January 2020 that Russian military intelligence had hacked Burisma beginning in November 2019; a co-founder of the firm that discovered the hacking said Russians were stealing email credentials. Both analysts acknowledged that cryptographic signatures are not a perfect way to authenticate emails, as some email services do not implement the technology as rigorously as others. About 16,000 of the 22,000 emails carrying cryptographic signatures came via Google, which rigorously implements the technology. The analysts noted that cryptographic signatures can only verify that an email originated from a certain email account, but not who controlled that account; there are other means for hackers to commandeer email accounts. According to the Washington Post, "Some other emails on the drive that have been the foundation for previous news reports could not be verified because the messages lacked verifiable cryptographic signatures."[4]
Among the emails that The Washington Post was able to authenticate was the Pozharskyi email that formed the basis of the New York Post's original article. An email referencing "10 held by H for the big guy?", a possible reference to a rejected proposal to give Joe Biden a 10% share of a Chinese deal his son was negotiating, was not authenticated, though a recipient of the email publicly vouched for its authenticity.[4]
One of the analysts found that timestamps on documents and operating system indexes matched, though he noted hackers could forge timestamps in undetectable ways. The analysts also noted that repeated access to the drive resulted in logs and other files used by forensic analysts to examine system activity being deleted. Neither analyst found evidence emails or other files had been manipulated by hackers, nor could they rule out that possibility.[4][62]
In reference to a cache of emails allegedly coming from the Hunter Biden Laptop, Matt Tait, a former information security specialist for the GCHQ (UK's Government Communications Headquarters), told CyberScoop, "it is clear the cache isn't in its original form".[63][64][65]
In November 2022, CBS News published the results of a forensic analysis they commissioned of a copy of the laptop data Mac Isaac initially handed to federal investigators in 2019. The analysis, conducted by Computer Forensics Services, found data, including over 120,000 emails, "consistent with normal, everyday use of a computer", found "no evidence that the user data had been modified, fabricated or tampered with", and found no new files created on the laptop after April 2019, when Mac Isaac received the laptop. The chief technology officer of Computer Forensics Services added: "I have no doubt in my mind that this data was created by Hunter Biden, and that it came from a computer under Mr. Biden's control".[3] Also on November 21, CBS News published the first photograph of the damaged Macbook Pro, which had been provided to them by Hunter Biden's legal team.[3]
According to reports on January 16, 2024, new filings by the U.S. Department of Justice's special counsel, headed by David C. Weiss, appear to be the first public confirmation of the laptop's authenticity by the DOJ. The filings refer to the laptop connected to Hunter Biden stating, “the defendant’s Apple MacBook Pro, which he had left at a computer store.”[66]
