Forensic analysis
In March 2022, The Washington Post published the findings of two forensic information analysts it had retained to examine 217 gigabytes of data provided to the paper on a hard drive by Republican activist Jack Maxey, who represented that its contents came from the laptop. One of the analysts characterized the data as a "disaster" from a forensics standpoint. The analysts found that people other than Biden had repeatedly accessed and copied data for nearly three years; they also found evidence others had written files to the drive both before and after the October 2020 New York Post reports. In September 2020, someone created six new folders on the drive, including with the names "Biden Burisma," "Salacious Pics Package" and "Hunter. Burisma Documents." One of the analysts found evidence someone may have accessed the drive contents from a West Coast location days after The New York Post published their stories about the laptop.
Using cryptographic signatures, the analysts were able to verify that from 1,828 to nearly 22,000 emails Biden had received came from the indicated email accounts of origin, suggesting they were authentic and had not been tampered with. The analysts said emails from Burisma, where Pozharskyi was an advisor, were likely authentic, but cautioned that if Burisma had been hacked, it would be possible for hackers to use stolen cryptographic signatures to forge emails that would pass as authentic. The New York Times reported in January 2020 that Russian military intelligence had hacked Burisma beginning in November 2019; a co-founder of the firm that discovered the hacking said Russians were stealing email credentials. Both analysts acknowledged that cryptographic signatures are not a perfect way to authenticate emails, as some email services do not implement the technology as rigorously as others. About 16,000 of the 22,000 emails carrying cryptographic signatures came via Google, which rigorously implements the technology. The analysts noted that cryptographic signatures can only verify that an email originated from a certain email account, but not who controlled that account; there are other means for hackers to commandeer email accounts of others.
One of the analysts found that timestamps on documents and in operating system indexes matched, though he noted hackers could forge timestamps in undetectable ways. The analysts also noted that the drive had been handled in such a way that logs and other files used by forensic analysts to examine system activity had been repeatedly deleted. Neither analyst found evidence emails or other files had been manipulated by hackers, nor could they rule out that possibility.[12][49]
An analysis by Distributed Denial of Secrets of 128,755 emails allegedly copied from the laptop and circulated by allies and former staff of President Donald Trump showed "signs of tampering" including 145 modification dates and emails created more than a year after Hunter Biden allegedly had the laptop.[50][51] Matt Tait, a cybersecurity expert and former information security specialist for the U.K.’s Government Communications Headquarters, reviewed the analysis and said "it is clear the cache isn’t in its original form
