EXCLUSIVE — A copy of Hunter Biden’s hard drive obtained by the Washington Examiner is indisputably authentic, and there is no evidence of any hacking or file manipulation, according to an examination conducted by a former Secret Service agent who has testified as a cyberforensics expert in over 100 classified, criminal, and civil matters at the state, federal, and international levels.
The Washington Examiner commissioned Konstantinos “Gus” Dimitrelos to conduct a full forensic examination to determine the drive’s authenticity and whether there were any signs of tampering. Using a technique he developed called “digital sandwiching,” Dimitrelos cross-referenced thousands of emails, documents, business records, text messages, Apple Notes, photos, geolocation data, travel records, and other information on the drive to conclude that Biden is the only person capable of producing the data.
“My analysis revealed there is a 100% certainty that Robert Hunter Biden was the only person responsible for the activity on this hard drive and all of its stored data,” Dimitrelos said, noting that his forensic techniques are reproducible and are the same that he frequently uses as an expert when working on criminal and civil cases.
“Hunter Biden’s MacBook Pro was not hacked, and the data contained on the hard drive is authentic,” Dimitrelos added. “Based on the data I examined, there was no manipulation of any photographs, emails, documents, or other user activities.”
U.S. Attorney David Weiss, the federal prosecutor for Delaware since being appointed by then-President Donald Trump in 2018, is running a federal criminal investigation into the president’s son.
In February 2021, President Joe Biden asked all Senate-confirmed U.S. attorneys appointed by Trump to resign, with Weiss in Delaware as the only exception. John Durham was asked to step down as the U.S. attorney for Connecticut but was kept on as special counsel investigating the false Trump-Russia collusion narrative.
Hunter Biden revealed he was under federal investigation for his taxes shortly after the 2020 election and is reportedly being scrutinized for possible money laundering and foreign lobbying violations under the Foreign Agents Registration Act.
Dimitrelos’s new forensic examination goes far beyond prior efforts to authenticate the drive, such as the one commissioned by the Washington Post, which relied mainly on email verification using a technology called DomainKeys Identified Mail, or DKIM.
“DKIM verification is only a portion of authenticating email integrity,” Dimitrelos said. “There were hundreds of unique identifiers showing Robert Hunter Biden is the only user of the laptop. There were also thousands of iPhone photographs and videos taken by RHB including personal ones, RHB identification cards, travel documents, credit cards, business and financial transactions.”
Hunter Biden took dozens of photos of his personal identification cards, including driver’s licenses, credit cards, his birth certificate, social security card, and his Global Entry card, and stored them on his computer. Metadata tied to the photos show they were taken by the same model iPhones that Hunter Biden had linked to his iCloud account, and emails on the drive contain receipts from Apple showing Hunter Biden paid for that same iCloud account on a monthly basis.
Records on the drive show Hunter Biden’s iCloud account was syncing his personal data with his MacBook Pro, iPhone, and iPad when the computer was last used in March 2019. Other records show Hunter Biden’s Apple ID account, which is used to sign in to all Apple services, has been associated with 46 different devices since 2011, including over 20 iPhones, eight Mac computers, nine iPads, and three Apple TVs, Dimitrelos said.
“Robert Hunter Biden received or sent hundreds of documents or transactions which confirmed he was in control of the laptop during the transactions,” Dimitrelos said. “None of the emails examined were fraudulent or altered and all are authentic and drafted, sent, and received by RHB.”
The MacBook Pro Hunter Biden used was released in 2017, meaning all documents on the drive from before that date, including those detailing his foreign business activities in Ukraine, China, and elsewhere, were synced to the laptop via the cloud either through his iCloud account or through one of the five email accounts he connected to the computer, Dimitrelos said.
Dimitrelos also authenticated Hunter Biden’s signatures on numerous signed business documents located on the drive.
“While in the U.S. Secret Service, one of my core investigative responsibilities was to examine signatures in fraud investigations,” he said. “I examined the signatures of Robert Hunter Biden located on the MacBook Pro Hard Drive and determined them to be authentic.”
One such event Dimitrelos pieced together using digital sandwiching was Hunter Biden’s stay at the Sixty Beverly Hills Hotel on June 22, 2018, when he took 24 explicit photos with an unknown woman.
Dimitrelos found the metadata attached to the photos, all of which were on the drive, show they were taken with the same iPhone X on the evening of June 22, 2018, at the same GPS coordinates of the Sixty Beverly Hills Hotel.
Further linking Hunter Biden to the hotel on June 22, 2018, was an email Wells Fargo sent to Hunter Biden’s work account four days earlier, on June 18, notifying him that the Sixty Beverly Hills Hotel had just charged him $717.04. The email contained a unique identifier from Wells Fargo confirming its authenticity, Dimitrelos said.
Text messages on the drive show Hunter Biden discussing his 25-year history of banking with Wells Fargo.
Just a week later, on June 30, 2018, Hunter Biden took a selfie in front of a mirror showing him holding the same iPhone X, demonstrating his ownership of the device used to take the photos at the Sixty Beverly Hills Hotel.
Data on the drive also show Hunter Biden’s iPhone X used an IP address consistent with AT&T, his cellular provider.
Putting all these data together proves Hunter Biden was at the Sixty Beverly Hills Hotel on June 22, 2018, and is the person responsible for taking the pictures found on the hard drive, Dimitrelos said.
The hard drive also contains hundreds of personal notes written by Hunter Biden, stored on Apple Notes and linked to his iCloud backups. An extensive list of his contacts and logins and passwords for his credit cards, bank accounts, and other accounts are among the personally identifiable pieces of information in the notes.
“The data contained within the notes are preserved and protected within the iCloud backups and are not being shared with any other persons,” Dimitrelos said. “Data within the notes is also unique to Robert Hunter Biden, which is another fact connecting the Macbook Pro Laptop to Robert Hunter Biden and only him.”
Also in the notes are email drafts discussing his business dealings that were later emailed to his associates, records on the drive show.
Dimitrelos found records on the drive indicating Hunter Biden was having technical problems with his computer in the weeks before leaving the computer at a Delaware computer repair shop.
On the computer’s desktop folder were error, system, and driver logs, the most recent generated on Feb. 2, 2019, pointing to a Wi-Fi connectivity problem. Records on the drive show the last time Hunter Biden used the laptop was on March 17, 2019, which fits when he dropped the system off at the repair shop less than a month later, on April 12, 2019.
One of the last records on the drive was a Venmo request Hunter Biden received via email from “Tony Hawk,” who was seeking $12,000 from him for “furniture” on the evening of March 17, 2019.
Dimitrelos also found documents and emails accessed after Hunter Biden abandoned the laptop in April 2019. On Sept. 1, 2020, duplicates of 123 emails found elsewhere on the drive were copied to a folder created on the desktop titled “Hunter Burisma Emails.” It’s unclear who is responsible for creating the folder and copying the emails.
“These emails are duplicates of emails located within the Robert Hunter Biden Apple Mail application which have been authenticated as being valid emails and forensically sound,” Dimitrelos said.
Dimitrelos’s analysis is a rebuke to claims the laptop and its contents are inauthentic.
Despite offering no proof, the Biden campaign, along with many in the media, dismissed the laptop story as Russian disinformation. The president called the story a Russian operation during one of the 2020 presidential debates.
He claimed: “There are 50 former national intelligence folks who said that what he’s accusing me of is a Russian plan. They have said this is, has all the — four, five former heads of the CIA. Both parties say what he’s saying is a bunch of garbage.”
The future president was referring to a report about the letter in an article titled “Hunter Biden story is Russian disinfo, dozens of former intel officials say.” The title was misleading because the letter never directly called it Russian “disinformation.”
The letter argued that “if we are right, this is Russia trying to influence how Americans vote in this election” and expressed “our view that the Russians are involved in the Hunter Biden email issue.”
Then-Director of National Intelligence John Ratcliffe said in October 2020 that there was “no intelligence” to support the laptop was Russian disinformation.
Hollywood attorney Kevin Morris, who is leading a team of 30 lawyers and investigators to probe how reporters and authorities obtained copies of Hunter Biden’s laptop, has produced no evidence that any of the files on the drive have been altered, CBS News reported on Friday.
Nicholas McQuaid, a former federal prosecutor, was appointed acting chief of the Justice Department’s Criminal Division at the start of the Biden administration. McQuaid had been a partner at Latham & Watkins with Biden defense lawyer Christopher Clark and worked on cases with him right until McQuaid took the job at the Justice Department. McQuaid is now listed as principal deputy assistant attorney general for the division.
The Justice Department hinted in February 2021 that McQuaid may have recused himself from the Hunter Biden case, but did not say so directly, when it told the Washington Examiner that McQuaid “is screened and recused from matters in which he has a financial interest or a personal business relationship, including matters involving his former law firm.”
Attorney General Merrick Garland has said the president has not interfered with the investigation and vows the Justice Department won’t improperly influence Weiss.
White House chief of staff Ron Klain said in April that “the president is confident that his son didn’t break the law.”
Clark deflected when asked substantive questions for this story.
“Why should I when you will provide me with nothing?” Clark said. “You can quote me in saying your laptop is a fraud and the fact your [sic] hiding it from verification simply proves that.”
READ IN FULL: Redacted version of Dimitrelos’s report on Hunter Biden’s hard drive
