A cyber forensics expert commissioned by the Washington Examiner recovered over 168,000 deleted files from a copy of Hunter Biden’s abandoned laptop.
Many of the deleted files were system files, application files, or duplicates of user files stored elsewhere on the laptop.
Some of the recovered data, however, shed light on his financial dealings in 2018 and early 2019, as well as his personal dealings during that time frame. Also recovered from the drive were deleted pictures of government ID cards for two individuals linked to President Joe Biden’s son.
Konstantinos “Gus” Dimitrelos, a former Secret Service agent who has testified in over 100 classified, criminal, and civil matters, retrieved the deleted files from unallocated space on the hard drive using a technique called data carving.
The existence of recoverable deleted user files adds another layer of authenticity to the hard drive, Dimitrelos said.
“In order for user-created data — including personal photographs, bank records, invoices, business records, third-party data such as the driver’s licenses of other persons, chat conversations, and medical records, as examples — to exist within the unallocated hard drive space, the computer user would have had to manually delete the files,” Dimitrelos said. “Any Robert Hunter Biden recovered files in unallocated space was there as a result of deletions by the user ‘roberthunter.’”
Dimitrelos has examined the Washington Examiner’s copy of the hard drive and determined with 100% certainty that Hunter Biden “was the only person responsible for the activity on this hard drive and all of its stored data.”
Many of the recovered user files were attachments to text messages that Hunter Biden sent to or received from his associates. The text messages contain markers indicating that an attachment was deleted.
One of the recovered text attachments was a selfie he took in which he can be seen holding a vape pen. He attached the photo to a message sent to an unknown person Jan. 30, 2019.
“That’s the weed vape pen that a Russian Escort left in my room before I came here this time,” Hunter Biden texted them.
A report by Republican senators in 2020 concluded Hunter Biden paid “nonresident women” who were “nationals of Russia or other Eastern European countries” and who appeared to be linked to what records indicated was an “Eastern European prostitution or human trafficking ring.”
Hunter Biden also received an invoice from his psychiatrist, former Fox News contributor Keith Ablow, showing he had racked up $13,600 worth of psychotherapy charges in November and December 2018. Hunter Biden had requested that Ablow send him the invoice in a Dec. 10, 2018, text.
Hunter Biden’s legal team told CBS News in May that it obtained a laptop he left at Ablow’s office in February 2019. It says the laptop is “the Rosetta Stone” that can prove if copies of Hunter Biden’s drive that have circulated through the media have been altered. But the copy of the drive obtained by the Washington Examiner has user files dating through March 17, 2019.
Dimitrelos also recovered numerous deleted screenshots of text message conversations with Hunter Biden’s ex-wife, Kathleen Buhle.
One of the screenshots shows that Hunter Biden wired $2,900 to Buhle through Apple Pay on April 19, 2018. He sent Buhle the screenshot later that day after she suggested he hadn’t sent the payment.
Another recovered screenshot is a message from Buhle’s phone showing that David Barboza of the New York Times had reached out and asked her: “I wonder if I can call you about a story I am writing about a Chinese company you may have heard about. I don’t know that you know for sure. But someone suggested I ask you.”
It’s not clear exactly when Barboza contacted Buhle or when she forwarded the screenshot to Hunter Biden.
Hunter Biden’s lawyer George Mesires texted him Dec. 4, 2018, warning him Barboza had indicated to him that the New York Times would be running a story about his involvement with the now-defunct Chinese energy conglomerate CEFC in the coming days.
“No reference to Joe Biden specifically relative to CEFC’s efforts,” Mesires informed the president’s son.
The New York Times published a December 2018 story, for which Barboza was a co-author, that focused on CEFC and its leader at the time, Ye Jianming. Buhle was not quoted in the article.
Hunter Biden was paid millions by CEFC as he attempted to work out business deals with them.
Tony Bobulinski, Hunter Biden’s former business associate, released a separate trove of WhatsApp text messages in October 2020 not found on the laptop that show the pair discussing meetings involving Joe Biden and CEFC in May 2017. The president has denied ever speaking with his son about his overseas business dealings.
Hunter Biden was given a $1 million retainer to represent Ye’s deputy, Patrick Ho, who was eventually sentenced to three years in prison in March 2019 for violating the Foreign Corrupt Practices Act. Ho was deported to Hong Kong in June 2021 after serving his sentence.
Ye has since disappeared in China, and Chinese state-run media named him in an alleged corruption case in 2018. China allowed CEFC to go bankrupt.
Another recovered record shows Hunter Biden was notified by his assistant, Katie Dodge, that Bank of America had notified him on Feb. 4, 2019, that his scheduled credit card payment had been returned unpaid.
“Please give me a call to let me know how payments should proceed please,” Dodge texted Hunter Biden on Feb. 14, 2019, after texting him the notice from Bank of America.
These files were recovered just over two months after former Steve Bannon adviser Jack Maxey claimed he had recovered “450 gigabytes of erased material” from his copy of the abandoned laptop. Dimitrelos said his recovery and analysis of deleted data is ongoing but that it would “not be possible” for 450 gigabytes of deleted files to be retrieved from the laptop, as the system was only capable of storing a maximum of 234 gigabytes in the user volume.
Not all deleted files on the drive were able to be recovered.
Among the more notable nonrecoverable deleted files was a screenshot Joe Biden texted his son March 6, 2019. Joe Biden was not yet president. The file name of the screenshot suggests it was taken from Signal, an encrypted messaging application. The father-son text exchange has been previously reported, but the attachment being unrecoverable is new.
“What would you like me to do. Dad,” Joe Biden texted his son after sending the screenshot.
Hunter Biden then responded to his father with a lengthy text message about his falling out with his former business partner Eric Schwerin.
The next day, Joe Biden offered to help his son with his troubles with Schwerin.
“Can i help with Eric,” he texted Hunter Biden. “I have absolutely no hesitancy.”
The younger Biden responded, “I’ll handle Eric.”
Dimitrelos explained that the Signal file Joe Biden texted his son is not recoverable because it may have been overwritten by new data after deletion.
“There are many attachments, screenshots, and other identified files which are not recoverable,” he said. “This is because unallocated space becomes free space for new files to be copied to, thus overwriting the previous file data.”
Of the aforementioned ID cards, the first recovered was a picture of a woman holding up her California ID, showing she was slated to turn 21 in 2019.
The woman, Joanna Rush, texted the image to Hunter Biden on Nov. 22, 2018, less than two hours after he requested that she call him. Other text messages on the drive show Hunter Biden was engaged in a sexual relationship with Rush. She did not respond to a request for comment.
The second was a picture of the driver’s license for Richard McCray, a Virginia Lyft driver who got in a car crash with Hunter Biden on Feb. 6, 2019. McCray had texted Hunter Biden a picture of his license as well as a picture of the Hertz vehicle incident report he had filled out after the accident. McCray declined to comment without personal confirmation from Hunter Biden that the reporter reaching out to him was who he said he was.
Hunter Biden’s attorneys, Mesires and Chris Clark, did not return a request for comment.