Gus Dimitrelos Deleted Files Report REDACTED - 1

1.
My name is Konstantinos “Gus” Dimitrelos, I am over eighteen years of age and have
personal knowledge of all facts and circumstances set forth herein.
2. I have reviewed a hard drive provided to me by Washington Examiner Investigative
Reporter Andrew Kerr.
3. I am a retired US Secret Service agent and began cyber forensics in 1996 getting certified
by the Royal Canadian Mounted Police and US Treasury CIS2000 program.
4. In addition to 11 other Secret Service agents, I was the first in the United States to
become certified as a computer forensics specialist and have been conducting forensics
examinations while employed or contracted by various government agencies and in the
private sector continuously for 26 years.
5. While in the US Secret Service (USSS) I performed numerous cyber investigations and
was a USSS lead investigator for the Canadian/USA Northeast Blackout of 2003 and
Technical Security Coordinator for the 2002 Salt Lake City Winter Olympics.
6. I am certified in International, US Federal and US State Courts as a Digital Evidence
Forensic Expert.
7. I have been contracted since 2007 by the US Department of Justice-US Attorney’s Office
(DOJ-USAO) to conduct cyber investigations and cyber and cellular forensics and
collect, examine, investigate and testify in cyber and cellular cases for all federal
agencies and more than 40 state and local police departments.
8. I have conducted more than 3,000 forensics exams, trained over 2,000 law enforcement
personnel and have testified more than 100 times in state, federal, international courts and
depositions.
9. I am certified in US Federal and US State Courts as an Expert in Cellular Historical Data
Reconstruction (Cellular Triangulation) which is the analysis of Call Detail Records.
10. I have performed thousands of Call Detail Records Examinations from all major
providers including TMobile, Verizon, AT&T, Sprint and others.
11. I am certified in US Federal and US State Courts as an Expert Geo-location evidence
from photographs, GPS units, vehicles, social media and other location based
technologies.
12. I conduct network-based forensics and data breach investigations in various environments
Cyber Forensics, Inc - CyberForensics.com - EIN 82-2561188 - DUNS 080902944 - CAGE 7Z4P4 1
including Linux, PC and macOS environments.
13. I am a Certified Ethical Hacker and perform penetration testing and vulnerability
assessments.
14. I am an instructor for the Regional Counterdrug Training Academy and authored the
Cellular Triangulation and Mobile Device Forensics course for Law Enforcement which
focuses on Call Detail Records analysis for all major providers and mobile device
forensics on Android and iOS devices.
15. I am a US Department of State contracted lead instructor, course developer and cyber
program coordinator for the Global Cyber Anti-Terrorism Assistance program (GATA).
16. I perform cyber forensics, mobile device forensics and/or cellular triangulation services
for corporations including Toyota Tsusho of America, DHL, State Farm and Allstate.
17. I have attached my current Curriculum Vitae to this Affidavit report.
Cyber Forensics Request Background

18. On April 5, 2022 I received an unsolicited request for forensics services from Washington
Examiner Investigative Reporter Andrew Kerr.
19. On June 1, 2022 I conducted a data deletion analysis per a request by the Washington
Examiner.
20. A macOS operating system contains a path named ‘Trash’ which is used similar to the
Windows Recycle Bin. Files put into Trash are not permanently deleted therefore, a copy
of the file moved to the Trash still exists in allocated space and can simply be ‘Put Back’
by opening the Trash icon and moving the file from the Trash.
21. During my analysis of the RHB MacBook Laptop I identified there were no files located
in Trash but thousands of files were recovered in the hard drive Unallocated space.
22. Since user created or saved files including email, photographs, business records, banking
records, etc., exist in the RHB MacBook Laptop hard drive Unallocated space and not in
Trash, this would mean actual files would have to have been manually deleted and
emptied from Trash or bypassed Trash.
23. The computer user has options to empty Trash or to Delete a specific file permanently
using several options including:
○ Empty the Trash
○ Press Option + Command (⌘) + Delete

○ Go to File and choose Delete Immediately
24. All of the Deletion methods demonstrate control of the Laptop and the Files being
deleted.
25. As stated, once Trash is emptied or a specific file is deleted permanently the file is sent to
the Unallocated partition instead of remaining in Allocated space and folders as shown
below.
26. In order to recover deleted files located in the unallocated space, a cyber forensics
examiner must have physical level access not logical access to the hard drive.
27. A total of 5,959,863 files or artifacts existed on the Robert Hunter Biden hard drive and a
breakdown of the file categories and file quantities are shown below.
28. Using the technique named Carving, I was able to carve out (recover) thousands of files
located in the unallocated space on the RHB MacBook Pro Laptop.
29. The files and data shown in this report were recoverable however, there are many
attachments, screenshots and other identified files which are not recoverable. This is
because Unallocated space becomes free space for new files to be saved to, therefore
overwriting any previous file data.
30. As requested by the Washington Examiner the request was to specifically identify files
which were created and/or modified and/or saved and then deleted by Robert Hunter
Biden.
31. This request further verifies the person using the MacBook Pro laptop was in fact RHB
and is the only person using the laptop to save and later delete user specific files and data.
32. One such example is the below Ritz-Carlton hotel reservation made by Mr. Hunter Biden.
/roberthunter/Library/Mail/V6/71BA9E8B-8351-4053-88F6-3A2F8DC2E4E1/INBOX.m
box/E9273EF6-B8ED-4DF2-A955-34538DD822C2/Data/3/Messages/3591.partial.emlx»
Hudson West 01152018.pdf»Carved [2354231].jpeg
33. The following pages reflect files and unique user data and files which were deleted by the
MacBook user and owner RHB and then recovered through data carving in the hard drive
Unallocated space. If recoverable, the file information will include the file name and the
original file path location but will not contain a date of deletion..
34. Additionally, the recovered Unallocated files also have an association to data and/or files
currently located in Allocated space.
35. One example is a chat conversation with Mark O’Malley wherein Hunter identified Keith
Ablow as his Therapist.
36. Also, email communications with Keith Ablow and the Practice Manager correlate with
the Carved bill located below.
○ /roberthunter/Library/Messages/Archive/2018-12-10/+1 on
2018-12-10 at 10.03.27.ichat»Carved [9762].pdf
37. Numerous Chat conversations with various persons also confirm Robert Hunter Biden is
in control of the MacBook Laptop and deleting selective conversations.
○ /roberthunter/Library/Messages/Archive/2018-12-20/Kath Biden on 2018-12-11
at 10.17.52.ichat»Carved [17323].jpeg
38. The below screenshot appears to have been sent from David Barboza to Buhle Biden and
then forwarded to RHB
39. The David Barboza chat conversation regarding the New York Times also corresponds to
a message George Mesires texted Hunter Biden on Dec. 4, 2018.
40. The deleted screenshot of an Apple Pay transaction correlates with an existing
conversation between Hunter and Kathleen regarding the $2,000.00 payment.
41. Similar to other banking transactions or notifications, the below screenshot was shared
with Katie Dodge in a chat conversation and later deleted.
○ /roberthunter/Library/Messages/Archive/2019-02-14 gmail.com on
2019-02-13 at 11.16.27.ichat»Carved [5514].jpeg
42. There are thousands of payments located in the ‘roberthunter’ user account which were
saved and not deleted. There were additional financial transactions including the below
invoice and corresponding check copy.
○ /roberthunter/Library/Mail/V6/71BA9E8B-8351-4053-88F6-3A2F8DC2E4E1/IN
BOX.mbox/E9273EF6-B8ED-4DF2-A955-34538DD822C2/Data/3/Messages/35
91.partial.emlx»Hudson West 01152018.pdf»Carved [2910721].jpeg
○ /roberthunter/Library/Mail/V6/71BA9E8B-8351-4053-88F6-3A2F8DC2E4E1/IN
BOX.mbox/E9273EF6-B8ED-4DF2-A955-34538DD822C2/Data/3/Attachments/
3591/2/Hudson West 01152018.pdf»Carved [3170236].jpeg
43. Additional bank statements were recovered in the Unallocated space.
○ /roberthunter/Library/Mail/V6/1670BB73-9EB5-4000-83C4-3CB2E76EB29F/[G
mail].mbox/AllMail.mbox/E9273EF6-B8ED-4DF2-A955-34538DD822C2/Data/
2/3/Attachments/32420/2/H.Biden.pdf»Carved [3839].jpeg
1/8/Attachments/81222/2/Biden.pdf»Carved [3807].jpeg
44. RHB had a relationship with a person named Joanna Rush adding her to his Wells Fargo
Zelle account.
45. In addition to the above email, which is located in the roberthunter allocated partition, a
copy of Joanna Rush’s Driver License was carved from unallocated space.
/roberthunter/Library/Messages/Archive/2018-11-22/Joanna Rush on 2018-11-22 at
00.42.37.ichat»Carved [6105].jpeg
46. Further Unallocated space analysis and recovery revealed RHB was involved in a vehicle
collision with Richard McCray and there was an exchange of information and
communications regarding the collision.
○ /roberthunter/Library/Messages/Archive/2019-02-07/+1 on
47. Contracts already cited in previous findings and reports were also recovered in
Unallocated space.
4/8/Attachments/84715/2/Bres4-4PDF.pdf»Carved [507].jpeg
48. The following two recovered files demonstrate the execution flow related to this contract
which shows the receipt of the below contract and the later execution by Hunter Biden in
the following contract.
○ /roberthunter/Library/Containers/com.apple.mail/Data/Library/Mail
Downloads/7DBD0740-A6CD-49EA-AA4F-3754D4FB1AA4/Scan Nov 29,
2018 at 11.29 AM.pdf»Carved [605325].jpeg
mail].mbox/All
Mail.mbox/E9273EF6-B8ED-4DF2-A955-34538DD822C2/Data/3/2/Attachments
/23219/1/Scan 1.pdf»Carved [534].jpeg
49. The recovered image of the painting below correlates with the conversation between Kaz
Zosen.
○ /roberthunter/Library/Messages/Archive/2019-03-05/Kaz Zosen on 2019-03-04 at
23.39.07.ichat»Carved [3393843].jpeg
50. RHB had a chat conversation related to a Vape pen left in this hotel room and the
conversation is copied below unredacted and the photograph taken by Hunter Biden of
the Vape pen follows.
○ /roberthunter/Library/Messages/Archive/2019-01-30/ on
51. My analysis of the MacBook Laptop Unallocated space revealed numerous documents
identifying Hunter Biden deletion actions in conjunction with related non-deleted
conversations.
○ /roberthunter/Library/Messages/Archive/2019-02-20/George R. Mesires on
2019-02-20 at 12.14.25.ichat»Carved [51909].pdf
52. The above Quitclaim was discussed between Hunter Biden and George R. Mesires.
Expert Conclusion
Based on my previous analysis of the Allocated Partition and data contained within it as
well as this Unallocated space analysis on the MacBook Pro Laptop hard drive, I was able to
further confirm the owner and user of this laptop to be Robert Hunter Biden.
In order for user created data including personal photographs, bank records, invoices,
business records, third party data such as the drivers licenses of other persons, chat conversations
and medical records as examples, to exist within the Unallocated hard drive space, the computer
user would have had to manually delete the files. The macOS operating system does not delete
User created files or personally created data and since there were no automated wiping tools
being used by RHB, any Robert Hunter Biden recovered files in Unallocated space were there as
a result of deletions by the user ‘roberthunter’.
The files carved from the MacBook Pro Laptop hard drive Unallocated space shown in
this report are reflective of the ones still existing in the Allocated Partition, discussed in multiple
conversations, emailed as attachments, and were created, modified or saved by Robert Hunter
Biden and cited in previous reports.
Due to the number of Carved files, I will continue my analysis and may supplement this
report on a later date.
FURTHER AFFIANT SAYETH NAUGHT.
Signed this on the 7 day of June, 2022.
____________________
Konstantinos “Gus” Dimitrelos
CEO - Cyber Forensics, Inc
Retired - US Secret Service

Gus Dimitrelos Deleted Files Report REDACTED - 1

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Gus Dimitrelos Deleted Files Report REDACTED - 1

Uploaded by

Copyright:

Available Formats

1.

Cyber Forensics Request Background

○ Press Option + Command (⌘) + Delete

FURTHER AFFIANT SAYETH NAUGHT.

Signed this on the 7 day of June, 2022.

You might also like