I've pulled together what we can learn from the October 22, 2020 CYA memo on the Hunter Biden laptop. Hoping some tech folks, esp @malwarejake and @matthew_d_green can review it to see if they can figure out why FBI had to install laptop hard drive in new laptop to get an image of it.

https://www.emptywheel.net/2023/07/06/the-technical-oddities-of-the-fbis-exploitation-of-hunter-bidens-laptop/

The Technical Oddities of the FBI's Exploitation of Hunter Biden's Laptop - emptywheel

For some reason, the FBI deemed it necessary to buy a new laptop and install the hard drive from the laptop once owned by Hunter Biden before it could image the laptop.

emptywheel

@emptywheel @malwarejake @matthew_d_green

"FBI determined in order to do a full forensic review a replacement laptop had to be purchased so the hard drive could be installed, booted and imaged."

The instant you boot from that SSD, you've altered forensic data. Log files are added to at least, and if rotated, data may be lost before you've done a thing.

This is BASIC. What they did is clown school forensics. Did they do this themselves without cyber?

@thomasafine @emptywheel @matthew_d_green I'm trying to give this the most generous reading possible and think it's a description of a non-technical individual reciting what they saw the techies do.

@malwarejake @emptywheel @matthew_d_green
I just can't find a reading generous enough to make sense out of things.

If they were working from a disk image copy and not the original, there'd be no confusion about people needing to "buy a laptop to put the hard drive in" (from 43.d).

But 20. also is quite specific. "FBI determined in order to do a full forensic review a replacement laptop had to be purchased so the hard drive could be installed, booted and imaged".