iPhone and MacBook Forensics Investigation Exposes £113,000 Property Fraud Operation

A digital forensics investigation from Belkasoft into an iPhone and a damaged MacBook has helped secure the conviction of Jason Cunningham, a rent-to-rent property operator who defrauded landlords and investors of more than £113,000 through forged contracts and false promises.

Cunningham ran several companies in the rent-to-rent sector, leasing properties from landlords and subletting them as houses in multiple occupation (HMOs) or serviced accommodation. While the model is legitimate, he used it to con victims while cultivating an image of jet-setting success.

“He styled himself as a multi-millionaire, jet-setting business guru, with regular trips to Dubai,” said Mark Morris, digital forensic expert at Aardvark Forensics. “He scammed both landlords and tenants with forged documents and, when challenged by his victims, he would attempt to play them off against each other and threaten litigation.”

Acquiring Data From a Broken MacBook

Following the defendant’s arrest, Morris was instructed to examine two seized devices: an iPhone and a MacBook with a non-functioning screen and keyboard.

To access the MacBook, Morris connected it to an external monitor and keyboard via a powered docking station, then created a Time Machine backup to an external hard drive, processed using Belkasoft X. AweClone software provided a secondary Mac-to-Mac acquisition, maximizing data recovery from the compromised device.

The iPhone was acquired via a local iTunes-format backup, also processed entirely within Belkasoft X.

Belkasoft X allowed Morris to examine and correlate data from both devices simultaneously, since communications and documents spanned both sources. Keyword searches across WhatsApp, iMessage, and SMS/MMS artifacts revealed the extent of the fraud, while date-filtering isolated communications matching specific transaction periods.

Documents purporting to record agreements with landlords and tenants didn’t align with witness timelines. “The digital material recovered from the MacBook and iPhone was considered alongside bank records and witness evidence,” Morris said. “Taken together, that material did not support the existence of a genuine or legitimately operating business.”

Cunningham’s defense argued a successful businessman had no motive to defraud. Forensic evidence dismantled this: financial flows revealed that stolen money, not legitimate profit, funded leased Lamborghinis, five-star hotels, and private jet travel. Over £100,000 has already been recovered from identified bank accounts, with Proceeds of Crime Act inquiries ongoing.

Court exhibits included documents, message printouts, photographs, and financial flow analysis, presented to a jury across a nine-week trial involving over 30 witnesses. Cunningham was convicted on two counts of fraudulent trading and five counts of using a false instrument, and jailed in November.

Morris also highlighted AI’s emerging impact on digital forensics, referencing BelkaGPT, Belkasoft’s new AI feature. It describes images, extracts text from scanned documents, and transcribes audio/video, turning visual and spoken evidence into searchable text alongside chats and emails.

In fraud cases, this means investigators can query evidence using natural language like “find images of luxury vehicles” or “show conversations about investor payments,” surfacing connections traditional keyword searches might miss.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.