A MacBook with a dead screen and keyboard, together with the suspect’s iPhone, provided evidence used to convict UK rent-to-rent property fraudster Jason Cunningham. The devices were examined with Belkasoft X during an investigation led by Trading Standards. Cunningham took more than £113,000 from 15 victims and was sentenced to four and a half years in prison at Reading Crown Court in November 2025.
Mark Morris, a digital forensic expert at Aardvark Forensics, examined the devices using Belkasoft X. His findings were considered alongside bank records and witness testimony.
A Property Sourcing Scheme Built on False Promises
Cunningham operated several property sourcing businesses from premises in Newbury. He persuaded investors to pay non-refundable fees to find properties for rent-to-rent serviced accommodation. Many proposed deals collapsed, and he refused to refund the fees. He also used forged documents and tenancy agreements to mislead investors and landlords.
Cunningham presented himself as a wealthy business guru, recording podcasts and promoting ways to get rich quickly. When victims challenged him, he played them off against one another and threatened legal action.
“He operated out of a premises in Newbury, about 300 yards away from my office! He styled himself as a multi-millionaire, jet-setting business guru, with regular trips to Dubai.”
Mark Morris, digital forensic expert at Aardvark Forensics
After a nine-week trial, a jury found Cunningham guilty on August 6, 2025, of two counts of fraudulent trading and five counts of using a false instrument.
Acquiring a MacBook With a Broken Screen and Keyboard
Investigators seized devices from several properties. Two devices mattered most: an iPhone and a MacBook whose display and keyboard no longer worked.
- Broken MacBook. Morris connected the MacBook to an external monitor and keyboard through a powered docking station. This allowed him to operate the laptop and create a Time Machine backup on an external hard drive. He processed the backup in Belkasoft X and used AweClone through a Mac-to-Mac connection as a second acquisition method.
- iPhone. Belkasoft X acquired and examined a local iTunes-format backup.
- Search and filters. Keyword searches across WhatsApp, iMessage, and SMS/MMS surfaced messages that confirmed the complainants’ accounts. Date filters isolated the periods of the alleged transactions.
- Court exhibits. Belkasoft X reports helped present selected artifacts in a format that the jury, counsel, and judge could follow.
What the Evidence Proved
The defense argued that a successful businessman would have had no reason to commit fraud. The evidence presented at trial challenged that account. Digital material, bank records, and testimony from more than 30 witnesses showed that money obtained through the fraud paid for leased Lamborghinis, five-star hotel stays, and private jet travel.
Investigators also examined documents Cunningham presented as agreements with landlords and tenants. Their contents did not match witnesses’ accounts of when the agreements had been made.
“The conclusion that the documents were forged arose from a combination of evidence types. The digital material recovered from the MacBook and iPhone was considered alongside bank records and witness evidence.”
Mark Morris, digital forensic expert at Aardvark Forensics
Lessons for Digital Forensic Examiners
The case offers two practical lessons for examiners working on fraud investigations:
- A damaged laptop can still be acquired. An external monitor, keyboard, and docking station were enough to create a full backup. A second acquisition method provided a cross-check.
- Related devices belong in one case. The phone and the laptop each held part of the record. Examined together, they showed the full timeline.
Morris also sees a role for BelkaGPT, the offline AI assistant in Belkasoft X, in future fraud cases. It extracts text from photos and scanned documents, so photographed contracts and invoices become searchable alongside chats and emails.
What Happens Next?
The court set a confiscation timetable under the Proceeds of Crime Act 2002. Compensation for victims will be decided after confiscation proceedings conclude.
The full case study, with screenshots of each step, is available on the Belkasoft website. Examiners who want to test Belkasoft X on their own evidence can request a free trial.
About Belkasoft
Belkasoft is a global provider of digital forensics and incident response software. Law enforcement agencies, government bodies, and corporate security teams around the world use Belkasoft products to acquire, analyze, and report on digital evidence.
