iPhone and Broken MacBook Evidence Helps Expose £113,000 Property Fraud

Digital evidence recovered from an iPhone and a damaged MacBook helped investigators expose a property sourcing fraud that caused losses of more than £113,000.

Jason Paul Cunningham used forged documents, misleading messages, and false promises to persuade investors to pay non-refundable fees for property deals that often failed to materialize. A jury convicted him of two counts of fraudulent trading and five counts of using a false instrument.

The investigation combined messages, documents, photographs, financial records, and witness testimony. According to a Belkasoft digital forensics case study, examiners correlated evidence from both Apple devices to reconstruct Cunningham’s activities and challenge claims that he ran a successful property business.

Property investors lost more than £113,000

Cunningham operated several property sourcing businesses from premises in Craven Road, Newbury. His companies targeted people interested in rent-to-rent serviced accommodation investments.

Customers paid fees after Cunningham promised to find suitable properties and arrange deals with landlords. Many proposed deals collapsed, but he refused to return the money.

The official National Trading Standards sentencing announcement states that the fraud affected 15 victims over approximately three and a half years.

Case detail	Confirmed information
Defendant	Jason Paul Cunningham
Fraud type	Property sourcing and advance-fee fraud
Victims	15
Confirmed losses	More than £113,000
Conviction date	August 6, 2025
Sentence date	November 21, 2025
Prison sentence	Four and a half years

Investigators examined an iPhone and damaged MacBook

Police seized several devices after Cunningham’s arrest. The two devices most relevant to the forensic examination were an iPhone and a MacBook with a broken internal screen and keyboard.

The MacBook’s physical condition prevented investigators from operating it normally. Digital forensic expert Mark Morris of Aardvark Forensics connected the laptop to an external display and keyboard through a powered docking station.

This setup allowed Morris to access the MacBook and create a Time Machine backup on an external hard drive. Investigators preserved and processed that backup with Belkasoft X.

Two acquisition methods recovered MacBook data

Investigators used a second acquisition process to recover as much information as possible from the damaged laptop.

AweClone software supported a Mac-to-Mac acquisition, providing another source of data alongside the Time Machine backup. Using two methods reduced the risk that one acquisition would omit relevant files.

The recovery process included:

• Connecting the damaged MacBook to an external monitor and keyboard.
• Creating a Time Machine backup on an external drive.
• Processing the backup in Belkasoft X.
• Performing a separate Mac-to-Mac acquisition with AweClone.
• Comparing evidence recovered through both methods.

This approach allowed investigators to recover documents, communications, photographs, and file-system artifacts despite the MacBook’s damaged hardware.

The iPhone was acquired through a local backup

Investigators created a local iTunes-format backup of Cunningham’s iPhone and processed it within the same forensic platform.

The backup contained communications and other artifacts that could be compared with data recovered from the MacBook. Examining the devices together helped investigators identify conversations and documents that crossed between mobile and desktop systems.

The main sources of communication evidence included:

• WhatsApp messages
• iMessage conversations
• SMS and MMS messages
• Documents exchanged or stored on the devices
• Photographs linked to Cunningham’s activities

Keyword and date searches revealed the fraud pattern

Investigators searched the recovered data for names, properties, payments, contracts, and other terms connected to complaints from landlords and investors.

Date filters helped narrow large volumes of messages to the periods surrounding particular transactions. This made it easier to compare Cunningham’s statements with bank transfers, witness accounts, and document timestamps.

The analysis helped investigators answer several important questions:

1. What promises did Cunningham make before receiving payments?
2. Which documents did he send to landlords and investors?
3. When did property deals begin to fail?
4. How did Cunningham respond when victims requested refunds?
5. Did the device records support the existence of a genuine business operation?

The combined evidence showed inconsistencies between Cunningham’s representations and the actual operation of his companies.

Digital evidence supported findings that documents were forged

Some recovered documents purported to record agreements between Cunningham, landlords, tenants, and investors. However, their contents and timing did not match accounts provided by witnesses.

Investigators did not rely on the device records alone. They compared the files with bank records, transaction dates, witness evidence, and communications recovered from both Apple devices.

This combined analysis did not support Cunningham’s claim that he operated a genuine and successful property sourcing business. It instead showed a pattern involving forged agreements, false promises, and refused refunds.

Evidence type	Role in the investigation
Messages	Showed promises, disputes, payment discussions, and communications with victims
Documents	Allowed investigators to examine contracts and alleged agreements
File metadata	Helped establish when files were created or modified
Bank records	Showed where victim payments went
Witness testimony	Provided timelines and context for the digital evidence
Photographs	Supported analysis of Cunningham’s activities and lifestyle

Stolen money supported a luxury image

Cunningham presented himself as a successful property entrepreneur and business mentor. He promoted an image that included luxury cars, expensive hotels, private jet travel, and trips to Dubai.

His defense argued that a successful businessman would have no reason to commit fraud. Investigators responded by tracing financial flows and comparing them with evidence recovered from the devices.

The analysis indicated that money obtained through the fraudulent operation funded much of the luxury lifestyle used to support Cunningham’s public image.

Investigators linked the proceeds to:

• Leased Lamborghinis
• Five-star hotel stays
• Private jet travel
• International trips
• Promotion of Cunningham as a wealthy property expert

More than £100,000 was recovered from bank accounts

More than £100,000 had already been recovered from identified bank accounts when the forensic case study was published.

Authorities also began confiscation proceedings under the Proceeds of Crime Act 2002. These proceedings aim to recover financial benefits obtained through criminal conduct.

Compensation, legal costs, financial penalties, and the victim surcharge will be determined after the confiscation process concludes.

Cunningham received a four-and-a-half-year sentence

A jury at Reading Crown Court found Cunningham guilty after a nine-week trial involving more than 30 witnesses.

The convictions covered two counts of fraudulent trading under the Fraud Act 2006 and five counts of using a false instrument under the Forgery and Counterfeiting Act 1981.

The official account of Cunningham’s conviction and sentence also notes that he had previous dishonesty convictions and convictions for unfair trading from 2015. The judge treated that history as an aggravating factor.

Charge	Number of convictions
Fraudulent trading	Two
Using a false instrument	Five
Total guilty verdicts	Seven

Forensic reports helped present complex evidence to the jury

The trial required prosecutors to explain years of messages, transactions, documents, and business activity in a format that jurors could follow.

Investigators produced court exhibits containing message printouts, documents, color photographs, and financial flow analysis. They selected relevant material instead of presenting every item recovered from the devices.

The forensic platform generated readable reports for specific communications, including selected iMessage conversations. These reports helped counsel, the judge, and the jury follow the evidence during the lengthy trial.

Why evidence from multiple devices mattered

Messages and documents rarely remain limited to one device. A conversation may begin on an iPhone, while related contracts, images, or payment records appear on a MacBook.

Examining both sources in one investigation allowed the forensic examiner to connect evidence that might appear incomplete when viewed separately.

Cross-device analysis can help investigators:

• Find copies of messages or documents stored in different locations.
• Compare timestamps across devices.
• Connect attachments with the conversations in which they were sent.
• Identify deleted or incomplete records using another data source.
• Build a clearer timeline of transactions and representations.

The property fraud forensic investigation shows how evidence from a damaged computer can remain valuable when examiners use alternative acquisition methods.

AI could make future forensic reviews faster

Artificial intelligence did not establish Cunningham’s guilt in this case. Investigators relied on conventional acquisition, artifact extraction, keyword searches, date filtering, financial analysis, and witness evidence.

However, newer forensic tools can use AI to convert visual and spoken material into searchable text. This can help when a case contains thousands of photographs, scanned contracts, voice messages, and video files.

BelkaGPT, a feature introduced for Belkasoft X, can support tasks such as:

• Describing the contents of images.
• Extracting text from photographs and scanned documents.
• Transcribing audio and video recordings.
• Making media evidence searchable alongside messages and emails.
• Finding material through natural-language and semantic searches.

An investigator could search for conversations about investor payments or images showing luxury vehicles. Human examiners would still need to validate the results and place them within the wider evidential record.

Damaged devices can still contain critical evidence

A broken display or keyboard does not necessarily make a computer inaccessible to investigators. External hardware, backups, disk acquisition tools, and alternative connection methods may still preserve its data.

Using more than one acquisition method can also improve coverage and provide a way to confirm important findings.

The Cunningham case demonstrates that digital evidence becomes strongest when investigators combine it with independent sources. Messages and documents gained meaning when compared with bank records, witness timelines, and the financial path of victim payments.

FAQ