Stephen Bunting

---

Key findings

Affidavit Highlights:

“I agree that the information on the WD HDD [hard drive] has been altered.”

“It is a scientific certainty that data on the CF Card were added and/or modified while the CF Card was in FBI custody, specifically while signed out to Special Agent Michael Lever, the lead investigator for this case.”

Bio

Stephen Bunting served as a Captain with the University of Delaware Police from 1980 to 2009, with the last ten years of that career in digital forensics and cyber investigations. He created the digital forensics unit from its inception and ran it until my retirement in 2009. Bunting conducted hundreds of forensic examinations for numerous agencies. He was a part-time instructor during that time, 2003-2004, for Guidance Software, the makers of EnCase forensic software. He has trained hundreds of forensic examiners from federal, state, and local law enforcement agencies as well as private agencies and international police.

Since 2008, Bunting has been a contract instructor for the U.S. Dept of State Antiterrorism Assistance Program (ATA) Cyber Division. During his 15 years with ATA, he taught, as lead instructor, nearly all their cyber course offerings in well over twenty countries. He has been a mentor for ATA, as well. Currently Bunting is an embedded mentor for the Albania State Police Counter Terrorism Directorate and their Computer Audio Video Forensics Unit, having done so since 2019, and has been in country over a dozen times. One of his projects there is creating a new digital forensics lab at their Counter Terrorism Directorate.

Since retirement in 2009, Bunting has worked for Forward Discovery, which was bought out by Alvarez and Marsal. In 2013 he left Alvarez and Marsal and formed his own practice, Bunting Digital Forensics, LLC. Since 2009, his private sector duties have included forensic examinations in Medicaid fraud, intellectual property theft, email forgery, copyright infringement over peer-to- peer networks, spoliation, telecommunications fraud, malware, mobile device forensics, eDiscovery collections, Macintosh examinations, and limited criminal defense casework. Since 2013, he has been a contract instructor for MSAB in Sweden, makers of XRY / XAMN mobile device forensic software, teaching classes in the U.S. and internationally.

Bunting has received numerous certifications over the years in computer forensics, mobile forensics, and vehicle forensics. He has testified in federal and state courts and has been recognized as an expert in computer forensics at both levels. He has assisted in various phases of establishing accredited laboratories, including pre-assessment / planning, training, policy and procedure development, and mentoring. 

Bunting has written five textbooks in the field and published numerous articles. He has an in-depth knowledge of a broad range of digital forensics as well as policies and procedures on which digital laboratory accreditation is based.