Case Study: Belkasoft X Helps Unmask Property Fraud Mastermind
How digital forensics exposed a lifestyle built on stolen money and secured a conviction
Background
Jason Cunningham operated several companies in the rent-to-rent property sector, leasing properties from landlords and subletting them as houses in multiple occupation (HMOs) or serviced accommodation. While the business model itself is legitimate, Cunningham used it to defraud both landlords and aspiring property investors using forged contracts and false promises, ultimately causing losses exceeding £113,000.
"He operated out of a premises in Newbury, about 300 yards away from my office! He styled himself as a multi-millionaire, jet-setting business guru, with regular trips to Dubai. He also made podcasts and advertised how he could train people to gain easy and quick wealth, even having his own boastful website."
He scammed both landlords and tenants with forged documents and, when challenged by his victims, he would attempt to play them off against each other and threaten litigation for breach of contract and libel."
— Mark Morris, digital forensic expert at Aardvark Forensics
The investigation: Devices, data, and a broken MacBook
Scope of the digital examination
Following law enforcement attendance at several properties and the arrest and seizure of devices, Mark Morris of Aardvark Forensics Ltd was instructed to carry out digital forensic analysis. The devices of primary relevance to the defendant were two: an iPhone and a MacBook whose internal display and keyboard were no longer functioning.
Acquiring data from a broken MacBook
The damaged state of the MacBook presented an immediate practical challenge. With no working screen or keyboard, standard operation was impossible. The solution was pragmatic and methodical:
- The MacBook was connected to an external monitor and keyboard via a powered docking station, enabling it to be operated sufficiently to create a Time Machine backup to an external hard drive.
- That backup was preserved and processed using Belkasoft X.
- As a secondary acquisition method, AweClone software was used via a Mac-to-Mac connection to recover additional data from the device.
The deliberate use of two independent acquisition methods maximised data recovery and ensured the preservation of the widest possible range of relevant material—a sound evidential strategy in any forensic examination where device integrity may be in question.
Acquiring data from the iPhone
Belkasoft X was used to acquire a local iTunes-format backup of the iPhone. The acquired backup was then processed and examined entirely within Belkasoft X, enabling analysis of the device's data in a forensically sound manner.
iOS device acquisition methods in Belkasoft X
The role of Belkasoft X in the investigation
Unified examination of multiple devices
One of the most operationally significant features of Belkasoft X in this case was its ability to examine and correlate data from both the iPhone and the MacBook within a single platform. Rather than treating each device in isolation, the examiner could consider messaging artifacts, documents, and file system data across both sources simultaneously.
This unified approach was particularly important because communications and documents often spanned both devices, and the evidential picture only became clear when data points from both sources were viewed together.
Artifact extraction and keyword searching
Relevant messages were recovered through artifact extraction from both the MacBook data and the iPhone backup. The principal messaging platforms identified were WhatsApp and Apple Messages—including iMessage and SMS/MMS communications.
Keyword search across all artifact types was the primary technique used to reveal the extent of the various fraudulent operations. It helped identify the communications and documents that confirmed what complainants had alleged, forming the evidential backbone of the prosecution.
Filtering and timeline analysis
The ability to filter messages by date parameters proved particularly useful. In fraud cases where large volumes of communications are involved, the capacity to isolate communications within specific time windows—matching the periods when alleged transactions and deceptions occurred—significantly streamlines the review process and reduces the risk of examiner error or fatigue.
Forged documents
The investigators were also provided with documents, which Jason Cunningham purported to record agreements or contractual arrangements with landlords and tenants.
However, the content of the documents did not align with the witnesses' descriptions of the timing. Provenance and consistency of the documents with other recovered data were examined, and the digital material was considered alongside bank records and testimony.
"The conclusion that the documents were forged arose from a combination of evidence types. The digital material recovered from the MacBook and iPhone was considered alongside bank records and witness evidence. Taken together, that material did not support the existence of a genuine or legitimately operating business consistent with the representations made by Jason Cunningham or his companies."
— Mark Morris, digital forensic expert at Aardvark Forensics
Disproving the defence
Cunningham's defence rested on the proposition that a successful businessman would have no rational motive to defraud. The digital evidence examined through Belkasoft X directly undermined this claim.
The examination made it possible to demonstrate to the court that Cunningham's high-end lifestyle was not funded through legitimate and successful business dealings. The financial flows revealed through the digital artifacts, combined with bank records, told a different story: one in which stolen money financed the facade of success.
Dogged examination of his iPhone, MacBook and bank accounts proved to the jury that it was stolen money that funded the leases of the Lamborghinis, five-star hotel stays and private jet travel. Over £100,000 has already been recovered from bank accounts identified during the investigation, and Proceeds of Crime Act enquiries are ongoing.
Presenting evidence in court
The evidence used in court comprised documents, message printouts, colour photographs, and financial flow analysis. Over 30 witnesses gave evidence against Cunningham, including individuals who returned to the UK from abroad to attend the trial.
The ability of Belkasoft X to produce clear artifact outputs enabled the preparation of court-ready exhibits in a format accessible to a jury, counsel, and the judge.
Creating a report for selected iMessages in Belkasoft X
Cunningham was found guilty of two counts of fraudulent trading and five counts of using a false instrument, following a nine-week trial, and was jailed in November.
Looking ahead: AI-assisted forensic analysis
This case also speaks to the evolving role of artificial intelligence in digital forensics. Morris notes that in a concurrent large-scale commercial matter involving very high volumes of public-domain data, AI played a significant role in the analytical stage—materially reducing review time, highlighting risks, and streamlining complex processing tasks.
"It is therefore exciting to see that Belkasoft X has now introduced BelkaGPT, which has the potential to take an already powerful tool to the next level. It was only in 2022 that AI was not considered reliable at basic mathematics, yet today it can be used to reliably automate data processing, recognize patterns that a human might miss, and perform consistent and fast analysis—reducing the risk of human error and countering operator fatigue."
— Mark Morris, digital forensic expert at Aardvark Forensics
BelkaGPT extends digital forensic examiners’ capabilities by describing images, extracting text from photographs and scanned documents, and transcribing audio and video recordings. This way, it transforms visual and spoken evidence into searchable text alongside emails, chats, and other digital artifacts.
BelkaGPT helps find relevant evidence in various artifact types, including media files
In financial fraud investigations, these capabilities are particularly valuable. Suspects often exchange photographs of contracts, invoices, bank statements, receipts, identification documents, and expensive purchases through messaging apps, while also relying on voice messages for everyday communication.
Once converted to text, the evidence becomes accessible through both keyword and natural-language searches. Investigators can ask questions such as "Show me conversations about investor payments," "Find images of luxury vehicles or watches," or "Identify voice messages discussing rental income or deposits." Because semantic search understands meaning rather than relying solely on exact word matches, it can reveal relevant evidence and connections that traditional searches might overlook.
Conclusion
The conviction of Jason Cunningham demonstrates the power of methodical digital forensic examination in dismantling a sophisticated fraud operation. Behind the carefully constructed image of legitimate entrepreneurial success lay a pattern of deception sustained by forged documents, misleading communications, and stolen money.
Belkasoft X provided the analytical platform through which that deception was exposed: enabling unified examination of multiple devices, systematic keyword and timeline-based review of communications, and the extraction of artifacts that—in combination with bank records and witness evidence—proved beyond a reasonable doubt that Cunningham's lifestyle was funded not by business success, but by fraud.
Over £100,000 has already been recovered. POCA proceedings continue.