The final results of the NFS's examination of Choi Soon-sil's tablet PC, which was obtained and reported by JTBC last year, have been released. The NFS notified the court of its conclusion that “there was no tampering with or modification of the tablet PC.” Based on the whereabouts of the tablet, the statement of former secretary Chung Ho-sung, and the classified information saved on the device, the NFS finally confirmed the prosecution's conclusion that Choi Soon-sil was the actual user.

The so-called “tablet PC fabrication theory,” whereby Ms. Choi claimed having never seen or used a tablet, has been circulating from pro-Park organizations to far-right media to political circles for the past year. Not only JTBC, but prosecutors, courts, the Korea Institute of Digital Forensics, and now the National Forensic Service have proven that this is not true.

A number of files created and modified from October 18, 2016, to October 31, 2016, were found, indicating that the integrity of the entire tablet PC was not maintained after October 18, 2016... However, in the case of the assessed tablet PC, the integrity of the entire tablet PC is easily compromised because a large number of files are created and modified just by booting the tablet PC. So, it is necessary to check the integrity of the file unit related to the case, the hash value of the file, and the relevance of file-related information (download log, email log, temporary file (cache) data, time information on the file system, etc.). 

While JTBC and the prosecution claim that these files are 100% the result of automatic updates when the device is turned on, Na Gi-hyun, a researcher at the NFS who wrote the forensic report, testified in court that he could not rule out the possibility of artificial manipulation. 

Question (Choi Soon-sil's attorney) : So you're saying that someone operated the user application, not the automatically updated application, when the device was turned on?

Answer (Researcher at the NFS) : Yes, there were such things, and there were also files that were just created when the application was newly configured, so yes.

.....

Q : So there's also the possibility that someone did this update at a certain time, or opened that file, or changed something.

A : I think that's a possibility. That's something that, like I said, I'd have to open them up and look at them, and that's something that I can't really comment on at this point.

Given that the Google account registered on the forensic tablet PC was registered and used on multiple devices and that the assessed tablet PC was accessed by multiple Google accounts, it is possible that it was used by multiple users. However, given that a single Google account can be registered on multiple Android devices, a single KakaoTalk account and phone number were found, and location information (GPS) was found at a specific location on a specific date, it cannot be ruled out that it was used by a single user with access to multiple Google accounts. For the above reasons, it is difficult to determine whether the tablet PC was used by a single or multiple users based on the analysis results presented above. 

Q(Choi Soon-sil's lawyer) : (On the same day that JTBC received the NFS report, it was widely reported that "NFS has also confirmed that it is Choi Soon-sil owns the tablet." Did NFS confirm that it was 'Choi Soon-sil's tablet' in its report?) What I'm asking is, did you report that the tablet in this case was Choi Soon-sil's tablet, or did you ever confirm it? 

A(Researcher at the NFS) : No. 

Q : No. Why were you not able to identify it as Choi Soon-sil's tablet? Answer: (...) In terms of the user side, it's something that has to be determined by the judge after looking at the materials, but it's not something that we can determine based on the materials.

Q : So there were no records that would lead you to believe that the tablet belonged to Choi Seowon. 

A : That's what we described in our report.

Q : That's all there was, no trace, no record of anything specific.

A : Yes, if there were anything that could be identified, we would have written it down, but for now, you can take it as what we wrote in our report.

The date of the court testimony by Na Gi-hyun, a researcher at the NFS, is May 23, 2018. The next day, the 24th, an arrest warrant was requested for Mr. Byun. The court reviewed Mr. Byun's arrest warrant on the 29th, and he was detained on the 30th.

According to the results of the NFS's report, ... it is concluded that it is difficult to believe that the contents of the tablet in this case were fabricated or tampered with.

The tablet, in this case, was examined by the NFS (including whether the storage records were altered), and it was determined that the contents of the tablet, in this case, were not tampered with.