New analysis suggests Guccifer 2.0 files copied locally, not hacked by Russia
RT | July 12, 2017
Files stolen from the Democratic National Committee (DNC) were likely downloaded to a USB drive by someone with physical access to a computer connected to the DNC network, not hacked remotely by Russia, according to a new analysis.
In an interview with Motherboard in June 2016, the hacker who claimed to be Guccifer 2.0 said he used a zero-day exploit to breach the DNC server and steal files he later published under the title “NGP-VAN.”
The leak was quickly attributed to the Russian government. However, a document published Sunday by an individual known as the Forensicator shows how the 7-zip file published by Guccifer 2.0 was transferred at a speed of 23 MB/s, making it “unlikely that this initial data transfer could have been done remotely over the Internet.”
“The initial copying activity was likely done from a computer system that had direct access to the data,” the report from the Forensicator stated. “By ‘direct access’ we mean that the individual who was collecting the data either had physical access to the computer where the data was stored, or the data was copied over a local high speed network (LAN).”
For his analysis, the Forensicator looked at the data from the 7-zip file which showed the .rar files were built on September 1, 2016, while the other files were last modified on July 5, 2016. When the .rar files are unpacked using a program called WinRAR, their timestamps were preserved from the date they were transferred.
The timestamps of those .rar files were relative times, while the times recorded in the 7-zip files are absolute times, recorded in Coordinated Universal Time (UTC). The Forensicator found that if the .rar files were adjusted to Eastern Time, they “fall into the same range as the last modified times for the directories archived in the .rar files.”
Therefore, the Forensicator concludes that the files were built on a computer system where the Eastern Daylight Savings Time (EDT) timezone setting was in force, meaning that the system was most likely located on the East Coast of the US.
The Forensicator then generated a list of the files sorted by the date they were last modified and imported the list into an Excel spreadsheet. Analyzing the files by date last modified, he observed that the last modified times were clustered together in a 14-minute time period on July 5, 2016.
The analysis of the metadata also found a majority of the time it took for the files to be copies, 12 minutes and 48 seconds of the 14 minutes and 15 seconds, was allocated to “time gaps” that appear between several top-level files and directories. The Forensicator concluded that this indicated that the files were chosen from a much larger collection of files.
Estimating the transfer speed of the files published by Guccifer, the Forensicator concluded that if the 1.98 GB 7-zip archive published by Guccifer was copied at a rate of 22.6 MB/s, and all the time gaps were attributed to additional file copying, the initial file copy would be 10 times larger, or 19.3 GB.
No comments yet.
Featured Video
Pentagon Fast Tracks Iran War Ground Option
or go to
Aletho News Archives – Video-Images
From the Archives
The Heirs of Meyer Lansky Want Compensation from Cuba. They Shouldn’t Get a Dime.
By Jack Colhoun | History News Network | June 19, 2016
Meyer Lansky
The heirs of Meyer Lansky, the impresario of the North American Mafia gambling colony in Cuba (1933-1958) are betting on a big payback from the negotiations between the United States and Cuba to normalize relations between the two countries. Compensation claims by U.S. citizens or businesses for properties nationalized by the Cuban revolution are among the issues under discussion.
Lansky’s daughter Sandi, her son Gary Rapoport, and her brother Paul have filed a compensation claim against Cuba for the Riviera Hotel and Casino with the U.S. Foreign Claims Settlement Commission. The Cuban revolution confiscated the Riviera and other Mafia-owned properties after it toppled the gangster-linked regime of General Fulgencio Batista in 1959.
“It was through my grandfather’s hard work that the hotel was built,” Rapoport told the U. K. Daily Mail Online on December 23, 2015. “We are his natural relations . . . . By right, it should be our property.” He says the Riviera is valued at $70 million. The Tampa Bay Tribune, Reuters, and Haaretz have also covered the story.
The Riviera, which overlooks the Straits of Florida, was the crown jewel of Lansky’s casinos, hotels, and nightclubs in Havana. When the Riviera opened in December 1957, it was the largest Mafia-owned hotel-casino outside Las Vegas. The hotel’s 440 double rooms were booked solid for the winter season of 1957-1958.
However, the narrative that the success of the Riviera was the product of Meyer Lansky’s “hard work” is undercut by Lansky’s own assessment of his arrangement with Batista. … continue
Blog Roll
Aletho News- Eight Iraqi resistance attacks hit US Victoria base near Baghdad airport
- US Dirty War Iran Revelations 2026: Ex-Counterterrorism Chief Joe Kent Exposes Proxy Strategy
- Iran’s Dimona Strike Shatters Myth of ‘Impenetrable’ THAAD, Patriot & Arrow Air Defenses – Analyst
- Bahrain admits US Patriot missile hit residential area, injured dozens
- Iran retaliation shakes helium, global tech supply chains
- Zionist takeover: Trump’s war on Iran reveals who really dictates US foreign policy
- Iran’s strike on Dimona – Israel’s nuclear weapons research center – shows Israeli air defences are weakened
- Fidel Castro’s War on Jewish Mobster Meyer Lansky
- US Trying to Oust Russia From All Energy Markets – Lavrov
- Western silence allows Israel to get away with killing journalists
- If Americans Knew
- Lebanon deaths top 1,200; Palantir AI to be embedded across US military – Not a ceasefire Day 163
- Israel’s assassination game: Take all pragmatists off the board
- Food shortages return to Gaza as Israel tightens aid restrictions under the cover of its war on Iran
- Trump demands trillions in payments from Gulf countries, billions from Harvard – Not a ceasefire Day 162
- Meet the former fashion blogger and shady doctor behind the ‘30,000 dead’ Iran psy-op
- Vatican Secretary of State to Trump, Israel: End the war as soon as possible
- The Majority of Americans Believe War Against Iran Benefits Israel More Than US
- Efforts to shut down pro-Palestinian speech face series of setbacks in court
- What has Israel done to my brother?
- Eid without worship in Al Aqsa – Not a ceasefire Day 161
- No Tricks Zone
- Former Pfizer Toxicologist Dr. Helmut Sterz Tells Bundestag Hearing Pfizer Vaccine Should Have Never Been Approved
- Energy Expert: Germany’s Nuclear Phaseout Was A “500 Billion Euro Mistake”
- New Research: South Australia’s Mid-Holocene Sea Surface Temperatures Were 4°C Warmer Than Today
- Storing Green Energy To Last Germany 10 Days Would Require A 60-Million Tonne Battery
- New Studies: UK Sea Levels Were 4 Meters Higher Than Today During The Mid-Holocene
- Destructive Green New Deal: German Energy And Metal Group Warns Of Drastic Crisis
- New Study Documents A 20-Year Pause In Arctic Sea Ice Decline – Driven By Internal Variability
- Wake-up Call: Survey Shows Majority Of Germans Now Favor Postponing Climate Targets!
- Televised! Leading German Political Candidate Tells Schoolchildren CO2 Makes Sun Hotter!
- New Study: A Century Warming Of 1.1°C Is ‘Commonplace’ And ‘Not Unusual’ During This Interglacial
Aletho News 
Leave a comment