New analysis suggests Guccifer 2.0 files copied locally, not hacked by Russia
RT | July 12, 2017
Files stolen from the Democratic National Committee (DNC) were likely downloaded to a USB drive by someone with physical access to a computer connected to the DNC network, not hacked remotely by Russia, according to a new analysis.
In an interview with Motherboard in June 2016, the hacker who claimed to be Guccifer 2.0 said he used a zero-day exploit to breach the DNC server and steal files he later published under the title “NGP-VAN.”
The leak was quickly attributed to the Russian government. However, a document published Sunday by an individual known as the Forensicator shows how the 7-zip file published by Guccifer 2.0 was transferred at a speed of 23 MB/s, making it “unlikely that this initial data transfer could have been done remotely over the Internet.”
“The initial copying activity was likely done from a computer system that had direct access to the data,” the report from the Forensicator stated. “By ‘direct access’ we mean that the individual who was collecting the data either had physical access to the computer where the data was stored, or the data was copied over a local high speed network (LAN).”
For his analysis, the Forensicator looked at the data from the 7-zip file which showed the .rar files were built on September 1, 2016, while the other files were last modified on July 5, 2016. When the .rar files are unpacked using a program called WinRAR, their timestamps were preserved from the date they were transferred.
The timestamps of those .rar files were relative times, while the times recorded in the 7-zip files are absolute times, recorded in Coordinated Universal Time (UTC). The Forensicator found that if the .rar files were adjusted to Eastern Time, they “fall into the same range as the last modified times for the directories archived in the .rar files.”
Therefore, the Forensicator concludes that the files were built on a computer system where the Eastern Daylight Savings Time (EDT) timezone setting was in force, meaning that the system was most likely located on the East Coast of the US.
The Forensicator then generated a list of the files sorted by the date they were last modified and imported the list into an Excel spreadsheet. Analyzing the files by date last modified, he observed that the last modified times were clustered together in a 14-minute time period on July 5, 2016.
The analysis of the metadata also found a majority of the time it took for the files to be copies, 12 minutes and 48 seconds of the 14 minutes and 15 seconds, was allocated to “time gaps” that appear between several top-level files and directories. The Forensicator concluded that this indicated that the files were chosen from a much larger collection of files.
Estimating the transfer speed of the files published by Guccifer, the Forensicator concluded that if the 1.98 GB 7-zip archive published by Guccifer was copied at a rate of 22.6 MB/s, and all the time gaps were attributed to additional file copying, the initial file copy would be 10 times larger, or 19.3 GB.
2 Comments »
Leave a comment
Featured Video
US traders struggle to find buyers for Venezuelan oil as China shifts to Canada
or go to
Aletho News Archives – Video-Images
From the Archives
British propaganda campaign incited mass slaughter of communists in Indonesia in 1960s, declassified papers reveal
RT | October 17, 2021
British spies played a part in the mass murder of Communist Party of Indonesia (PKI) members in the 1960s, urging locals, including army generals, to “cut out” the “communist cancer,” declassified papers have revealed.
The Indonesian Army’s brutal clampdown on the PKI in 1965 and 1966 is considered to be one of the worst mass murders of the 20th century. Between 500,000 and three million supporters of the Communist Party were slaughtered, according to various estimations.
Declassified Foreign Office documents, which were recently released by Britain’s National Archives and seen by The Guardian newspaper, indicate that the UK isn’t without fault in those shocking events.
The British Foreign Office had always denied the country’s involvement in the brutal clampdown on those blamed of communist links in Indonesia. … continue
Blog Roll
Recent Comments
loongtip on Showdown loongtip on New York Bans Israel-Linked Te… loongtip on Trump tells India to stop purc… eddieb on The Old Testament and the Geno… papasha408 on Trump’s war posturing against… Coronistan on This is How We Should Have Res… Coronistan on NO MANDATES, NO PROFITS: MODER… Lutz Barz on Russia Vows to Protect Its Oil… loongtip on Russia Vows to Protect Its Oil… loongtip on Hamas never agreed to lay down… eddieb on Conspiracy Denial eddieb on WEF Calls for ‘Cultural Revolu…
Aletho News- IRGC drone completes lawful recon mission before contact lost
- Spain announces major social media crackdown
- Newly surfaced Epstein email ties him to Israel–UAE strategy targeting Qatar
- Focus on Panama’s ‘port case’ must not be misplaced
- ‘No nuclear program, no ballistic missiles, no support for resistance’: Israel sets red lines ahead of Iran–US talks
- Turkiye pulls out from defense pact with Saudi Arabia, Pakistan: Report
- Iran riots 2026: How the Erfan Soltani “execution” story went viral – and fell apart
- US and European forces could deploy to Ukraine under Zelensky plan – FT
- Showdown
- US traders struggling to find buyers for Venezuelan oil, as China shifts supply chain to Canada
- If Americans Knew
- Official US gov’t reports contradict Mike Waltz’s rants against UNRWA
- Israel lets just 5 patients out of 20,000 exit Gaza – Not a ceasefire Day 116
- Trump Again Bypasses U.S. Congress to Push $6 Billion in Arms Sales to Israel
- One side emerged from a tunnel; the other side killed 31. Both must “exercise restraint” – Not a ceasefire Day 115
- Trump Expected to Pick Kevin Warsh, Son-in-Law of Zionist Billionaire Ron Lauder, as Fed Chair
- Israel killed at least 32 Gazans on Saturday – Not a ceasefire Day 114
- Is Israel opening the Rafah border to depopulate Gaza? – Not a ceasefire Day 113
- NBA Star Stephen Curry’s Ties To Israeli Military Intelligence
- ‘Apocalyptic wasteland’: Biden admin. blocked warning on deteriorating Gaza situation after Oct. 7
- Why Israeli counterterrorism tactics are showing up in Minnesota
- No Tricks Zone
- Climate Scientist Who Predicted End Of “Heavy Frost And Snow” Now Refuses Media Inquiries
- Polar Bear Numbers Rising And Health Improving In Areas With The Most Rapid Sea Ice Decline
- One Reason Only For Germany’s Heating Gas Crisis: Its Hardcore-Dumbass Energy Policy
- 130 Years Later: The CO2 Greenhouse Effect Is Still Only An Imaginary-World Thought Experiment
- New Study Affirms Rising CO2’s Greening Impact Across India – A Region With No Net Warming In 75 Years
- Germany’s Natural Gas Crisis Escalates … One Storage Site Near Empty …Government Silent
- Polar Colding…Antarctica Saw Its Coldest October In 44 Years!
- New Study: Sea Levels Rose 20 Times The Modern Rate During The Roman Warm Period
- As German Gas Storage Dips Dangerously Low…Shortage Hardly Avoidable
- New Study: Brazil’s Relative Sea Level Was 2+ Meters Higher And SSTs 3-4°C Warmer 6000 Years Ago
Aletho News 
Notice as the forensics of DNC emails is being further explored and revealed, (((the MSM))) ramps up the narratives of Trump-Russian collusion about the election.
LikeLike
How ridiculous. If I ssh into a machine remotely and zip a bunch of files into an archive FROM REMOTE, it’s not going to timestamp the files with my local time, but the time on the machine that I am remotely connected to — the machine that is archiving the data. Archiving data into a single file is standard practice before grabbing them from afar.
LikeLike