+++
+++
The Forensicator is the anonymous member of Veteran Intelligence Professionals for Sanity.
The
report as laid out by The Forensicator:
Based on the analysis that is detailed below, the following key findings are presented:
-
On 7/5/2016 at approximately 6:45 PM Eastern time,
someone copied the data that eventually appears on the “NGP VAN” 7zip
file (the subject of this analysis). This 7zip file was published by a
persona named Guccifer 2, two months later on September 13, 2016.
-
Due to the estimated speed of transfer (23 MB/s)
calculated in this study, it is unlikely that this initial data transfer
could have been done remotely over the Internet.
-
The initial copying activity was likely done from a
computer system that had direct access to the data. By “direct access”
we mean that the individual who was collecting the data either had
physical access to the computer where the data was stored, or the data
was copied over a local high speed network (LAN).
-
They may have copied a much larger collection of data
than the data present in the NGP VAN 7zip. This larger collection of
data may have been as large as 19 GB. In that scenario the NGP VAN 7zip
file represents only 1/10th of the total amount of material taken.
-
This initial copying activity was done on a system where
Eastern Daylight Time (EDT) settings were in force. Most likely, the
computer used to initially copy the data was located somewhere on the
East Coast.
-
The data was likely initially copied to a computer
running Linux, because the file last modified times all reflect the
apparent time of the copy and this is a characteristic of the the Linux
‘cp’ command (using default options).
-
A Linux OS may have been booted from a USB flash drive
and the data may have been copied back to the same flash drive, which
will likely have been formatted with the Linux (ext4) file system.
-
On September 1, 2016, two months after copying the
initial large collection of (alleged) DNC related content (the so-called
NGP/VAN data), a subset was transferred to working directories on a
system running Windows. The .rar files included in the final 7zip file
were built from those working directories.
-
The computer system where the working directories were
built had Eastern Daylight Time (EDT) settings in force. Most likely,
this system was located somewhere on the East Coast.
-
The .rar files and plain files that eventually end up in
the “NGP VAN” 7zip file disclosed by Guccifer 2.0 on 9/13/2016 were
likely first copied to a USB flash drive, which served as the source
data for the final 7zip file. There is no information to determine when
or where the final 7zip file was built.
The most important aspect about the report is the “estimated
speed of transfer (23 MB/s)” at which the documents were copied. It’s
inconceivable DNC documents could have been copied at such speed from a
remote location.
Disobedient Media reports:
Importantly, The Forensicator concluded that the chance
that the files had been accessed and downloaded remotely over the
internet were too small to give this idea any serious consideration. He
explained that the calculated transfer speeds for the initial copy were
much faster than can be supported by an internet connection.
This is extremely significant and completely discredits
allegations of Russian hacking made by both Guccifer 2.0 and
Crowdstrike.
This conclusion is further supported by analysis of the overall transfer rate of 23 MB/s. The Forensicator described
this as “possible when copying over a LAN, but too fast to support the
hypothetical scenario that the alleged DNC data was initially copied
over the Internet (esp. to Romania).” Guccifer 2.0 had claimed to
originate in Romania. So in other words, this rate indicates that the
data was downloaded locally, possibly using the local DNC network. The
importance of this finding in regards to destroying the Russian hacking
narrative cannot be understated.
If the data is correct, then the files could not have been copied
over a remote connection and so therefore cannot have been “hacked by
Russia.”
The use of a USB drive would also strongly suggest that the person
copying the files had physical access to a computer most likely
connected to the local DNC network. Indications that the individual used
a USB drive to access the information over an internal connection, with
time stamps placing the creation of the copies in the East Coast Time
Zone, suggest that the individual responsible for initially copying
what was eventually published by the Guccifer 2.0 persona under the
title “NGP-VAN” was located in the Eastern United States, not Russia.
During the presidential campaign,
POLITICO reported what now appears to be a disproven story about Guccifer 2.0 hacking and releasing DNC documents:
The hacker persona Guccifer 2.0 has released a new trove
of documents that allegedly reveal more information about the Democratic
National Committee’s finances and personal information on Democratic
donors, as well as details about the DNC’s network infrastructure.
The cache also includes purported memos on tech initiatives from Democratic vice presidential nominee Tim Kaine’s time as governor of Virginia, and some years-old missives on redistricting efforts and DNC donor outreach strategy.
DNC interim chair Donna Brazile immediately tied the leak to GOP presidential nominee Donald Trump.
“There’s one person who stands to benefit from these criminal acts,
and that’s Donald Trump,” she said in a statement Tuesday night, adding
that Trump has “embraced” Russian President Vladimir Putin and “publicly
encouraged further Russian espionage to help his campaign.”
POLITICO then suggests Guccifer 2.0 hacked into the DNC:
If authentic, the documents would represent the latest
strike from the mysterious hacker persona that has already roiled the
2016 election with leaks of documents stolen from the DNC and the House
Democrat’s campaign arm, the DCCC. Earlier document dumps include the
internal communications that forced the resignation of former DNC
Chairwoman Debbie Wasserman Schultz this summer and fueled allegations of party bias against Bernie Sanders.
The bombshell report brings murdered DNC staffer Seth Rich back into
focus, who many believe may have been the WikiLeaks source for the DNC
emails.
WND reports:
Private investigators have claimed there is evidence Rich
was the source WikiLeaks used to obtain thousands of DNC emails
released on the eve of the party’s presidential nominating convention
last July. The emails, indicating the party was manipulating the primary
race in favor of Hillary Clinton, led to the resignation of former DNC
Chairwoman Rep. Debbie Wasserman Schultz. On July 22, just 12 days after
Rich’s death and days before the Democratic Party Convention in
Philadelphia, WikiLeaks released 20,000 DNC emails.
Also as WND has reported,
former detective Rod Wheeler was initially hired by Rich’s parents
through a third party to find their son’s killer. Wheeler alleges former
interim DNC chairwoman Donna Brazille contacted the Metropolitan Police
Department demanding to know why he was “snooping” after Wheeler began
investigating Rich’s murder. As a result, he said, law-enforcement
authorities are now refusing to provide him with more details about the
case.