EXCLUSIVE: The Forensicator On Guccifer 2.0’s “Clinton Foundation” Files

by Elizabeth Vos, Disobedient Media:

Disobedient Media provided the first media coverage of the findings of the independent analyst known as the Forensicator. The Forensicator’s work and our coverage of their analysis was cited by Veteran Intelligence Professionals for Sanity (VIPS) in their memorandum to President Trump questioning Russian hacking allegations. The Forensicator’s groundbreaking analysis, the VIPS memorandum, and the immense work of Adam Carter have been instrumental in forcing legacy press and establishment figures to face a fundamental lack of evidence supporting Russian hacking claims.

The Forensicator‘s latest analysis was sparked in part by twitter user Stephen McIntyre’s observation regarding the so-called “Clinton Foundation” (cf.7z) file. The alleged Clinton Foundation information is separate from NGP-VAN data, though both were published by the Guccifer 2.0 persona.

The Forensicator’s report illustrated the time stamps used in their latest analysis of the “Clinton Foundation” files:

Guc2.png

The Forensicator prefaced their discussion of the latest findings with Disobedient Media by emphasizing that Guccifer 2.0’s use of the title “Clinton Foundation” was potentially misleading. They noted that despite the title, the file may not have actually come from a “hack” of the Clinton Foundation. When the Forensicator analyzed the files attributed to The Clinton Foundation, they confirmed that some were dated 7/5/2016; those files fit into gaps in the previously analyzed NGP/VAN data.

McIntyre’s tweets pointed out an observable time zone difference of an hour between the NGP-VAN files and the purported Clinton Foundation files. The Forensicator explained that the latest available information raised questions as to whether one person or multiple individuals were responsible for copying the files published by Guccifer 2.0. They stated that the available evidence is not sufficient to draw a strong conclusion on that issue.

The Forensicator addressed the time zone issue in his latest findings:

Guc2-cf-7z-cdt-usb-edt-time-change.png

The Forensicator additionally told Disobedient Media that in their earlier analysis of the NGP-VAN data, a copying event at a later date had raised questions as to the number of  “team members” involved. The Forensicator told Disobedient Media that the the data in the “Clinton Foundation” disclosure introduces new content that has time stamps which fit into the NGP/VAN timeline. This observation supports their conclusion that both the NGP/VAN files and the Clinton Foundation files were selected from a larger group of files dated 2016-07-05.

The Forensicator further explained to us that these new files either fit into gaps previously observed in their analysis of the NGP/VAN files, or preceded them by just one minute. This, they said, strengthens their earlier analysis of the NGP-VAN meta data, and suggests that the “Clinton Foundation” files was pulled from a much larger set of data, then curated.

The Forensicator also emphasized that “the entire cf.7z archive has two second granularity,” indicating that the Clinton Foundation files were copied to a FAT-based media (most likely a thumb drive) before the final 7zip file was built. They added that the files appear to have been copied to a Windows PC before the final 7zip was constructed.

Read More @ DisobedientMedia.com