Thread by @ClimateAudit

1/ something new on metadata of Wikileaks DNC emails. Hard to imagine that it's been overlooked so long. Result checks out from my spot checks. Binney and Larry Johnson report that DNC emails have FAT format and in three batches
turcopolier.typepad.com/sic_semper_tyr…

2/ FAT metadata saves timestamps only in even seconds 10:30, 10:32 etc. It is used on thumbdrives, while hard-drives timestamp to nanoseconds. I downloaded a couple of DNC emails (using wget in CMD to preserve timestamp) and spot checked that it was so. It was.

3/ they observed that Podesta emails were NOT in FAT format i.e. the FAT format did not appear to result from Wikileaks operations

4/ Forensicator had previously discussed presence of FAT formats in all documents in the second Guccifer2 zipfile (cf.7z) theforensicator.wordpress.com/cf-files-metad… and in top-level directories (rar) in the first zipfile (ngpvan)

5/ they report that the DNC emails were in three batches: on May 23, May 25 and August 26. It was already known (tho widely ignored) that DNC emails were hacked in the few days prior to May 25. (see @steemwh1sks). The May 23, 25 dates consistent; Aug 26 requires explanation

6/ note that Mueller report placed exfiltration of DNC emails between May 25 and June 1, an assertion that is inconsistent with latest email date (May 25). Mueller appears to have botched the precise dates by a week. Wonder how that happened?

6/ Binney and Johnston also discuss a peculiarity of Crowdstrike's conduct that I've discussed over and over, but which has got little resonance: the DNC email hack took place 4 weeks AFTER Crowdstrike knew that DNC had been hacked.

7/ an important point relating to Crowdstrike which Binney and Johnson didnt mention is that the emails fell into a narrow window from April 19 to May 25, with majority (including sensitive ones) being sent AFTER Crowdstrike and DNC knew about hack
climateaudit.org/2017/09/02/ema…

the image that I showed here is unhelpful as it only shows minutes.

7/ here's a better image confirming 2-second artifact. I downloaded from WL using wget to preserve timestamp and then used file.info in R to retrieve file metadata. Note that @bleidl challenges association of FAT with thumb drives.

8/ overall, I'm never been convinced by argument based on high July 5 copying speeds as this have been post-exfiltration copying. I don't think that there is any reasonable doubt that Podesta emails arose from same hacking program as Rinehart emails published at DCLeaks (syntax)

9/ I've also pointed out that some DNC email attachments turned up at DCLeaks. On balance, there's more evidence connecting DNC emails to DCLeaks hackers than to, say, Seth Rich-type leak. Conventional theory is far from disproven.

10/ on other hand, it seems to me that there's a considerable amount of arm-waving in Mueller indictment in relation to DNC emails and Guccifer 2. There are aspects of the whole matter that remain puzzling to me.

11/ I did my own sampling (every 100) of Wikileaks DNC emails. There's a fourth date that was missed by Binney and Johnson: Sep 21, 2016. It has about 9000-10000 emails.