Sooo.....

You have two choices:
#1 fall back on the "experts have debunked it". I'm an expert, I've debunked it.
#2 spend considerable amount of time understanding the issue so that you can competently debate it and answer questions, which frankly, isn't worthy your time
The short answer is this: the forensics investigators looked only at the C: boot drive, not the D: data drive were records are preserved. Thus, they could not have said whether or not records were correctly preserved according to state law.
Secondly, it's not a valid forensics report, because among other things, they violate forensics ethics by not putting their name on it and redacting information without disclosing the fact of redaction to the reader.
Thirdly, it's bizarre, since it's simply proving what everyone already knows, that the C: boot drive is wiped out in the Trusted Build process. You don't need a report arguing this since Dominion documents that this is exactly what they do.
...indeed, it's inaccurate because it says some files weren't "deleted", when in fact, they all were deleted. Everything is deleted on the C: drive -- records are preserved on the D: drive.
Fourthly, it's bizarre because Tina Peters admits its her job to preserve records by copying them to the D: drive, so the target of here whistleblowing is nobody but herself.
My point is this: you can't debate stupid. The issue is so basic, THEY DIDN'T EXAMINE THE D: DRIVE, that you have to wonder why anybody takes it seriously.
scribd.com/document/52625…
In any event, there's subtext here, what they are really arguing. The underlying argument is their (wrong) claim that all Windows operation-system logs must also be preserved. It's not true, the election records preservation rules don't refer to them.
The reason they argue this is because none of the logs that are preserved show any election hacking anywhere. Thus, their reasoning goes, the evidence of hacking must reside in those junk files that nobody cared to preserve.
One could reasonably argue that more Windows operating system logs should be preserved, in case we need to investigate hacking -- FOR FUTURE ELECTIONS.

But it only works if your are arguing for future elections.
In other words, no Trumpist argued before the 2020 election that Windows system logs should be preserved. They only discovered that argument after the election, when looking for ways to cast doubt on the election.
Yes, it's just like the Maricopa routers. The Trumpist continued inability to find evidence of election hacking takes them to ever crazier extremes. Routers don't contain even data but would cost millions to rip out of networks.
The situations are sooo comparable. If you are crazy enough to believe that "the routers" contain data (they don't), then it's not possible to have a rational debate. There's no way for me to refute your claims, because they posit nonsensical things already.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Robᵉʳᵗ Graham #PcapsOrItDidntHappen

Robᵉʳᵗ Graham #PcapsOrItDidntHappen Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @ErrataRob

22 Sep
I think the reason people are upset at the new Space Force uniforms is that they didn't take the "unisex" approach to uniforms that the Scots take.
It's still early days. Maybe we can start a petition to make kilts optional.
Since Space Force seems to be deriving inspiration from sci-fi, yes, space kilts are a thing.
Read 4 tweets
21 Sep
So one of the funny things from that "Mesa County Dominion deletes files" report is the screenshot they take of the report produced by the FTK Imager.

It's missing a line of text: the name of the examiner who created the image. The name was "cjh" which many claim is Conan Hayes
With the magic of cryptography, we KNOW for certain the name was deliberately removed in that graphic. That's because the MD5/SHA1 hashes confirm this is the SAME system image that was posted online during Lindell's Cybersymposium.
Yes yes, I know, both MD5 and SHA1 are broken and it's possible to create two files with the same hashes, that SHA2 needs to be used to actually be certain. But it still would require participation of the person who created them -- not something done after the fact.
Read 4 tweets
20 Sep
1/ One of the problems with hacking is that you are always certain you are going it in the sub-optimal, least elegant fashion.

Such is the case in my examination of those disk images from the Mesa County election computer. A natural question is to grab password hashes.
2/ The standard free utility for examining a disk image is "Autopsy". There are more expensive commercial offerings. Autopsy has a lot of really cool plugins. I assume it would have one for password hashes, but I can't find one.
3/ So I do it the inelegant way. I simply go through the filesystem and extract the SAM, SECURITY, and SYSTEM registry "hives" (aka. files in registry format).
Read 7 tweets
20 Sep
I have a different memory of Occupy Wall Street.

When the leaders threatened violence against me because they wanted the table I was sitting at, they reason was "because we are all in this together" and thus my individual desire must be subordinate to the group desire. Image
It was a weird world where facts didn't matter. For example, signs claimed the 1% didn't pay taxes, when in fact the top 1% of income earners earn about 20% of the income and pay 40% of income taxes.
I remember being in line a the nearby Starbucks while the Occupy guys behind me were strategizing how they could get the police to arrest protestors, such as walking in the middle of the street.
Read 7 tweets
19 Sep
Fact check: false

The data wasn't deleted, it was backed-up (well, probably).

I did my own forensics analysis of the Mesa County servers. Retention rules would demand that data be backed-up externally. Thus, seeing data deleted locally wouldn't mean anything.
I can't confirm they were backed-up properly, or if the backups were deleted elsewhere. There's suggestions of connecting to both a NAS and an external drive, so I see hints they were.

I just know that "retention" would imply "external storage" from the server.
The way that Dominion "updates" work isn't "software updates" like you and I are familiar with. Instead, an "update" of this server applying a whole new system image, which wipes out whatever was on the server beforehand.
Read 5 tweets
16 Sep
Five years ago, I thoroughly debunked that conspiracy theory of a Trump sever in secret communication with Alfa Bank (a bank in Russia).

Today, there's an indictment of the lawyer involved in this, which gives a lot more detail on the backstory.
huffpost.com/entry/michael-…
2/ If you'll remember, I didn't prove it was wrong, but I showed that none of the DNS information meant anything. I explained things that others found unexplainable.
blog.erratasec.com/2016/11/debunk…
blog.erratasec.com/2016/11/in-whi…
3/ The indictment shows how Tech-Executive-1 at a big Internet company directed people at two startups he invested in to go hunting in private databases (like netflow logs and DNS lookup logs) to find dirt on Trump.
Read 8 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

:(