RussiaGateBooks

A Detective Author ~ Following a Trail of Geopolitics.
Read Book 1 here - 1 tweet at a time.
Or for a faster read - buy the Book:

[RussiaGateBooks @RussiagateBooks]

#HillaryClinton #SteeleDossier #MuellerReport #Russiagate #Spygate #Ukraine and more are all part of a bigger picture. Pieces in a puzzle.
Discover the more in my book 'Loaded for Guccifer 2.0' #5stars
Help me open the eyes of the world, or at least get people to ask questions.

[RussiaGateBooks @RussiagateBooks]

@mcmastersteve Second book in a planned trilogy in final edit. Thanks for following, retweeting and reading!

[RussiaGateBooks @RussiagateBooks]

THE END.
Thanks for reading, tweeting, following, participating. For those who haven't read the book, you can read it tweet by tweet here. Or (it might be easier to) Buy the Book: https://t.co/zTl3wmB3Qm
Read and decide for yourself what is going on in #geopolitics.

[RussiaGateBooks @RussiagateBooks]

Most of all #Guccifer2.0 was pointing us to #CyberBerkut to prove that
all the prophets were right. It was all about – and will Eternally be about – #Ukraine.
Buy the Book: https://t.co/zTl3wmB3Qm
#Russia #RussiaUkraine #Statecraft #Russiagate

[RussiaGateBooks @RussiagateBooks]

GUCCIFER2.0 knew the story was coming. He’d prepared for it. He’d carefully thought about what trail to leave. It was a trail that assumed we were just as dumb and brick-like as the cyberspace phantom was pretended to be.
Buy the Book: https://t.co/zTl3wmB3Qm

[RussiaGateBooks @RussiagateBooks]

In all, every single “Russian” thing in #GUCCIFER2.0’S documents was added in on purpose. It took some effort to do. It wasn’t a spur of the moment reaction to a #Russian spy reading about the #DNChack (in English) in the Washington Post.
Buy the Book: https://t.co/zTl3wmB3Qm

[RussiaGateBooks @RussiagateBooks]

By subtraction we can show that the document was modified in the timezone of 14:48 minus 11:48 = UTC +3. The time-zone of Moscow. And Kyiv.
Buy the Book: https://t.co/zTl3wmBBFU
#timestamps #guccifer2 #cybersleuth #sleuthing #computerforensics #russiagate

[RussiaGateBooks @RussiagateBooks]

Have another cup of tea. With biscuit. Back on page 434 figure C.4 showed the plain-text part of Техотчет.rtf that gave us the local time when the document was modified: 14:48.
Buy the Book: https://t.co/zTl3wmBBFU
#timestamps #cybersleuth #cyber #sleuth #russiagate

[RussiaGateBooks @RussiagateBooks]

Using one of the many on-line tools for epoch conversion allows us to say - drumroll please - the last modified time in UTC, according to the datastore in Техотчет.rtf was. . . :
Thursday, October 29th 2015 11:48:47 AM UTC
Buy the Book: https://t.co/zTl3wmB3Qm
#russiagate

[RussiaGateBooks @RussiagateBooks]

The number is known as an epoch in computing speak. The last stage is to convert the epoch into a date and time we understand.
Buy the Book: https://t.co/zTl3wmB3Qm
#computerspeak #geek #geekout

[RussiaGateBooks @RussiagateBooks]

The result is; there have been 130,905,929,274,630,000 one-hundred nano-second intervals between 00:00 UTC on 1st January 1601 and the time this document was last modified.
Buy the Book: https://t.co/zTl3wmB3Qm
#nanosecond #coding #codinglife

[RussiaGateBooks @RussiagateBooks]

Here’s the code and the result:
python
> import struct
> ft = "C5681F70:01D1123F"
> h2, h1 = [int(h, base=16) for h in ft.split(’:’)]
> ft_dec = struct.unpack(’>Q’, struct.pack(’>LL’, h1, h2))[0]
> print ft_dec
130905929274630000
Buy the Book: https://t.co/zTl3wmSEHU
#Python

[RussiaGateBooks @RussiagateBooks]

Some kind fellow over at a programming forum wrote a #python script to convert the two halves of the #bigendian #filetime into the #nanoseconds that Mr. Gates loves so much.
Buy the Book: https://t.co/zTl3wmSEHU

[RussiaGateBooks @RussiagateBooks]

If you are still following along the end is near. It’s possible (I guess) for semi-pro mathematicians to work out those all important 100 nanosecond intervals with a pencil and paper.
Buy the Book: https://t.co/zTl3wmB3Qm
#geekworld #math #nanoseconds

[RussiaGateBooks @RussiagateBooks]

Table C.3 (page 437 in the book) shows the re-arranging from little-endian to big-endian for the Win32FileTime we found in Техотчет.rtf.
Buy the Book: https://t.co/zTl3wmB3Qm
#cybersecurity #geek #cyberworld #cyberwar

[RussiaGateBooks @RussiagateBooks]

Because Word binary documents are written in the ‘little-endian’ fashion each half of the ‘DateTime’ has to be converted by reading right to left.
Buy the Book: https://t.co/zTl3wmBBFU
#geek #cybergeek #background #russiagate

[RussiaGateBooks @RussiagateBooks]

Microsoft arrange the filetime comes in two halves, a four byte ‘LowDateTime’ and a four byte ‘HighDateTime’ .
Buy the Book: https://t.co/zTl3wmBBFU
#cybersleuth #coding #BehindTheScenes #knowhow

[RussiaGateBooks @RussiagateBooks]

At 1st glance it doesn’t look like a time, but it is. It’s a Win32Filetime. The way Microsoft calculate a time is to do what would seem obvious to Bill Gates:
Count how many 100 nano-second intervals have passed since 00:00:00 UTC on the 1st January 1601.
https://t.co/zTl3wmSEHU

[RussiaGateBooks @RussiagateBooks]

There’s 2 filetimes each of 8 bytes. The 1st one starting at 0x0495 is the ‘Creation Time’ which hasn’t been recorded (or has been removed). The 2nd is the ‘last modified time’: 70 1F 68 C5 3F 12 D1 01 which is what we were after all along.
Buy the Book: https://t.co/zTl3wmB3Qm

[RussiaGateBooks @RussiagateBooks]

Root Entry indicates that it’s the start of what, with their poetic flair, Microsoft call a Compound File Directory Entry. They contain the all important file times.
And there they are, a few lines further down between offsets 0x0490 and 0x04A0.
Buy: https://t.co/zTl3wmBBFU

[RussiaGateBooks @RussiagateBooks]

The hex values are in the ascii (text) range and work out as:
R o o t E n t r y
It’s good news. There is light ahead.
Buy the Book: https://t.co/zTl3wmBBFU
#puzzles #cybersleuth #cyberworld