THE END.
Thanks for reading, tweeting, following, participating. For those who haven't read the book, you can read it tweet by tweet here. Or (it might be easier to) Buy the Book: https://t.co/zTl3wmB3Qm
Read and decide for yourself what is going on in #geopolitics.
GUCCIFER2.0 knew the story was coming. He’d prepared for it. He’d carefully thought about what trail to leave. It was a trail that assumed we were just as dumb and brick-like as the cyberspace phantom was pretended to be.
Buy the Book: https://t.co/zTl3wmB3Qm
In all, every single “Russian” thing in #GUCCIFER2.0’S documents was added in on purpose. It took some effort to do. It wasn’t a spur of the moment reaction to a #Russian spy reading about the #DNChack (in English) in the Washington Post.
Buy the Book: https://t.co/zTl3wmB3Qm
Have another cup of tea. With biscuit. Back on page 434 figure C.4 showed the plain-text part of Техотчет.rtf that gave us the local time when the document was modified: 14:48.
Buy the Book: https://t.co/zTl3wmBBFU
#timestamps#cybersleuth#cyber#sleuth#russiagate
Using one of the many on-line tools for epoch conversion allows us to say - drumroll please - the last modified time in UTC, according to the datastore in Техотчет.rtf was. . . :
Thursday, October 29th 2015 11:48:47 AM UTC
Buy the Book: https://t.co/zTl3wmB3Qm
#russiagate
The number is known as an epoch in computing speak. The last stage is to convert the epoch into a date and time we understand.
Buy the Book: https://t.co/zTl3wmB3Qm
#computerspeak#geek#geekout
The result is; there have been 130,905,929,274,630,000 one-hundred nano-second intervals between 00:00 UTC on 1st January 1601 and the time this document was last modified.
Buy the Book: https://t.co/zTl3wmB3Qm
#nanosecond#coding#codinglife
Here’s the code and the result:
python
> import struct
> ft = "C5681F70:01D1123F"
> h2, h1 = [int(h, base=16) for h in ft.split(’:’)]
> ft_dec = struct.unpack(’>Q’, struct.pack(’>LL’, h1, h2))[0]
> print ft_dec
130905929274630000
Buy the Book: https://t.co/zTl3wmSEHU
#Python
Some kind fellow over at a programming forum wrote a #python script to convert the two halves of the #bigendian#filetime into the #nanoseconds that Mr. Gates loves so much.
Buy the Book: https://t.co/zTl3wmSEHU
If you are still following along the end is near. It’s possible (I guess) for semi-pro mathematicians to work out those all important 100 nanosecond intervals with a pencil and paper.
Buy the Book: https://t.co/zTl3wmB3Qm
#geekworld#math#nanoseconds
Table C.3 (page 437 in the book) shows the re-arranging from little-endian to big-endian for the Win32FileTime we found in Техотчет.rtf.
Buy the Book: https://t.co/zTl3wmB3Qm
#cybersecurity#geek#cyberworld#cyberwar
Because Word binary documents are written in the ‘little-endian’ fashion each half of the ‘DateTime’ has to be converted by reading right to left.
Buy the Book: https://t.co/zTl3wmBBFU
#geek#cybergeek#background#russiagate
Microsoft arrange the filetime comes in two halves, a four byte ‘LowDateTime’ and a four byte ‘HighDateTime’ .
Buy the Book: https://t.co/zTl3wmBBFU
#cybersleuth#coding#BehindTheScenes#knowhow
At 1st glance it doesn’t look like a time, but it is. It’s a Win32Filetime. The way Microsoft calculate a time is to do what would seem obvious to Bill Gates:
Count how many 100 nano-second intervals have passed since 00:00:00 UTC on the 1st January 1601.
https://t.co/zTl3wmSEHU
There’s 2 filetimes each of 8 bytes. The 1st one starting at 0x0495 is the ‘Creation Time’ which hasn’t been recorded (or has been removed). The 2nd is the ‘last modified time’: 70 1F 68 C5 3F 12 D1 01 which is what we were after all along.
Buy the Book: https://t.co/zTl3wmB3Qm
Root Entry indicates that it’s the start of what, with their poetic flair, Microsoft call a Compound File Directory Entry. They contain the all important file times.
And there they are, a few lines further down between offsets 0x0490 and 0x04A0.
Buy: https://t.co/zTl3wmBBFU
The hex values are in the ascii (text) range and work out as:
R o o t E n t r y
It’s good news. There is light ahead.
Buy the Book: https://t.co/zTl3wmBBFU
#puzzles#cybersleuth#cyberworld