Further RTF Analysis Supports Russian Fingerprint Fabrication

By Adam Carter --- May 26th, 2016 (Updated: May 30th, 2016)

Today, I was fortunate enough to receive an email from 'StrontiumDog' who has also been taking a close look at the RTF data in Guccifer 2.0's documents.

(If unaware of the discoveries already made, you can find details here and here)

I don't want to filter StrontiumDog's words so I'm just going to copy & paste some of the main points from his email below (and update other parts of this site to include the new additions where relevant).

These new things are speculative/circumstantial but they do add some weight to the general assessment of the initial files so far.

• Editing Duration "\edmins", the files were only edited for 2,2,4,0,1 minutes respectively.  This would indicate that Guccifer 2.0 spent no significant time at all, reading the contents of the file, between opening it and saving it for redistribution.  If he didn't read it, how did he know it was worth leaking?
  
  
• Timezone.  I think you missed it, because I didn't see it in your site, and its possibly the most significant thing I picked up on.  Timezone.  RTF does not define Timezone information for Date/Time within the file.  It is presumably just taken from the local time of the computer.  Which means, Guccifer 2.0 was operating a computer set to the exact same TimeZone as the source of the documents, otherwise the create and modify times could never be so close together.  You could easily test this, create a file, change your time zone, modify the file and save.  If Guccifer 2.0 was anywhere in Europe, his Timezone would be significantly advanced from DC Time, which means he is either in the same timezone, has his timezone set to the timezone of the documents (and how would he know that, because timezone information is not in the file), OR he specifically looked at the time in the file, and adjusted his clock to match, and again, for what purpose, why would he want it to look like he was in DC when the files were created?
  
  He is also connected to the internet, so presumably his computer would have its time zone set to the local time zone set on installation, and then updated from internet time servers, just like everyone else on the planet does.

Thanks to StrontiumDog for sharing what he has discovered.