Guccifer 2.0's First Five Documents: The Process

By Adam Carter --- May 31st, 2017

I'm aware that the "Multi-Stage Fingerprint Fabrications" article assumes a fair bit of technical knowledge to follow through and I'm also seeing some try to explain the processes and not communicate them as well (or accurately) as could be done.

So, here are processes that appear to have been used to construct Guccifer 2.0's first 5 documents (very likely starting at 1:38pm on June 15th but that's not an essential point for the sake of proving the fabrication efforts):


"1.doc", "2.doc" & "3.doc"

Based on the version numbers and editing time, it now appears that the specific procedure used, involved the following:

On a PC with a copy of MS-Word registered to "Warren Flood", a blank template file is created with a Russian stylesheet in it.

Approximately 30 minutes later, someone using the name "Феликс Эдмундович" carries out the following actions:

  1. The template document is opened (at v3). - Content from an original document is copied/pasted into the document body, and it is saved. (ie. "1.doc" at v4)
  2. "1.doc" is then copied twice to create "2.doc" and "3.doc".
  3. Both files are opened at 2:08 PM and contents from the next original document are copied in to "2.doc", replacing the body text, this is then saved (as "2.doc" at v5 and editing time at 2 minutes)
  4. Contents from the next original document are copied into 3.doc, this is saved, then altered and saved a further 2 times, with the final save occurring at 2:12pm (ending up at v7, with 4 minutes editing time)
Credit (and thanks) for working out the above sequence goes to: Christine Granville

Even if we ignore Flood's name as creator and assume that an original document was opened at first and then had a Russian stylesheet entry added by accident, it would not explain the same stylesheet entry correlation (with identical RSID) in the second and third documents.


"4.doc"

On a PC with a copy of MS-Word registered to "user", an original document was opened and saved-as "4.doc".

(It appears this was done in between the initial and second phases of fabricating the first 3 documents.)


"5.doc"

On the PC with a copy of MS-Word registered to "Феликс Эдмундович" an original document is opened and then saved as "5.doc".


For both "4.doc" and "5.doc", the original creator/author name being retained but the creation and last modification timestamps matching the modification time - is how we can tell how those the files were handled - if you experiment writing out RTF-format documents in MS-Word under various circumstances you'll see this result only occurs under the same set of circumstances)