2 ms·

According to Techcrunch, it has been done (after the expulsion evidently): We asked Jake Williams, a former NSA hacker who founded cybersecurity and digital fo

by t_1 8y ago

According to Techcrunch, it has been done (after the expulsion evidently): We asked Jake Williams, a former NSA hacker who founded cybersecurity and digital forensics firm Rendition Infosec, to examine the metadata embedded in the photos. The photos, taken from her iPhone, contained a matching date and time for the alleged hack, as well as a set of coordinates putting her at the Mark Twain House. While photo metadata can be modified, Williams said the signs he expected to see for metadata modification weren’t there. “There is no evidence that these were modified,” he said.

jonstewart 8y ago
I’ve met Jake a couple of times, he’s a good examiner. TFA says he looked at the [EXIF] metadata of the photos. There’s nothing in here to suggest a comprehensive forensic analysis of the cellphone itself (eg from a Cellebrite extraction). A phone is a treasure trove of SQLite databases.
- chatmasta 8y ago
  > A phone is a treasure trove of SQLite databases This is so true. I've thought for a long time that a cool art experiment would be a blackbox with a lightning cable protruding out of it. You plug your phone in and answer "Do you trust this computer?" And if you do, those "SQLite databases" you mention get projected on the wall. A bit like the wall of sheep, I guess, but more for the purpose of educating people just how much data is actually on their phone.
ghaff 8y ago
>While photo metadata can be modified, Williams said the signs he expected to see for metadata modification weren’t there. “There is no evidence that these were modified,” he said. Assuming the person changed all data/time fields including those in the file system, what other signs of modification would there be? I poked around online and didn't find anything.
- cgoecknerwald 8y ago
  My first guess would be weather records from that day, if the photo was taken outside.

by t_1 8y ago

jonstewart 8y ago

I’ve met Jake a couple of times, he’s a good examiner. TFA says he looked at the [EXIF] metadata of the photos. There’s nothing in here to suggest a comprehensive forensic analysis of the cellphone itself (eg from a Cellebrite extraction). A phone is a treasure trove of SQLite databases.

chatmasta 8y ago
> A phone is a treasure trove of SQLite databases This is so true. I've thought for a long time that a cool art experiment would be a blackbox with a lightning cable protruding out of it. You plug your phone in and answer "Do you trust this computer?" And if you do, those "SQLite databases" you mention get projected on the wall. A bit like the wall of sheep, I guess, but more for the purpose of educating people just how much data is actually on their phone.

ghaff 8y ago

>While photo metadata can be modified, Williams said the signs he expected to see for metadata modification weren’t there. “There is no evidence that these were modified,” he said. Assuming the person changed all data/time fields including those in the file system, what other signs of modification would there be? I poked around online and didn't find anything.

cgoecknerwald 8y ago
My first guess would be weather records from that day, if the photo was taken outside.