Of course. Even more likely is that the timestamps aren't forged, but are merely a result of the attackers copying everything to some sort of local storage a fe

Of course. Even more likely is that the timestamps aren't forged, but are merely a result of the attackers copying everything to some sort of local storage a few days before preparing the big dump to release to the public. It's possible that in reality the data was initially copied 3+ months ago. You can't rely on file timestamps as a sole mechanism of when the true "original" version of a file was created or modified. (This is "conclusion 2" from the post.) This isn't really news at all, and I'm kind of surprised Schneier thought it was worthwhile enough to publish it. Look at how incredibly sensationalistic this article is, which Schneier cites as the primary source: http://www.4thmedia.org/2014/12/breaking-we-can-conclusively-confirm-north-korea-was-not-behind-sony-hack/ http://www.4thmedia.org/2014/12/breaking-we-can-conclusively... "BREAKING: We Can Conclusively Confirm North Korea Was NOT BEHIND Sony Hack", seriously? I understand he just wanted to aggregate all the updates and commentary since his last post, but this is practically nothing and is just about bordering on FUD (I'd say "reverse-FUD" but that's not how it works, just like "reverse-racism" doesn't exist). So far, no 3rd party has provided any strong evidence showing that North Korea either was or wasn't involved.