[Clubber]

From what I can tell, he's also basing the transfer speed on last modified dates. I'm not overly familiar with the details of Linux last modified date, but I don't believe there is a history of last modified, it's just a single date per file. If that's the case, it only indicates the time of the last copy, which could have been from the downloads (or whatever) folder to a thumb drive after the download.

The data was likely initially copied to a computer running Linux, because the file last modified times all reflect the apparent time of the copy and this is a characteristic of the the Linux ‘cp’ command (using default options).

Don't get me wrong, I wouldn't put it past either political party to do something like this, but the evidence seems somewhat weak if I'm understanding it correctly.

[kbenson]

Apparently they've never heard of rsync and -t (--times), which is implied by -a (--archive), which is recursive and copies all relevant data for archival purposes, and is the first flag I use with every single rsync command? There are plenty of file copying/syncing techniques that preserve timestamps, and if the files were previously copied to/from a device that did not (such as a thumb drive to the computer they were eventually stolen from), then it would stand to reason that the modification times would represent the times of that prior copy operation.

I mean, file timestamps have been used by some really smart people to make intersting assumptions about what's going secretly on in very interesting ways, such as Tsutomu Shimomura reportedly looking at library access times while covertly on the same remote system as Kevin Mitnick to make assumptions about what he was compiling (I don't recall the source, it may even be made up), but this isn't one of them.

[saghm]

It's also completely trivial to arbitrarily change the "last modified" date of a file to literally anything you want on Linux with `touch -t`.

[nikita2206]

I understood it as he compared last modified of two files that were downloaded consecutively. Now if you take the difference between those last modified dates that would be the time spent downloading one of these files (which one is up to which date was greater). That is assuming that files were being copied synchronously one by one (like cp would do)