| There is a much more plausible explanation: 1. The timestamps reflect some process that occurred before the files were uploaded to the internet. That's it. That's the plausible explanation. * Secondary transfer to removable media that changed timestamps * Transfer to network file server, likewise * Archival * Compression/decompression * Encryption/decryption * Analysis of files that touched them (set timestamp) to indicate completion Basically any process that proceeded at an average of 23MB/s would produce that pattern. And note, that it doesn't preclude the possibility that the timestamps changed many times between when they were on the DNC server and when they were made public. So indeed, the 23MB/s could indicate removeable media was involved, but it could have been from one Russian intelligence officer's computer to another's. Occam's razor: the simplest explanation is the most likely one: The timestamps reflect a process that occurred at a rate of about 23MB/s. We just can't speculate on what process that is. |
eg `rsync -aP` widely used by SysAdmin/DevOps people specifically sets the timestamp of copied files to match their source.