One of the major differences between Mr FOIA and Guccifer 2 is the latter’s use of email to correspond to journalists.
G2 contacted Gawker and Smoking Gun on June 15, corresponding further with Smoking Gun on June 21 and June 27. He corresponded with Vocativ on July 4-5 and with the Hill on July 11 and 14. Both the content and metadata are available for the June 27, July 4-5, July 11 and July 14 emails. Threat Connect has been the most prominent in using email metadata in efforts to link Guccifer 2 to Russia: here, here, here. Jeffrey Carr has been one of the most prominent critics of these metadata analyses.
In today’s post, I’m going to discuss some timestamp information that, to my knowledge, has not been previously canvassed. The analysis turns on information from the accumulation of a chain involving different time zones. Readers of Climategate emails will recall many such chains as emails passed forth between CRU and the US.
First, here is a screenshot of an email from guccifer20@aol.fr to The Smoking Gun offering emails on Hillary Clinton’s staff. (For orientation, this is three weeks after Trump Jr’s meeting and one week after the first memo in the Steele dossier.) It’s received at 3:43 PM Eastern (Daylight).
TSG replied a few minutes later, expressing interest, resulting in a second email from Guccifer 2 (Stephan Orphan) at 4:18 PM (Eastern). Within the thread, there is timestamp information on the timezone of G2’s computer: Guccifer 2 received his answer from Smoking Gun at 14:46- implying his timezone is reading one hour earlier i.e. Central.
The same applies to a subsequent email, where once again the receive time for Guccifer 2 appears to be in a timezone one hour earlier (Central).
Discussion
The time zone information here is consistent with the time zone information on the cf.7z dossier. Because computer time zones can be set and reset in a few seconds, so one cannot place much weight on this. I don’t know how far a fake timezone setting in a computer is carried forward into email headers and metadata. I’d be interested in information on this. While this indicia seems fairly slight, other indicia used to attribute Guccifer 2 are just as slight if not worse.
Source