Latest / Parsing the Truth: One Byte at a Time / Epstein's Missing Minute Found

Transcript

Epstein's Missing Minute Found · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Hello everybody and welcome back
0:53
to Parsing the Truth One Bite at a Time.
0:56
I'm your Co host, Stacey Eldridge and as always, I am
1:00
joined by the brilliant Becky Passport.
1:03
Hey, Becky. Hey, welcome back everyone.
1:06
Glad to see everyone again so. We are doing something
1:09
unscheduled tonight. We were planning not to do this.
1:13
You know, it was not the plan to do this, much like it was not
1:15
the plan to do this the first time.
1:17
So what are we not planning to talk about tonight, Becky?
1:20
Well. Not planning to talk about
1:23
Epstein, but we're going to jump on the bandwagon again.
1:26
Yep, once again, we're jumping on the bandwagon.
1:28
On September 2nd, the House Committee on Oversight and
1:32
Government Reform released 33,295 pages of Epstein related
1:39
records and those were provided by the Justice Department.
1:42
We went out hunting after some prompting from some people to
1:46
look and see if we can find any more Epstein prison videos and
1:51
what luck we did find some more prison videos.
1:54
So we are going to walk you through everything that we've
1:59
found. We've got a lot of nice things
2:01
here to show tonight. So if it's one of those times
2:03
where you want to see where we're talking, talking about,
2:06
you can watch us on Spotify or you can head on over to YouTube
2:10
and watch us and we'll try to talk you through everything.
2:13
But sometimes it's just nice to have those visuals.
2:17
We looked around in the Google Drive link that was provided in
2:21
that press release from the committee and everything is in
2:24
Google Drive. There was a nice folder called
2:27
Natives that kind of stood out to me.
2:29
So I jumped through there and I started looking as much like I
2:34
do in any case for the outliers. I started looking out for the
2:39
big videos and then I kind of saw right away that those were
2:43
relevant prison videos. And then I looked, checked out
2:47
the rest of that folder and found some more prison videos.
2:51
Becky and I downloaded all of those files and I will go ahead
2:55
and start sharing my screen now. What I found interesting is that
3:00
these weren't called raw data files.
3:03
These weren't even released as raw data files.
3:06
They were released as natives, which can indicate more original
3:11
based versus the very first time they were released.
3:16
They were actually called raw video, raw image files,
3:20
something like that effect, and we said these were not, This was
3:24
a work product. So very interesting for how they
3:29
labeled them a little differently this time.
3:31
And I've not really heard any comments from the government
3:35
saying this is raw or this is native.
3:37
This is just the name of the folder.
3:38
So it is what it is. I have seen complaints where
3:42
people are like, well, there's 33,000 files, how?
3:45
How are we supposed to know what they are and what this is
3:48
relevant to? Well, I happen to find a helpful
3:52
little clue. At the root of that Google Drive
3:56
is a dot dat file 2025 I've brought up on the screen for you
4:01
in Notepad++, which is a handy little viewer for trying to make
4:06
sense of gobbledygook. And I've opened up the 2025 zero
4:11
822 dot dat. We had the known files that we
4:15
downloaded. So I started searching for some
4:17
of those names and lo and behold, I found them.
4:21
And I was able to see the original file names for not just
4:27
these video files that we were interested in, but for
4:30
everything. So if you're trying to make
4:32
heads and tails of this stuff, you want to head to the Google
4:35
Drive and download that dot dat file.
4:38
And I'm going to head back over to our blog post because that
4:44
has a nice table that we've made where we have the file name of
4:48
the video as it's presented in the Google Drive, and then we
4:51
have the original file name. And now Becky is going to walk
4:56
us through all of these new prison videos that were released
5:00
on September 2nd. This was interesting that that
5:04
we had 13 approximately 1 hour segment videos and so we started
5:11
looking at each one and and how they're labeled here, the video
5:14
names where they're out of sync. So it starts with ends with 155
5:20
dot MP4, the next one IS156157158.
5:24
These were how it was presented to us, but then it skips
5:26
TO154150, I'm sorry, one 53154 and so on.
5:31
So it was interesting to start to break it down and look at
5:35
these videos as what is the time frame that they are associated
5:41
with. And very much like the original
5:44
file name that Stacy found in that dot dot file, we see that
5:49
exactly at 1800, at 1800 on 8/9/2019 all the way through 810
6:01
of 2019 at 7:00 in the morning, approximately 7:00 in the
6:05
morning. There is no missing seconds.
6:09
We have approximately 1 hour to 59 and you know 23 seconds to 59
6:16
and 51 seconds. All of these files are
6:19
approximately at the same amount of time, video length.
6:22
They have original file name associated with them.
6:25
And then we have a time frame and where one one time frame
6:29
ends, it picks up within a second.
6:32
Sometimes it overlapped a couple of times like on a 161 and 162,
6:38
it started at 3:00 AM and 11:00 seconds.
6:43
So if you if you follow through with this, you'll see that there
6:47
is absolutely 0 missing time and they are all consistently
6:54
provided with the right hours of information and we looked at
7:01
those. Yeah.
7:02
So all of these times are in the local time zone, Eastern Time
7:07
zone. Becky, do you want to kind of
7:08
talk about some of the visual things that you saw in these 13
7:14
new files versus what we saw in the big long nearly 11 hour
7:20
video that was released back in July?
7:23
In the big videos that we saw that were released in July, we
7:27
see at the top it it it references a location.
7:32
I believe it starts with like 160 and it references that
7:36
location and then in the bottom corner, left hand corner, it had
7:42
the date and the time and then over in the right hand corner it
7:48
had the word play like it was following a play, like it was
7:52
following and watching a video versus these thirteen one hour
7:58
segments of video. The information is all centered
8:04
in the bottom of the video. Looking at that it looks more
8:13
what you would see if you exported or you were looking at
8:17
it directly on the DVR before it was exported.
8:21
And so it in my opinion it looks more native and I like that term
8:25
they use here. Looks more from a level of a DVR
8:29
viewing. It also has a, I would say much
8:33
better clarity. Viewing it, it's a it's a little
8:37
clearer, but at times it could be a little light colored or but
8:41
the color, the text format and the quality seemed much
8:47
different. Yeah, it was a bigger and better
8:50
quality in the videos that were released in July.
8:55
And if you look at the metadata, you can easily see that it is a
8:58
much smaller quality in these one hour segments that were
9:03
released. And but we don't and we'll kind
9:06
of get into that. But we don't know why the
9:09
quality is different other than we know for sure that that July
9:13
video was work product and that would be a logical reason for
9:18
why they put it into an Adobe product and we're trying to
9:22
enhance it. And remember with video 2 dot
9:25
MP4, they did say that this was the enhanced version where they
9:29
were trying to brighten it and stuff like that.
9:31
So clearly between what was released September 2nd and in
9:35
July, there is a difference in video resolution and because one
9:40
video resolution of of these smaller files is much smaller
9:45
than that makes for a poor quality video.
9:47
And so you kind of get to see some of that, we'll call it
9:50
ghosting, where it's kind of pixelated when there's some
9:53
movement going on. But we do like the fact that in
9:58
the video you're seeing at the bottom of the screen the name of
10:01
the camera and the date and the time stamp in there.
10:04
That makes us think maybe that this is much more likely that it
10:08
was exported from the DVR system.
10:12
We didn't see a mouse right floating through the screen.
10:16
Yeah. No play and stop and start
10:19
controls just on that visual review.
10:22
And then knowing that the resolution is much lower and
10:25
what we're seeing, it seems much more likely that this is
10:28
something that came from an actual DVR system.
10:33
This is not something that has been manipulated or enhanced on
10:38
first glance. And so as I mentioned, we kind
10:42
of, you know, we originally found the big stuff and so we
10:45
knew we had video 1 and video 2 from July.
10:49
So we wanted to see what other big videos we could find out
10:52
there. And we found another 220 gig
10:57
files and they are they end with 1169 and they respectively
11:04
appear to visually match the videos in July 2025 that were
11:09
released 168 matches video one where 169 matches video 2.
11:16
And then of course, when we reviewed that dot file, it did
11:21
say that those two files came from video one and video 2
11:25
respectively. Now, of course, we're digital
11:28
forensic examiner. So my while we do look at stuff
11:31
with our eyeballs all the time to see what we can see, we also
11:35
have to dig down more into the data.
11:37
We did just that. And once again, we use that EXIF
11:42
tool now. Becky, do you want to talk a
11:43
little bit about like EXIF and metadata?
11:46
It's. It's it's a great tool for us to
11:49
be be able to quickly drop these files into this tool that not
11:55
only gives us dates and times, but it gives us what it was made
11:59
with or it could give us a flashpoint.
12:02
It just gives us more details. And so EXIF tool is one of the
12:07
tools that we as forensic examiners choose to use to get
12:12
more in depth metadata about video or a file or a picture.
12:18
Right. And we use this tool even though
12:20
we have super expensive forensic tools that we also use because
12:26
the difference is that expensive Jack of all trades tool can't
12:29
necessarily do everything at the deep level that we need it to.
12:33
I think now is a good time to kind of compare and contrast the
12:37
video one and then the 168 file that was just released.
12:43
This is all the EXIF data that we extracted.
12:45
And if you head over to the blog, you can see the command
12:47
that we ran to get this specific set of data.
12:52
And I use it with the options to get the most possible data.
12:56
But you'll hear us refer to some of these QuickTime tags, the
13:00
track tags. And then if you remember from
13:04
July, everybody was all up in arms about Adobe, Adobe Media
13:10
Encoder being seen in there and some other stuff related to
13:13
Adobe. Well, all of that Adobe
13:16
information is stored in these XMP tags.
13:20
And that's where we got all of this Adobe information last
13:23
time. And I'm just going to scroll
13:25
through here, but you can see there is a ton of information in
13:30
here. And for some reason, Adobe uses
13:33
food references, there's pantry entries, there's ingredients,
13:38
all of that good stuff. And this is also where we saw
13:41
the names of some other files that were the ingredients that
13:46
were used to make video one. But the, but the nice thing
13:51
that's in here, lots of great date and time stamps, you know,
13:54
we see the created and modified dates and the XMP tags of, of
14:00
May 23rd of this year starting, you know, at 7:00 PM and some
14:06
modification happening at 8:15 PM.
14:10
And we see some of those time stamps throughout.
14:13
But when we move over to 168, which was made from video 1
14:20
based on that dot DAT file, we're going to see something
14:24
different and we'll get into why it's different as well.
14:28
But here you can see it's kind of starting off the same.
14:31
You've got your system information, you've got some
14:33
QuickTime tags. It still says the same modified
14:37
and created information here as well.
14:41
It's still matching for the tracks and stuff like that.
14:45
So that looks good. But as we're continuing to
14:47
Scroll down, the XMP data is gone, right?
14:53
Becky, do you want to talk about how we know that happened and
14:57
why it happened? It's an informed, educated
15:00
conclusion based on on what we have.
15:03
When a when a another program such as an E discovery tool is
15:08
used to extract the data or booze other videos to create the
15:15
data, it will strip that metadata.
15:18
So it's going to strip that XMP data off of there because of the
15:22
ediscovery tool. And so that is where we have
15:26
come to the conclusion that the XMP tags that contain that Adobe
15:32
information in Video one are now absent.
15:35
Yep. And we based this on the fact
15:37
that we saw that dot dot file that had all the original file
15:41
names and then the new file names in the file pass.
15:44
There's also a dot OPT file in there well as well that gives
15:49
similar information. And both of those files together
15:51
is indicative of some sort of E discovery tool being used to
15:56
process the files. And when we say process the
15:59
files, we mean just basically like renaming them because when
16:03
you're doing discovery, it's just like going in and out and
16:06
organizing it into folders and stuff like that.
16:08
So we don't know what E discovery tool was used.
16:12
We don't know what any of the settings were.
16:15
We don't know if this happens every time with the E discovery
16:18
tool that was used or if this was a special setting that was
16:21
used. But for whatever reason, there
16:25
are there are no more of these XMP tags.
16:28
But we can see from the dot dot file that it did come from video
16:33
one. That's right.
16:34
And then Becky, what else also happened because the metadata is
16:40
now different between video one and then the new file 168?
16:45
We hashed the original video one and video 2 that was released in
16:49
July and then we hashed these videos 169 and 168 and that hash
16:56
value changed and that's due to the metadata being stripped as
17:00
well. Yep, absolutely.
17:02
So that's again why it's important to hash files all the
17:04
time. I wish again they would give us
17:06
hashes so we know we're downloading, because once again,
17:09
in this Google Drive, hashes are notably absent.
17:12
Right, right, so we hashed them all and have something to
17:16
compare it to. Yep.
17:17
So we have our hashes and we will get them up on the blog.
17:21
So if you're downloading stuff and want to check and compare,
17:23
you can compared to us as well. So we have the EXIF data from
17:27
the 168 file and the video 1 and you can see how the created
17:32
times from the QuickTime tags and the modified times still
17:35
match. The duration still match.
17:38
But for whatever reason, 1 is in like hour, minute, second, then
17:41
the other one is in this goofy Adobe time.
17:44
But anyways, they they both do equal the 10 hours, 52 minutes
17:49
and 24 seconds. That's right.
17:51
Now, we also went through all of the 13 files that Becky was
17:55
talking about and reviewed their metadata as well.
18:00
So let me pull up one of those to share with you.
18:03
So this is 154 and this is the one that starts at 11:00 PM and
18:10
goes all the way through to midnight.
18:13
And we'll talk about the words all the way through to midnight
18:17
in a minute. But you can see that this one
18:20
starts off the same, but the there's not a whole lot of
18:25
valuable information in in this EXIF data that we were able to
18:29
retrieve. Now this file has a modification
18:32
date of time of August 4th, 2025.
18:35
That is most likely when the file was outputted slash created
18:41
through the use of that E discovery tool that recent date.
18:47
But if you continue to Scroll down under the QuickTime tags,
18:51
we don't have any create or modified dates here.
18:55
Same thing with the tracks. There's not really any clues in
18:59
here as to what created this file.
19:06
That's right. And so, Becky, you know, we kind
19:08
of talked about it like why do we think this metadata is here
19:12
like that? The tool that the tool that was
19:14
used to export it or the tool that was used to create these
19:19
files so that they were pulled directly likely from the DVR for
19:24
them to be viewed. So in doing so it it only gives
19:28
us partial information, the one hour segment files as you
19:32
mentioned that file system. Right.
19:34
And we don't, we know the DVR system was old.
19:37
It was scheduled to be replaced. And let's remember, this is 2019
19:40
and it was already old. So we don't know the brand or
19:44
anything like that. So that could certainly account
19:46
for the lack of metadata being embedded within the files
19:50
themselves. And it certainly could account
19:52
for the low quality of the videos themselves when you watch
19:56
them and that the resolutions, you know, we don't know if they
19:59
selected it to be small video. We don't know if they selected
20:04
to have no EXIF data. We don't.
20:06
There's lots of things we don't know.
20:08
Right, right. And what we don't know is are
20:11
these with raw files? And why don't we know that?
20:14
Why don't we know if these are the raw files?
20:18
And basically, we don't know it because there's very little
20:21
metadata to be associated with it.
20:23
It's been run through that ediscovery tool.
20:26
Again, stripping off more information, because if we at
20:29
least had the original files before they were ran through
20:34
that ediscovery tool, we definitely might have more
20:37
metadata. But then we could also have some
20:39
more dates and times, some created and modified dates and
20:43
times, you know, and we would be wanting those to be back in 2019
20:48
when they first got that DVR system.
20:52
Exactly the old DVR system. Absolutely that old.
20:55
DVR system. Now earlier I hinted that the
21:00
file 154 goes all the way through midnight.
21:04
Becky, why is it so interesting that I'm saying the file goes
21:08
all the way through until midnight?
21:11
Well, because. On the two videos that we
21:15
analyzed that came out in July, there was a time stamp on the
21:22
video that stops at 115858 and starts at 12 is.
21:31
That a missing minute. That was a missing minute and
21:34
two seconds of something missing minute and two seconds.
21:37
However, from our analysis this 8/9/2019 goes to 235959 which
21:46
covers that one minute and two second time frame.
21:52
So we have found the missing minute.
21:55
We did we. Found no longer lost.
21:58
It was. It was never lost to a system
22:00
reboot. Yes, and it clearly there is 0
22:04
system reboot that occurs here. File continues 154.
22:11
The file that ends with 154 dot MP4 ends at 235959 and guess
22:18
what 160 starts at 235959 and continues on until 111 AM in the
22:28
morning. So we have clearly seen there is
22:32
0 reboot and how the data was pulled out and off of this DVR
22:38
is 0 seconds or missing. And it still kind of goes back
22:42
to what we talked about in July. Why was it called RAW Files?
22:48
Who said that? And it's also now we're asking
22:52
what is the origin of this system reboot?
22:56
We all know Miss Bondi said it in to the media, but we don't
23:01
know why she said it. Did somebody tell her it was a
23:05
missing minute due to a system reboot?
23:06
What is the origin of the missing minute and the system
23:11
reboot story? No, no idea.
23:13
No idea. No idea if presented the videos
23:18
that we analyzed in July and the only conclusion the person who
23:24
was analyzing or presenting the material to Bondi was that it
23:31
must have been it had to have been in fact, I want to say I
23:34
heard on the news that it Bureau of Prisons said there is a
23:40
reboot every night and that is where that one minute and two
23:43
seconds. So that information was relayed
23:45
to her and she related to the media without a full analysis as
23:50
analysis of all 13 one hour segments.
23:55
And this is what happens when you start concatenating files
23:59
together and then you're you're starting one file, you're ending
24:03
another file, you're starting one file and you're ending
24:06
another file. They come together and then
24:08
missing data. It appears that data is missing
24:11
and there's no data missing. Nope.
24:13
There's a time frame there's. No missing minutes anymore.
24:16
Becky accounted for all the minutes and seconds and all
24:19
those 13 video segments. Let's let's talk about what
24:24
happens in that missing minute. I know Becky, you were going
24:27
through that with a fine tune tooth comb.
24:30
Give us the details on that missing minute.
24:32
So what what was found to be different was there is movement
24:36
again there is movement by guards.
24:39
That is that when that 115858 stops on the one video one, it
24:47
stops and picks up at 12. You don't see any activity.
24:51
But during the time frame that you watch in the one hour
24:56
segments, you actually see more activity.
25:00
You see a guard stepping away from the guard desk and walking
25:04
off scene towards a doorway or a cell area.
25:08
And then you see that guard come back and come back up the stair
25:12
where stairwell where you also pick that up on the video number
25:17
one, right. So we do see movement.
25:20
Yeah, yeah, so is and it and it was almost towards the end of
25:27
the August 9th. It was towards the end of 1159 I
25:31
think it was like, you know, it depends where you want to count
25:34
the the movement from about 44 seconds, 45 seconds.
25:38
So like maybe 15 seconds left in the day.
25:40
This is where you see the cards start to move kind of at an
25:43
angle. And again, it's not high
25:45
quality. You kind of got some of that
25:46
ghosting stuff going on. So it's hard to tell, but it's
25:50
definitely a person moving towards the corner of the screen
25:54
and they're going kind of off towards where where the entrance
25:57
to the prison cells were. But then you see him reappear.
26:03
Oh, do you remember about what time it was like 12 O 1:00 AM
26:06
and how many? Seconds.
26:08
Yes, it was. It was all the way into the next
26:11
video of 160 where it was definitely within a minute of
26:19
that that midnight time frame. Yeah, and you see him walk back
26:23
onto frame downstairs because remember the cameras like
26:28
upstairs in the stairwell. So you see him come back into
26:31
frame downstairs and then, you know, you lose him.
26:35
But then he pops up at the top of the stairs, he walks across
26:38
straight in front of the video and then he goes to use the
26:41
phone to get out of there and he's leaving the floor through
26:45
that door in the stairwell by 12O2, 02 AM on the 10th.
26:50
That's right. So he, he was always in there
26:52
after midnight. It's just that one minute that
26:55
was missing at 11:59 PM. He's in there for 1415 seconds
27:00
and that was never there before. That's right.
27:02
That's right. We found the missing minute.
27:05
We've got 13 new files, but Becky and I have concluded we
27:10
are still missing 2 videos. Two video files.
27:14
That's right. We feel like we're getting so
27:16
close, right? Like everybody was pretty
27:18
excited in July, All right? They've released the Epstein gel
27:21
video. Then there was a minute missing.
27:24
Now we've got 13 more videos. We've got a minute back, but now
27:29
we're still missing 2 video files.
27:31
And why are why do we say that we are still missing 2 video
27:35
files? Stacy this.
27:36
Comes back from all of that EXIF data that we reviewed in video
27:42
one dot video one dot MP4. Remember the Adobe stuff listed
27:46
all of the ingredients. And so there were two videos
27:51
that were the ingredients and they had file names that were
27:55
named after dates and times. They were 2025-05-22MP4 and then
28:04
25 or yeah and then 2025-05-2216-305-21 dot MP4.
28:16
And so if if you couldn't track all that in your head, I don't
28:20
blame you. But basically what it's supposed
28:21
to be doing is like on one video was probably created on May
28:28
22nd, 2025, beginning at 9:00 PM in the evening, probably a local
28:35
time. This is probably when either the
28:38
screen capture was started or when it ended.
28:42
And then the same for the other one.
28:43
The other one would have been started earlier at 4:00 in the
28:47
afternoon. And because we know that the
28:50
video is nearly 11 hours long, we would expect these two videos
28:55
combined together to equal almost 11 hours long.
29:00
But maybe they account for 13 hours because all of these 13
29:04
videos equals 13 hours of video. So maybe those two equal more.
29:11
Now, Becky, why do we want these two video files?
29:14
Believe these two video files are going to help us to answer
29:17
why the time frame was started at 7:40 PM when we clearly have
29:25
video that goes back to 6:00 PM or 1800.
29:30
So we have video that goes back to 1800 on 8/9 of 2019 all the
29:36
way through 810 on 20/19 at 7:00 AM in the morning.
29:42
The time of these videos, Video one and Video 2, they start at
29:49
7:40 PM and they end at 6:40 AM. We clearly have more data that
29:57
can be before and more data that can be after.
30:01
But why are these specific videos used and why do they
30:06
start at a specific time? Why is it stopping at 115858 and
30:12
then starting at midnight and then ending at 6:40?
30:16
And is this 2 files that these two files were chosen and
30:21
because they were concatenated together that 115858 and the
30:26
12:00 are two? You know, is where one video
30:30
stops and one video starts. And because of that, these two
30:34
video files would help answer more questions.
30:37
Yeah. And one of the questions it
30:38
could answer was, was the missing minute in either one of
30:43
these two files? And then of course, there's
30:46
additional questions because if it was in there, then the next
30:49
question is why was it cut? And then if it wasn't in there,
30:53
the next question is why wasn't it in there?
30:55
So as a digital forensic examiner, we're used to this.
30:59
We get one answer and then we always have more questions.
31:02
This is just how it works as you're going down the rabbit
31:05
hole of digital evidence. And just trying to understand
31:08
all these time frames and these videos.
31:10
And clearly we, we talk about time, we talk about dates, we
31:15
talk about metadata. And we, we, we want to focus on
31:20
the facts. We're, we're here to tell you
31:22
the truth. And, and we got closer with the
31:25
video, with the videos that were downloaded and dropped yesterday
31:30
and released yesterday. But now we still haven't, we
31:33
still have questions. We still have a few more
31:35
questions. We say we would like all of the
31:38
original 13 video files before they've been run through the
31:42
processing tool or the ediscovery tool, whatever they
31:46
they've used. We'd like to see that and we'd
31:48
like to see those two files that were the ingredients for video
31:52
one and video 2. So I don't know if those will
31:56
ever come out. I've, we've been busy working on
31:59
this, so we've not been tracking the news to see what the current
32:03
uproar is about what they've released.
32:06
I know yesterday a lot of what I saw was there's so many files,
32:09
how can we make sense of it? Well, we've given you the clue.
32:11
There is a dot dot file. Take a look at that for the file
32:14
names. Now, not all of the file names
32:17
are meaningful, but some of them are.
32:19
Helpful. And again, it goes back to why
32:22
do you look at metadata? Why do you look at time stamps?
32:25
Why do you build a timeline? Why do you, why do you analyze
32:29
it at the level that you analyze it?
32:31
Why is it important to have more closely related raw files?
32:35
These, these, these are very closely related to raw files.
32:39
The only thing missing is that stripped metadata that would say
32:44
when they were actually created. As far as that goes in in any
32:48
other details, especially ADVR system, it might tell us more
32:52
about the DVR system, but. Yeah, it might.
32:55
It might not. We just don't know.
32:57
That's right. That's.
32:58
Right. The more we get, the more we can
33:00
tell. But the good thing about these
33:02
13 segment files is that we have second to second noted from
33:10
8/9/2019 to 8/10/2019. Zero seconds missing.
33:15
Yep, so that is that is a huge win in terms of accountability.
33:19
Still doesn't look good, but at least the missing minute has
33:23
been found and is no longer missing.
33:26
That's right. So with that, until next time,
33:29
stay safe, stay sharp, and as always, keep parsing the truth
33:33
when bite at a time. If you enjoyed this episode,
33:37
make sure to follow us to get notified the next time a new
33:41
episode drops. If you can do more, head on over
33:45
to parsingthetruth.com and donate by clicking on the donate
33:49
button. Parsing the Truth is a nonprofit
33:51
organization and we are raising money to send a new digital
33:54
forensic examiner to I Asus training next year in Orlando.
33:59
Thanks.