A newspaper article about Arsenal Consulting and the Sledgehammer forgery

There is a story today in the Chelsea Record about Arsenal Consulting, the forensic firm that identified the digital forgery in the Sledgehammer CDs. Here is Mark Spencer, the president of the company:

“Those responsible for forging these documents went through a significant amount of effort trying to be consistent. It was the consistency that surprised me. We’ve dealt with a lot of forgeries in the past and I’ve never seen something like this. Basically, I would say ‘they’ were crafty and consistent.”

The story continues:

“Spencer said that upon their initial investigation, things looked legitimate, but in hindsight it was only because the forgers had been so thorough.

Upon a deeper analysis of the CDs, Spencer said hidden in the documents were references to the Calibri font – something just about anyone who has used Microsoft Word is familiar with – as well as references to a particular type of ‘XML’ file.

The major problem with that – and a key part of the forgery proof – was that those things weren’t even invented yet in 2003, when the files were supposedly created and last saved.

“When we got a little more aggressive and found the font and XML issues, that’s when we knew something was very, very wrong here,” said Spencer. “Ultimately, we found nine Powerpoint files had references to a particular type of ‘XML’ and 71 Word and Excel documents had references to ClearType fonts like Calibri and Cambria. We talked to the creator of those fonts, and they weren’t available in Microsoft Office until the 2007 version.”

Believing the files were legitimate was becoming more and more of a stretch of the imagination.

“We were getting to the point where there was no legitimate way the files landed on there in 2003 unless we’re going to believe in time machines,” he said. “It’s just simply not possible.”

A similar situation unfolded with the hard drive, which was seized on July 2009 and stored at a Naval base in Turkey, supposedely under tight security.

“We found 120 files and folders on the drive that on first glance appear to have been created April 8, 2004, but we know from digging into the file system that they couldn’t have been created before July 28, 2009,” he said. “Coincidentally, many – if not all – of the incriminating documents are in that batch of 120 files and folders. The most likely scenario is someone attached that drive to a computer which was already backdated and copied those files and folders to the drive, then detached the hard drive and put it back.””

The digital evidence of forgery, along with all the anachronisms we have documented in the contents of the Sledgehammer files, leave no room for doubt: the Sledgehammer documents were prepared not in 2003, as the prosecutors claim, but years later, and their metadata were altered to frame the defendants.