The metadata indicate that the emails had to have been copied locallyby someone who had physical access to the networkto some sort of mobile hard drive or flash drive.
We keep hearing this. And I agree that 49.1 megabytes per second (nearly 400 mbs) exceeds at least the typical Internet download speed.
So a couple of questions:
1. When the emails were downloaded to a thumb drive do they get a new time stamp. If so that would be all you need for a forensic analysis.
2. Is it really true that 49.1 megabits per second over the Internet is really impossible.
Two yes answers = Slam Dunk for the Inside Job Theory.
You should really read the detailed whitepaper on this, but basically yes to both questions. The timestamps are particularly interesting, as how they are handled depends on the type of filesystem. That’s all addressed in the analysis.