10

Was the video implicating rebels in the shooting down of MH17 created the day before the crash?

enter image description here

Example claim

donwload SBU video of recording of rebels talking of downing #MH17 and check the creation date: 16/07 the day before!

 #pt try yourself, SBU recording video on SBU youtube account: https://www.youtube.com/watch?v=V5E8kDo2n6g

Sklivvz
  • 78,578
  • 29
  • 321
  • 428
Andrew Grimm
  • 38,859
  • 36
  • 141
  • 342
  • 2
    The detail view shown has a 10-digit number along with the apparent timestamp. Normally, I'd expect that to be a UNIX timestamp, but the value is way out of range (some point in the future). None of my attempts to shift this (ie, UNIX timestamps are often stored as 32-bit integers, so implies certain limits on values) have resulted in anything remotely plausible. This is ignoring the possibility that somebody had the recording device/camera set to the wrong date/time in the first place. I don't know about whether the video is them _planning_ it, which might be day before... – Clockwork-Muse Jul 20 '14 at 07:41
  • Isn't it just US time instead of Ukrainian time? Timezone would be the first thing I'd consider. – sashkello Jul 20 '14 at 08:03
  • 4
    There is [a post claiming that this might be caused by a Youtube bug](https://gist.github.com/klaufir/d1e694c064322a7fbc15) that sets the date wrong. – Mad Scientist Jul 20 '14 at 10:05

1 Answers1

21

Timestamps are not a good source of information unless you are really sure where they come from. They are set using the system time of the computer creating the file, which might, for example, be set incorrectly; or the program might make a mistake when creating them or writing them to the file. For a quick demonstration of why timestamps are not reliable, I have had a look at the video in question, using the same program with which the screenshot was made for your source. You will see that one of the tracks was created about 110 years ago; if this is evidence of a set-up, then it was done by the Russian Imperial secret police.

Information on SBU video

The particular problem of videos which are one day too old is very easy to replicate. I just took an old video and uploaded it to Youtube. The original creation date of the video was back in 2013, which is what the Format Analyzer shows (correctly). After I re-downloaded the video from Youtube, the creation date was given as 19.07.2014 - that is, one day (26 hours, to be exact) before I uploaded it. You can try this out for yourself, or look at reports that have documented the process in more depth.

As for the source of this strange behavior: the timestamps used in computers generally count the seconds that pass from a particular date. MPEG-4 files use the Macintosh epoch, which started on January 1st 1904; most web servers run Unix, where the epoch starts on January 1st 1970. You can find all this information in the ISO/IEC 14496-5 format documentation, together with the information that you need to add exactly 2082758400 to get from one epoch to the other. However, if you do the math, you will see that the real difference is 2082844800, with a difference of 86400 seconds, or one day. That is not my discovery - it has been noted before. Therefore, if you follow the standard (which Youtube apparently does), your date will be off by one day.

This is not to say that the recording says the truth. However, there is no evidence that it was "made before the crash".

P_S
  • 3,554
  • 23
  • 29
  • 5
    The Russian Imperial secret police have [form](http://en.wikipedia.org/wiki/The_Protocols_of_the_Elders_of_Zion) for this kind of thing! – Andrew Grimm Jul 20 '14 at 09:06
  • 1
    You should reference some authoritative source claiming that we can't trust youtube timestamps. Showing an inner track has a broken timestamp does not invalidate the other timestamp. – Sklivvz Jul 20 '14 at 13:12
  • 1
    For example, timestamps are considered forensic evidence here: http://www.acsac.org/2010/program/posters/ding.pdf – Sklivvz Jul 20 '14 at 13:14
  • 4
    @Sklivvz You're right, I'll try to provide more sources. However, if I understand the paper you cite correctly, it is about files you get *together with the system*, and even then it states that "such forensic results are not reliable". – P_S Jul 20 '14 at 20:05
  • For time stamps to be forensically accepted, they must be internally consistent with other data from the filesystem! This is why forensic imaging is so critical - any missed step can invalidate all data or inferences from the investigation! – Rory Alsop Jul 21 '14 at 15:26
  • 1
    The github link is dead. – Emil Jeřábek Mar 23 '16 at 16:41