CYFOR’s Klaudia Sokolowska testimony in Hodlonaut Norway trial casts more doubt on digital evidence

Testimonies in the recent “Hodlonaut” trial in Norway have highlighted many problems analysts encounter when using digital files as evidence. We previously looked at the lengthy testimony of BDO Norge manager Dashley van Schijndel, and the latest video is that of Klaudia Sokolowska, Cyber and Corporate Investigator at CYFOR. Like Schijndel, Sokolowska found several examples where a KPMG file analysis showed inconsistencies or produced results she could not replicate.

As we’ve mentioned before, the difficulties these analysts encountered only prove the need for a scalable, universal “ledger of truth” such as the BSV blockchain. Documents saved on-chain (not on additional “layers” or on third-party networks) will always show exactly when they were created and by whom, and have timestamps for any changes.

Though she found KPMG’s report examining over 70 files to be quite thorough, Sokolowska notes some of the difficulties that present when attempting to prove digital activities from over a decade ago. The best way is to attempt to recreate the exact same environment in which they were created, using older hardware and software versions—though it’s impossible to create a 100% exact replica, meaning there’s always the chance some other unknown factor could be affecting the results.

On-chain records would not require such time-consuming and ultimately unreliable efforts since there would be an auditable record of all events from the creation date to the present.

Like BDO’s Dashley van Schijndel before her, Sokolowska was called to analyze the analysis: a digital forensics report from audit firm KPMG. Granath produced the KPMG report to support his case, while Schijndel and Sokolowska testified for Dr. Wright.

Wright’s counsel asks Sokolowska if KPMG’s testing environment met with her satisfaction. However, she says she didn’t receive an adequate description of this to perform a real verification of her own. She says that if she had produced a report like KPMG’s, she would have published more detailed information on exactly what hardware, software, and methods they used.

In digital forensics, one has to keep in mind that if an independent third party wants to test the results, they would need to recreate the same environment, she states.

Like BDO, CYFOR also noted that the MD5 hash value of a document uploaded to SSRN.com in 2019 (the original Bitcoin white paper) was different from the one recorded by KPMG. Neither BDO nor CYFOR could explain this discrepancy, and Sokolowska says it may indicate either the file had been re-uploaded between the analyses or that KPMG entered the wrong hash value.

Sokolowska is also cross-examined on other inconsistencies KPMG found, such as long editing times and metadata indicating software versions and fonts released more recently than the original documents. Again like BDO, she says “total editing time” is not a reliable metric due to differences in the ways hardware and software record those times. As for software versions, she says it’s possible that some users might have access to pre-release versions a while before they’re published officially. However, this is just one possibility to explain the situation.

Overall, the digital forensic analyses of Dr. Wright’s discovery evidence and assessment of those analyses indicate it’s still difficult (if not impossible) for the files to convince anyone 100% one way or another. Dr. Wright’s critics will forever contend that he “forged documents” to prove his claim to be Bitcoin creator Satoshi Nakamoto, while his supporters will point out these claims are more circumstantial and implied than definite. Dr. Wright has said all along that all of the items turned over in discovery could have been compromised and its provenance cannot be ensured. All they really prove is the need for a better way to create clear timestamps and records of evidence in a digital world. 

Watch Granath vs Wright Satoshi Norway Trial Coverage Livestream Recaps on the CoinGeek YouTube channel.