Craig Wright’s former lawyers say emails submitted to court ‘not genuine’

Patrick Madden took the stand as an expert witness during Day 16 of the Crypto Open Patent Alliance (COPA) v. Craig Wright lawsuit. Madden created the ‘Madden Report,’ which found that many of the documents produced by Wright were so different from the originals that they were likely forgeries.

After the day concluded, Wright’s ex-attorneys rang an alarm about certain emails found by Wright’s wife and introduced as evidence last week. These emails might also have been forged.

For context, COPA is suing Wright seeking a near-worldwide injunction against him claiming the copyright to Bitcoin’s whitepaper. Wright claims to be Satoshi Nakamoto, the creator of Bitcoin. COPA disagrees.

Previously, Wright’s attorneys attempted to call on the expertise and methods of digital forensics experts like Madden. This included one who seemed to agree with Madden’s analysis. Wright even attempted to claim that his enemies had created forged documents to frame him.

Read more: COPA v. Craig Wright trial analyzes newly published Satoshi emails

Opening questions

The day started with Wright’s attorneys going over a few technicalities. Cross-examiners said Peter Bryant had asked to submit evidence related to computing environment tests. They also said there had been a disclosure issue over the weekend and that Wright would be providing further details. Judge Mellor asked why additional forensics tests that had been requested by Wright were taking longer than desired. Then the issues were shelved to be revisited later.

Wright’s attorneys opened the morning’s formal proceedings by asking about Madden’s decision to include just a few paragraphs by way of background instead of his full curriculum vitae when creating his report.

Madden answered that he didn’t feel the need to include every course he’d ever taken. However, he did clarify that he’d taken a 12-week class to become qualified in digital forensics.

The Madden Report about possible Craig Wright forgeries

Madden reviewed about 500 documents for his report. He allowed that he hadn’t used the devices they had been found on, which he had expressed concern about, and admitted that some of the metadata could be altered depending on the environment. However, not all of it would be affected.

When asked about whether relying on timestamps could be misleading, he said, “Depending on the timestamps, yes.” Wright had allegedly tampered with his computer’s clock, which could affect timestamps. However, the digital forensics experts still found some peripheral evidence of the tampering.

Wright’s attorney brought up an analysis from his digital forensics expert, Dr. Plancks, in which she mentioned that some metadata like creation date or ‘last access’ date could be modified by something other than creating, accessing, or modifying the document.

Wright had made a lot out of copying files to different places in his testimony and Madden countered that it depended on which timestamp or file was being analyzed.

Read more: Craig Wright hits COPA trial with 164,000 pages of evidence

Operating systems and virtual machines

Again, the testimony went into some technical details such as Wright’s claim to run the Linux operating system and a Red Hat-created command-line package his attorney referred to as the ‘rox cluster.’ Madden allowed that he had “no reason to doubt it.”

They also discussed a virtualized environment that Wright allegedly created. A virtualized environment, also often referred to as ‘virtual machines,’ makes it possible to create a simulation of a computer environment in an isolated container on an existing host machine.

According to his attorneys, he also used Citrix to enable remote access to a workspace. Madden said he was familiar with analyzing data on Citrix but not with installing or using it. He also said establishing a remote connection to another server through Citrix would not cause changes to the files on the server to be saved on the user’s machine.

Madden disagreed with Wright’s attorney on whether someone opened a template loaded with Microsoft Word, or opened a new document. Madden said the template loaded when the document opened. It was possible to have the template launched when Word launched, but Word had to be configured to automatically launch a new document. He allowed that he was probably being a little pedantic about it, and Judge Mellor told him not to worry about it. It seemed to mostly matter because Wright had a template that used mathtype.

They went through Grammarly to see how it might impact a document. Madden admitted that he hadn’t done much with Grammarly before using it for the COPA v. Wright case.

Read more: COPA trial: ‘Very annoying’ Craig Wright was ‘into Japanese stuff’

Wright disagreed with Madden’s position that formatting options like fonts and font names would only save if the document was saved. Mellor responded, “He can if he wants.”

When it came up that Wright claimed to use xcopy, Mellor allowed that some settings could be tweaked to disable an update of the last access timestamp. However, he didn’t know which version of xcopy Wright meant and said he didn’t use it due to inaccurate saving of timestamps.

Wright may have altered timestamps

On whether unzipping a zip file could generate a new ‘date created’ timestamp, Madden again said it can depend on certain, highly specific conditions — such as how the zip file was created.

Again, they swung back to the alleged modifications of the Bitcoin whitepaper and had a brief exchange on Microsoft Word versions, which could generate different metadata results or even different default file extensions. For instance, Microsoft Word used the .doc file extension until 2007, when it switched to .docx to reflect the integration of Office Open XML.

Then they switched to talking about Wright’s alleged recreation of the Bitcoin whitepaper, during which he backdated his computer’s system clock to tamper with the timestamps. Madden confirmed that his analysis was accurate even though he allowed that he hadn’t looked too closely at the text.

The attorney presented a .odt file with an apparent timestamp of March 2008. Open Office and LibreOffice use the .odt file extension by default.

Forensics experts detected that the allegedly forged version of the whitepaper was created using LaTeX, a program that Wright also admitted to using. Maddox stated that he wasn’t as familiar with LaTeX but maintained that features included in Wright’s version of the whitepaper hadn’t been released in March 2008.