Forensic Findings Undermine Craig Wright’s Claim to Be the Real Satoshi Nakamoto

11. “The King2.rtf” {ID_004695} {L2/49/1}

234. The document purports to be an article on network security, involving discussion of quorum systems, and part of what Dr Wright claimed was precursor work on concepts featuring in his development of Bitcoin. By its presence in BDOPC.raw, the document purports to pre-date 31 October 2007.

(a) COPA’s Reasons for Alleging Forgery

235. This is a document which was among the 71 New Reliance Documents that were inserted into the BDO Drive by the editing process and which the parties’ experts agree were manipulated [Madden / Lynch Joint Report [12] Q/6/5].

236. The document has been backdated. It is a Rich Text File created with the editor version Riched20.dll v10.0.19041. That version of Riched20 is the version associated with the May 2020 update of Windows 10. [Madden3 [86-91] G/5/34]

237. The section on BDOPC.raw above is repeated. Further:

237.1. Comparing the deleted version of this document to the disclosed version shows that this document did not exist in this form on 17 September 2023. [PM46 [12] H/278/4]

237.2. It was modified within BDOPC.raw at some point between 17 September and 19 September 2023. [PM46 [12] H/278/4]

237.3. This was done with the computer clock set back to 2007, in order to backdate the document.

237.4. The modification included deletion of metadata which were not contemporaneous to 2007 but which are contemporaneous to 12 September 2023.

238. A precursor version of this document was included in the deleted image InfoDef09.raw. Further, the same document was recoverable as a deleted file within BDOPC.raw [PM46 [29 H/278/8]. The recovered, deleted version of this document included the following: [PM46 [24] H/278/7]

238.1. An indication that the author was Craig S Wright. [PM46 [24] H/278/7]

238.2. An indication that the operator of the software in use was Craig S Wright. [PM46 [24] H/278/7]

238.3. A timestamp dating its creation to 12 September 2023. [PM46 [25.a.] H/278/8]

238.4. A Grammarly timestamp indicating it was interacted with on 12 September 2023 at 07:38:30 and 244 milliseconds. [PM46 [25.c.] H/278/8]

238.5. Reference to the use of Dragon Dictate software. [PM46 [25.d.] H/278/8]

238.6. A reference to the use of Zotero software version 6.0.27 [PM46 [24] H/278/7]. That version of Zotero was not released until 5 September 2023 [PM46 [20] H/278/7].

239. This document and the folder in which it was located contain metadata irregularities indicating the use of clock manipulation to alter their timestamps. [PM46 [12] H/278/4]

240. The document was sourced from BDOPC.raw. The section “BDOPC.raw” above is repeated. This document was added to BDOPC.raw by the Manipulation User.

241. Part of the chain of editing of document is another deleted document recovered from BDOPC.raw called “the King.rtf”. [PM46 [13] H/278/5]. “The King.rtf” was edited within one minute of “The King2.rtf”. “The King.rtf” contains:

241.1. References to the same user as author and operator of the software, “Craig S Wright”. [PM46 [18] H/278/6].

241.2. The same Grammarly timestamp indicating it was interacted with on 12 September 2023 at 07:38:30 and 244 milliseconds. [PM46 [18] H/278/6].

241.3. References to the font Calibri Light [PM46 [18] H/278/6], a font which had not yet been designed in 2007.

241.4. References to the same 5 September 2023 version of Zotero [PM46 [18] H/278/6].

242. Other related Dragon Dictate files, “The King.dra” and “The King2.dra” had existed within InfoDef09.raw and were deleted, and those files show similarly inconsistent metadata. [Madden4 [30-40] G/6/13].

(b) COPA’s Reasons for Inferring Dr Wright’s Knowledge / Responsibility

243. The effect of the tampering is to make the document appear to be supportive of Dr Wright’s claim to be Satoshi Nakamoto, contrary to fact.

244. This document was added to BDOPC.raw by the Manipulation User. The Manipulation User is Dr Wright. The section “BDOPC.raw” above is repeated.

245. The deleted documents record the user and editor as “Craig S Wright”. This information was deleted.

246. The deleted documents record the use of Grammarly in connection with the documents. Dr Wright is a user of Grammarly software.

247. The deleted documents record the use of Dragon Dictate in connection with the documents. Dr Wright is a user of Dragon Dictate software.

248. The deleted documents record the use of Zotero in connection with the documents. Dr Wright is a user of Zotero software.

249. Dr Wright has attached particular importance to this document:

249.1. It is said to be important to Dr Wright’s case because it is one of Dr Wright’s “versions of a paper titled “The King's Wi-Fi: Leveraging Quorum Systems in the Byzantine Generals Problem for Enhanced Network Security” that Dr Wright produced for an examination at the Sans Institute. The papers describe “using a proof-of-work chain to solve a problem in distributed computing known as the Byzantine Generals Problem, which is concerned with how to achieve consensus in groups that include hostile actors.” [Wright 6 E/21/3; Schedule 1 to Field 1, L20/223/5]

249.2. It is said to be one of Dr Wright’s “Notes, drafts and articles addressing technical concepts that underpin the concepts developed in the Bitcoin White Paper” [Wright6 E/21/3; Schedule 1 to Field1, L20/223/4]

250. The document was not disclosed at the proper time. It was disclosed instead from the BDOPC.raw image. BDOPC.raw is not a reliable source because it has been manipulated by Dr Wright. The section “BDOPC.raw” above is repeated.

(c) Dr Wright’s Explanations and COPA’s Rebuttal

251. Dr Wright accepted that this file (found on the BDO Drive) was created with a version of Windows which was the May 2020 update, and that it was feasible that there had been someone accessing the BDO Drive. However, he disputed Mr Madden’s findings that the version of this file found in the InfoDef.raw deleted folder contained signs of creation on 12 September 2023. Mr Madden based his findings on Zotero and Grammarly tags found in that equivalent version of the file, but Dr Wright claimed that Zotero and Grammarly do not work in the way suggested and do not have a plug-in for .rtf files. {Day5/76:15} and following.

252. COPA submitted that this explanation should be rejected as dishonest for the following reasons:

252.1. If the BDOPC.raw is accepted as being forged, it follows that documents on it should be treated as being forged unless they are documents which Mr Madden says are original to the image that was taken in October 2007.

252.2. Dr Wright accepts these documents have been tampered with, but blames Mr Ager-Hanssen. As set out above, that story lacks any credibility.

252.3. The files were clearly created using Grammarly and Zotero in 2023, as the unchallenged forensic findings by Mr Madden demonstrate: Madden4 Appendix PM46 {H/278/5}. There is no evidence to support Dr Wright’s assertion to the contrary, and Mr Madden was not cross-examined on the point.

252.4. Mr Lynch agreed with Mr Madden that ID_0004695 was manipulated: {Q/6/5}.