# LIES!!!!!!!!! All Lies!

**URL:** <https://forums.suse.com/t/lies-all-lies/22834>\
**Category:** Chatting over the Back Fence\
**Created:** [July 10, 2012, 4:06pm UTC](https://forums.suse.com/t/lies-all-lies/22834 "2012-07-10T16:06:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![System1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@System1](https://forums.suse.com/u/System1)\
**Post date:** [July 10, 2012, 4:06pm UTC](https://forums.suse.com/t/lies-all-lies/22834/1 "2012-07-10T16:06:20Z")

</div>

[http://blog.spiderlabs.com/2012/07/how\_much\_data.html](http://blog.spiderlabs.com/2012/07/how_much_data.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\
**Post date:** [July 10, 2012, 4:21pm UTC](https://forums.suse.com/t/lies-all-lies/22834/2 "2012-07-10T16:21:13Z")

</div>

Rule #1 of a Forensic Investigator, actually learn what the logs show.

The logs were 100% accurate but did not contain the data that you  
wanted, which would not have been very valid anyway.

The fact the bytes are unchanged does not indicate the content has not  
changed.

The logs actually show the more useful data of the amount of data being  
transferred.

If you want to make sure the “Source” is unchanged, dont look in log  
files for the byte size of files, run frequent MD5 checks on the source  
files.

I’m guessing this article is because he did a faulty job someplace where  
he made faulty assumptions about what the data in the log showed and is  
now trying to defend his own mistakes.

On 7/10/2012 9:06 AM, JayZie wrote:[color=blue]

> [http://blog.spiderlabs.com/2012/07/how\_much\_data.html](http://blog.spiderlabs.com/2012/07/how_much_data.html)[/color]

–  
Craig Wilson - MCNE, MCSE, CCNA  
Novell Knowledge Partner

Novell does not officially monitor these forums.

Suggestions/Opinions/Statements made by me are solely my own.  
These thoughts may not be shared by either Novell or any rational human.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\
**Post date:** [July 11, 2012, 12:56am UTC](https://forums.suse.com/t/lies-all-lies/22834/3 "2012-07-11T00:56:19Z")

</div>

That’s really not the mystery they made it out to be… I’m no forensic  
investigator, apache ninja or an ip flow wizard and I new right away the  
larger byte number was with header data.

I mean, comeon’, computers don’t make stuff up.

Well, not Linux ones anyway. 😃

On 7/10/2012 8:06 AM, JayZie wrote:[color=blue]

> [http://blog.spiderlabs.com/2012/07/how\_much\_data.html](http://blog.spiderlabs.com/2012/07/how_much_data.html)[/color]