The 38KB Fingerprint: How Guccifer 2.0 Cloned Contaminated Documents

Executive Summary

What This Analysis Shows

Guccifer 2.0’s first three released documents were not independent files. Structural analysis of their raw RTF data shows that 2.doc and 3.doc were created by duplicating 1.doc at the file-system level and replacing its content.

The evidence is technical and reproducible:

• A 38,637-byte stylesheet block appears byte-for-byte identical in all three files.

• The block contains Russian-language style strings and the RSID 11758497, which originated during the editing session that produced 1.doc.

• All three files share identical creation timestamps and the same document ancestry marker (rsidroot).

• The metadata pattern matches file-system copying rather than Microsoft Word’s “Save As” behaviour.

The result is three documents with different visible content but identical inherited Russian-language metadata.

This establishes structural duplication and metadata inheritance. It does not, by itself, determine ultimate attribution. It demonstrates the workflow used to produce the files.

Document Lineage

Document #1 was created by opening a Podesta email attachment (that was originally created in 2008) in Microsoft Word configured with Russian language settings (registered to “Феликс Эдмундович”), then pasting in Trump opposition research. That process introduced Russian-language metadata and editing markers into the file.

Documents #2 and #3 were not created independently. Instead, they were produced by copying the already-modified 1.doc at the file-system level and pasting new content into each duplicate. As a result, all three files share the same inherited Russian-language artefacts.

What This Means

The shared 38KB stylesheet block and RSID patterns show that the Russian-language metadata in these documents was structurally propagated through duplication rather than independently introduced into each file.

This analysis establishes construction methodology at the document level - not motive or attribution. Whether the duplication workflow was deliberate, incidental, or part of a broader operation is a separate question beyond what document structure alone can resolve.

What is demonstrable is that these documents were not released in their original form. They were produced through a reproducible process of duplication and content replacement - a process that can be independently verified using the linked source files

Why This Matters

For attribution:
If Russian-language metadata had been introduced independently in multiple files, we would expect variation in editing histories and contamination markers. Instead, we observe systematic inheritance of the same 38KB stylesheet block and RSIDs across documents. This shifts the question from “Why was Russian metadata present?” to “Why was the same metadata propagated?”

For the documents themselves:
The released RTF files were not untouched originals. They were produced through duplication and content replacement of a modified base document. That distinction matters when evaluating how the files were prepared prior to release.

For verification:
Unlike much of the public attribution debate - which relies on classified intelligence - these findings are based on publicly available files and can be independently reproduced using Word 2007 and a text editor.

 

Key Terms Explained

Before the technical walkthrough, here are the concepts this analysis relies on:

Stylesheet data: Word’s embedded formatting rulebook (styles, fonts, numbering, spacing). It can be carried along even when document content changes.

RSID (Revision Session ID): a value Word assigns to mark changes made during an editing session. RSIDs persist inside the file and are useful for tracing document lineage when files are duplicated and repurposed. RSIDs are essentially 32 bit IDs that identify changes occurring within the same unique document editing session.

Document grafting: copying content from one document and pasting it into another.

Metadata: embedded fields not visible in normal reading (author/operator strings, timestamps, language settings, and other internal markers).

Russian breadcrumbs: Specific technical markers indicating Russian language/user configuration:

• Language codes: \lang1049 and \langfe1049 (Russian language ID)
• Character set: \fcharset204 (Windows Cyrillic codepage)
• Cyrillic-encoded text: The operator name "Феликс Эдмундович" appears as \'d4\'e5\'eb\'e8\'ea\'f1 \'dd\'e4\'ec\'f3\'ed\'e4\'ee\'e2\'e8\'f7
• Cyrillic style names: Style definitions encoded in Cyrillic characters

These markers appear when documents are created or edited using Word configured for Russian language/region settings.

Background: Guccifer 2.0's First Document Was Already Suspicious

In 2018, an independent researcher known as Forensicator published a detailed analysis of how Guccifer 2.0 created the document "1.doc":

Did Guccifer 2.0 Plant His
Russian Fingerprints?

What Forensicator Discovered:

1. Guccifer 2.0 started with a document originally created by Warren Flood in 2008 (later found in the Podesta emails)
2. Opened it using Microsoft Word registered to "Феликс Эдмундович" (Felix Edmundovich in Cyrillic) - likely a reference to Felix Dzerzhinsky, founder of the Soviet secret police
3. Made some edits to this document
4. Copied content from a Trump opposition research document (also from the Podesta emails)
5. Pasted that Trump research into the Flood document

The Result: An odd hybrid document containing Trump research, but saturated with:

• Metadata from the original Flood document
• Russian language codes
• Cyrillic character encodings
• References to the founder of the Soviet Secret police

\sbasedon52 \snext50 \slink51 \sqformat \spriority0 \styrsid11758497 Sub-Bullet;}
{\\*\cs51 \additive \rtlch\fcs1 \af31507\afs24 \ltrch\fcs0 
\f1\fs24\lang1033\langfe1033\langnp1033\langfenp1033 
\sbasedon10 \slink50 \slocked \spriority0 \styrsid11758497 
  

Proof: Documents #2 and #3 Were Copied from Document #1

Three pieces of metadata prove these documents descended from the same source file:

1. Identical Creation Times

All three documents share the exact same creation timestamp:

View the creation time in each file:

• 1.doc: 2016-06-15 13:38
• 2.doc: 2016-06-15 13:38
• 3.doc: 2016-06-15 13:38

Click each link to see the identical \creatim\yr2016\mo6\dy15\hr13\min38 timestamp highlighted in the file.

Why this matters: When you use "Save As" in Microsoft Word, the creation time (\creatim) is updated to the current time. The fact that all three documents share identical creation times - down to the exact second - supports file-system copying (which preserves the original creation timestamp) rather than through "Save As" operations.

2. The Stylesheet Block Itself

The presence of the identical 38KB stylesheet block in all three files - contaminated with Russian metadata and tagged with RSID 11758497 - is itself evidence of copying.

The RSID tagging proves the block originated in 1.doc's Trump oppo paste session. If 2.doc and 3.doc were created independently, they wouldn't inherit these specific RSID markers from 1.doc's editing history. The shared RSID tags prove file-level duplication.

3. RSID Table Analysis: The Forensic Fingerprint

Beyond the shared root and stylesheet, there's an even more detailed fingerprint: the RSID table. Each Word document contains a table listing all the revision session IDs that have touched the file throughout its history.

View the RSID tables:

• 1.doc: RSID table
• 2.doc: RSID table
• 3.doc: RSID table

When we compare these tables across all three Guccifer 2.0 documents AND their source materials, a striking pattern emerges:

Key Findings from RSID Analysis:

Shared contamination RSIDs - Multiple RSIDs appear in all three Guccifer documents:

• 11758497 - The Trump oppo paste RSID (our smoking gun)
• 9588946 - Another contamination marker
• 4678604 - Inherited from Flood document
• 1125774 - Inherited from Flood document
• 5602882 - Inherited from Flood document
• 6842998 - Inherited from Flood document
• 8330574 - Inherited from Flood document
• 12517870 - Inherited from Flood document
• 12588815 - Inherited from Flood document
• 14756795 - Inherited from Flood document
• 15158013 - Inherited from Flood document
• 15995570 - Inherited from Flood document
• 16453316 - The shared rsidroot

Source-specific RSIDs - Each document also contains RSIDs from its pasted content:

• 1.doc contains RSIDs like 2119710, 5703012, 11673071 from the original Trump Opposition research document
• 2.doc contains RSIDs like 4737387, 9764998, 14354415 from the GOP strategy memo
• 3.doc contains RSIDs like 656492, 2310076, 5462108 from the talking points memo

This dual pattern - shared contamination RSIDs plus source-specific RSIDs - proves the documents were created by pasting clean content into contaminated shells.

What makes RSID 11758497 special:

• Appears in all three Guccifer 2.0 documents
• Does NOT appear in any of the source documents
• Does NOT appear in the Flood document
• Was created specifically during the Trump oppo paste into 1.doc
• Persisted when 1.doc was copied to create 2.doc and 3.doc

Complete RSID Comparison Table:

For the complete detailed RSID table with all 400+ entries, click here.

Sample of key RSIDs:

Legend:

• G2-1/2/3: Guccifer 2.0's three documents
• Source-1/2/3: Original content sources (Trump oppo, GOP strategy, talking points)
• Flood: Warren Flood's 2008 base document
• ✓: RSID present in document
• - : RSID not present

What this proves:

The RSID table analysis provides evidence of the copying workflow:

1. All three documents share RSIDs from the Flood document (showing common ancestry)
2. All three documents share RSID 11758497 (showing they all derived from 1.doc's contaminated state)
3. Each document also contains RSIDs from its specific content source (showing content was pasted in)
4. The contamination RSIDs persist even when content changes (showing structural reuse)

Document Ancestry: The Flood Document Connection

All three documents also share the same rsidroot (16453316), which originated in Warren Flood's 2008 document.

This proves common deep ancestry - all three descended from the Flood document that was used to create 1.doc. However, this shared ancestry doesn't tell us how 2.doc and 3.doc were created; it only confirms they all trace back to the same 2008 foundation. The evidence above (creation times, stylesheet block, RSID tables and pivotal 11758497 RSID) shows that 2.doc and 3.doc were specifically duplicated from 1.doc rather than created independently from the Flood document.

View the rsidroot in each file:

• 1.doc: rsidroot 16453316
• 2.doc: rsidroot 16453316
• 3.doc: rsidroot 16453316

 

What Content Was Pasted Into Each Document?

To understand the construction process, we need to know what content ended up in each file and if this content was found in other documents that were leaked.

The following documents were identified as having matching content including multiple RSID overlaps.

Document #1 (1.doc)

Content: Trump opposition research
Source: WikiLeaks Podesta Email #26562
Attachment: "Donald Trump Report – Opposition Research"
View original attachment

Framework: Warren Flood's 2008 document
Source: Podesta Email #41518
Attachment: "Slate_-Domestic-USDA-_2008-12-20.doc"
View original attachment

Process: Flood document opened in Russian-registered Word → Trump research pasted in → Russian contamination created

Document #2 (2.doc)

Content: GOP strategy document
Source: WikiLeaks Podesta Email #55782
Attachment: "Strategy on GOP 2016ers.docx"
View original attachment

Framework: Copy of the already-contaminated 1.doc

Process: Pre-contaminated copy opened → GOP strategy pasted in → Russian contamination preserved

Document #3 (3.doc)

Content: Candidate talking points
Source: WikiLeaks Podesta Email #3405
Attachment: "Candidate Talking Points - all changes.docx"
View original attachment

Framework: Another copy of the already-contaminated 1.doc

Process: Pre-contaminated copy opened → Talking points pasted in → Russian contamination preserved

What Does This Mean?

This analysis establishes something more specific than the presence of Russian-language metadata. It reconstructs the document workflow used to produce the files.

The structural evidence indicates that a pre-modified base document was duplicated and reused, resulting in systematic inheritance of its Russian-language metadata.

The Duplication Workflow

• Create modified base file - A copy of a 2008 DNC document is opened in Word 2007 configured with Russian language settings, and new content is pasted into it, producing 1.doc with embedded Russian-language metadata and RSIDs.

• Duplicate at file-system level - 1.doc is copied outside of Word (i.e. not duplicated via Word’s Save/Save-As functions)..

• Open each duplicate separately - Each copied file is opened independently in Word.

• Replace content - New content is pasted into each duplicate.

• Save and release - The duplicated files retain the inherited metadata from the original modified base file.

Result: Three documents with different visible content but identical embedded editing history.

Why This Pattern Matters

The structural pattern observed here is difficult to reconcile with several common explanations.

Independent document creation:
If each file were created separately - even in a Russian-configured environment - we would expect variation in editing histories and stylesheet structure. Instead, we observe replication: an identical 38KB block and shared RSIDs.

Simple formatting reuse:
If only visible formatting elements were reused, we would expect limited overlap in style definitions. Instead, the entire stylesheet block - including editing-session-specific RSIDs - was inherited intact.

Random or careless contamination:
Accidental metadata leakage would likely produce inconsistent patterns across files. Instead, the same contamination markers appear in all three documents, unchanged.

These patterns are consistent with duplication of a pre-modified base file followed by content replacement.

Document structure alone cannot determine whether this duplication was deliberate or incidental. It does, however, establish the mechanism by which the metadata propagated.

Conclusion: What We Can Prove vs. What Remains Open

What This Analysis Definitively Establishes

Proven and verifiable facts:

1. A 38KB stylesheet block appears identically in three Guccifer 2.0 documents - view in 1.doc | 2.doc | 3.doc
2. This block originated in document #1 during the editing session with RSID 11758497..
3. Documents #2 and #3 were created by copying of #1 outside of Microsoft Word.
4. This workflow preserved and propagated Russian metadata
5. The process occurred within a short timeframe and followed a consistent duplication pattern.

How you can verify:
Click any of the highlighted links in this article to see the evidence in the actual files. No special software required - just your browser. Source files are also linked to from the viewer pages.

What this demonstrates:
The Russian fingerprints in Guccifer 2.0's documents were not independently introduced into each file. They resulted from a systematic process that preserved and propagated Russian metadata by copying contaminated templates. The documents themselves record their production history.

What Remains Uncertain

Not proven by this analysis:

• Whether Guccifer 2.0 was actually the GRU
• Whether the operation was genuinely Russian or a false flag
• The true identity of the person or group behind the persona

Why attribution is difficult:

• Much of the public attribution debate relies on classified intelligence that is not independently verifiable. Technical indicators (TTPs, IOCs, etc.) can also be imitated.
• The presence of overt Russian-language artefacts has led to competing interpretations, but document structure alone cannot resolve questions of strategic intent.

The Core Finding

What this forensic analysis establishes is document duplication methodology, not ultimate attribution.

The released files were not independent originals. Structural evidence shows that they were produced by duplicating a modified base document and replacing its content, resulting in systematic inheritance of Russian-language metadata.

Whether this duplication was part of a broader intelligence operation, a false-flag effort, or something else entirely is beyond what technical document analysis alone can determine.

What is demonstrable is the mechanism: a reproducible process of duplication outside of Microsoft Word and content replacement that propagated embedded metadata across multiple documents. That process can be independently verified using the source files linked throughout this article.