Tampering with timelines - injecting false leads
Tampering with timelines - injecting false leads By: David André, copied with permission Background " Pearls and pitfalls of timeline analysis " went into some of the challenges of timeline analysis, such as information underflow, information overflow and interpreting timeline entries. One aspect that was only touched upon is that the data in a timeline is not necessarily trustworthy. Most of us are aware that the content of a log line can be influenced by whoever generated it. A less often asked question is: Which parts of a timeline entry come from the data, and which parts come from the tool? This article looks at a case where the answer turned out to be different from what one might expect. The __utmz cookie Google Analytics (ga.js) used several cookies to track visitors, one of them is __utmz , which stores how a visitor reached a website. Its value consists of a domain hash, a timestamp, a session and a source count, followed by a | separated list of key=value varia...
