Black Box curiosity of the day -- from Bev

[BevHarris]

Congrats to DU for the upgrade -- works great for me, good job! My DSL went out at 1 a.m. Sunday and had to get tech support to make it work again, argh.

Okay, as we work on detail stuff behind the scenes for an upcoming story, here's something that cropped up with some of the voting program test databases that I'd like to get some troubleshooting ideas for:

Had a voting database, in Access, test files, I assume.
After some kind of trigger, not sure if it was number of days or some other event, the data in the file mutated. Where there had been 7,000 votes suddenly there were only 168. Most precincts simply evaporated.

Okay, so if you then go and get a fresh copy of same file, delete the corrupted one, you can go back and view the original 7,000 votes, right? No. Any copy you view of same file is missing its votes.

So you uninstall, remove all remnants of the program, reinstall from scratch, reload a pristine file, but still: missing its votes.

I have screen shots of before and after. No version of same program has the votes that it had when I first opened it, yet I can document they were there. Another researcher had same original votes in file when they opened it, and printed reports from original votes, as I did.

How would you go about diagnosing or replicating this problem?

[htuttle]

1. Try setting the date on your computer back

It only knows what day it is by what you tell it.

I can't imagine what would cause this, however.

[Ivory_Tower]

2. Is there a macro in the file?

I might be way off-base on this, but just as a speculation -- does the file have a macro in it that checks for the date and clears/resets things based on that date?

You could try resetting your computer's system clock to a date prior to the date you saw this problem and try again.

Just a suggestion. But then again, I know very little about Access, so take this with a big grain of salt.

[papau]

3. Date/time trigger is in data, or number of views

I had this first happen 20 years ago in Unix -

solution is to come on with a machine that thinks it is 6 months ago if the trigger is a simple one

If number of views is the control - and this does not sound like this is the case - you need a clean copy with a few views left (on a CDrom so that it is not changed).

[Ivory_Tower]

If it's based on number of views

then it might be stored in the Windows registry, but probably only if this database (or the software using it) was somehow "installed" instead of just opened in Access. That could be a pain in the butt to find, although it is possible.

Hopefully I'm not sending folks down a blind alley!

(edit: continuing my tradition of missing words as I type)

[BevHarris]

12. Yeah, it has to be "installed"

the file can't be opened in Access until the GEMS program first decompresses it. I thought that a new version of GEMS with a new file, clock set back, might work, but no.

After seeing posts here and talking with others, it leads me to believe the trigger is in the registry.

Will take a look at that by using another system with a fresh registry and OS.

[Prisoner_Number_Six]

38. If you try a fresh system don't forget to

=back up the registry before you first open the file. It will enable you to restore it to a pristine state if something is altered.
=if you happen to run WinXP, you can set a System Restore Point first. That will make it easier to restore the registry after the file is opened and the registry is altered. I don't know if this feature is available in Win2k or not, but registry backup is possible all the way back through Win95.

[ParanoidPat]

4. Good morning Bev!

Have you set your clock back before reloading? :evilgrin:
If that doesn't work, may have to try a fresh load of the OS and other software on a machine with the clock set back just in case the trigger is hidden in the registry files. :)

[Ready4Change]

5. Good to see you back online, Bev!

.

[revcarol]

6. Way too technical for me.,...

but I did tell the Kucinich campaign about your site and your book.

ALL candidates in all states should know about this project..as well as officials.

[BevHarris]

7. Thanks -- trying the clock set adjustment now

It's not number of views; loading new version of file never viewed (by us) does not restore the votes.

Bev

[southernfried]

8. are you sure about that "pristine" file ?

if so, why/how ?

otherwise that date trick might help.

[BevHarris]

9. Nope. Time/Date reset doesn't restore the data.

This particular file has been a good one to demonstrate how votes can be manipulated. However, the particular section that imploded is the section needed for the demonstration. }(

Next step: Take it to a new computer altogether.

That will take an hour or so, and may not tell me much if I can't install the software there. I'll go there and just look at the Access file; if that doesn't work, will seek volunteers brave enough to install software and try out a "virgin" version of the vote data file (kept on a CD that is not rewritable) to see if someone else can replicate it.

Will let you know in a couple hours. Like most investigative threads, this is either a waste of time or will prove to be very interesting.

Bev

[Mairead]

10. Several things to check

1. Are the records still there physically? I.e., can you hexdump the changed data file and still see them? (You can get a hexdump utility from simtel http://www.simtel.net/pub/pd/63476.html if you haven't already got one)

2. Is this a mere bug or a malicious 'bug'? I.e., what characteristics, if any, separate the records that vanished from those that didn't? From the fact that entire disappear, it sounds like a real bug...a precinct disappearing is a bit hard to explain.

3. It might be a sign that your disk is failing. Run scandisk on it.

4. As others have mentioned, rewind the date, reboot the system, and see whether that helps (you have to reboot after rewinding the date, because date info is sometimes cached).

5. If that doesn't help, strip the system down to the metal, re-install the o/s, re-install Access, reload a fresh copy of the file, and see whether that helps.

6. If that doesn't help either, hexdump this fresh copy. And if you're none the wiser after all this, then I'm out of ideas :evilgrin:

[BevHarris]

13. Thanks, Mairead --

1. Are the records still there physically? Yes and no. Data is all there in one table, but evaporated from another table. Structure is this: Data appears in table 1. Data is mirrored in Table 2. But Table 2 is disjoined from Table 1, so changes in Table 2 don't affect Table 1. Data disappeared from Table 2 but not Table 1.

2. what characteristics, if any, separate the records that vanished from those that didn't? About 95% of the precincts evaporated altogether, in both Table 2 and the GEMS election total report.

3. It might be a sign that your disk is failing. No (thank goodness) -- same result on two different computers that had same stuff installed and looked at on same day.

4. As others have mentioned, rewind the date, reboot the system Did that, no go.

5. If that doesn't help, strip the system down to the metal, re-install the o/s, re-install Access, reload a fresh copy of the file, and see whether that helps. Can't. But I can check the files on an entirely different system.

Thanks for all the suggestions.

Bev

[sangh0]

16. I'm wondering if

version control (and those '18181's) might be involved here. You mentioned that you're installing a new copy of GEMS, which decompresses the files, and I'm thinking maybe there's something in that process that's programmed to delete the "test" files from the previous version. Do you have an older copy (the original version you used?) of GEMS?

BTW, this is sangha.

[BevHarris]

19. It happened within a session, with same version

I was using the officially certified version. I was in the process of documenting how votes can be manipulated, getting screen shots of each step. Had done same several times before, without the screen shots. I went back in for one more peek after generating report untampered - screen shot -- tamper votes - screen shot -- report tampered - screen shot. (Thank goodness, I already had my screen shots done! ).

When I went back in after the above process, the votes in the tampered file had disappeared. However, I then went to another computer, same GEMS version, same file, that I had done no tampering or screen shots or reports at all with. Hadn't touched the files, just had stuck them on there and they'd sat there for a week.

The votes had disappeared from that computer's file too, leading me to believe that it is a date trigger somewhere in the registry.

Bev

[sangh0]

21. A question

When you looked on the other computer (the one with the "same GEMS version, same file, that I had done no tampering or screen shots or reports ar all") did you look at the file through GEMS, or by opening the .MDB file with ACCESS?

[BevHarris]

27. Actually, I don't have Access on that computer, but

you can open it also with Excel 2002, which is what I did to see that the data was changed. Never even opened the file on GEMS on computer #2.

[sangh0]

33. Thanks

that eliminates one possibility

[dweller]

71. which one?

i'll pm my guess.
dp

[dansolo]

78. You might want to access the data without opening the file

Opening the file may trigger some sort of macro, and even opening it in Excel may be triggering it as well, since they both use VBA. Have you tried accessing the data in the original file without actually opening the file in a Microsoft application?

[papau]

18. Table 2 can not find the data in Table 1 to summarize?

This could be done by a simple macro - however the reload of a clean copy should fix it.

And the clean copy has been not been rewritten (auto save, etc.).

You may have to rewrite the macro that produces the data in "2" from the data in "1"

[ParanoidPat]

20. Bev, we can DU it out here...

....PM me and we'll set up a fresh system with the clock set to just before the 2000 election. From there we can incrementally move the clock up and chart what happens! :evilgrin:
I have access to some broadcast quality video equipment and can arrange to shoot the process for future use. It may take a day or so to do but it is definitely DU-able. :)

[BevHarris]

31. I will PM you. That's the best thing.

This needs to be replicated by someone with a higher level of technical expertise than I have.

Bev

[Az]

11. Carnivore

You may want to be cautious. For some time now the FBI has had permission to use a system called carnivore that they can place at an ISP and monitor its customers. In order to install Carnivore they would place it on their server. This may include a brief downtime while the software is loaded. They do not need to serve a warrant to you to monitor your traffic. They do need to serve it to the ISP.

[BevHarris]

15. Not testing it with a computer that has any modem connections.

Thanks.

[papau]

14. Windows registry seems likely evil - but "cookie" could be stored

anywhere.

A strip down to a bare formatted drive and a reload of OS, plus a hex dump of the file before and after loading it, may be required.

EPROM writing (the boot up Eprom can be rewritten) is also a possible.

Now this is getting interesting!

[BevHarris]

17. My next question: HOW INTERESTING?

Let's look at what we've got, if it's anything. Suppose I find the original data shows up if you use new operating system etc. (seems much easier to test on completely different system than to do all the stripping down, unless I'm missing something).

Suppose we prove that this file has votes and that a known trigger makes them disappear.

This is a test file (I ascertain this because the votes were placed in it a month before the election and are placed in patterns: 4,8,12,16,3,6,9,12,2,4,6,8,12,24,36,48, etc.)

So, suppose we have a test file for a voting machine that has a trigger to mutate. What does that really mean?

In a way -- it's not the real thing, so who gives a crap. But in another way...why would one set a booby trap in a test file, and what other questions does that give us?

I'm going to assume that we can replicate this, since at least one other researcher saw an identical set of original votes when he opened the file.

Can you weigh in on how high a priority you would place on further research on this file mutation? Assuming we can replicate this, what questions would you research next related to this issue?

Bev

[papau]

22. Why are there two reports?

Report 2 does not affect report 1. I assume report one does affect report 2 and indeed report 2 is a macro run against the data in report 1.

So with source data in report 1 unchanged so as to clear audit, do we then use results from post-macro/program adjusted Report 2 to report totals? This is the most important question. And then getting macro exposed becomes very important.

Then again if two reports where 2 does not tie to 1, what is purpose of 2?

Also possible is just lousy programming QC on second and rejected report format - (I do not believe this)

Also the "macro" could use a machine lanuage program that is buried in the data - so any review of the code will require someone to "disassemble" the machine code back to assembly code.

The name I gave you earler of my classmate of many years ago is the place I would go if he was open to the quest.

[BevHarris]

26. Answers...

Report 2 does not affect report 1. You cannot get a report 1 from GEMS. Only a report 2.

Bev

[ParanoidPat]

24. I want to see that registry string!

From what you have described it certainly looks like the registry is the likely culprit. Remember, so called '30 day free trial' software make use of the registry to shut down the software after the trial period. Poorly protected software can be fooled by a simple clock change. Well written software requires that the registry entries be removed and the software be reinstalled. Very well written software has a key built in that 'knows' the useable date period of the code without a serial number installed. Unless the software is 'freshly' installed on a computer with the date set within the useable range it will not operate. You need a software developer who specializes in protecting software using the registry. :)

For now you can remove all the Gems and Access software, run a copy of 'Reg Clean' to remove the old registry entries, reload and try again! :)

[BevHarris]

28. Oh! Great idea!

First, I'm going to pop over and look at the data in Access on another computer without intalling GEMS at all. See if the data is there.

Yeah, GEMS puts stuff all over your registry. After that I'll look into uninstall and regclean and backdate the clock and reinstall.

[Cocoa]

23. what's the ratio up to?

smoking guns:false alarms, I mean.

Is it about the same as WMD in Iraq?

I commented here several times that every time one of those false alarms was raised, that my question was why don't they wait until they've verified it before reporting it? It's always breathless, it's always "this is the most credible evidence yet" etc. etc.

And what is the percentage of people that believe that WMD have actually been found? Something like 30%, isn't it. The people that wanted to believe, is my guess, so much that they didn't care if it was true. They probably thought it was patriotic to believe it because the cause was so good.

[ParanoidPat]

30. Cocoa, the best way to keep this process on the up and up...

....is to do it in public and invite scrutiny of what we're seeing. Should anyone who knows more about what we're discussing see that we may be misinterpreting what we're seeing, they are free to 'chime in' and tell you, me and everyone else at the same time that it's bullsh*t! We're just comparing notes. If you catch us 'blowing smoke' please let us know where we went wrong! :)

[Eloriel]

32. Having a reading comprehension today, Cocoa?

what's the ratio up to?"
smoking guns:false alarms, I mean.

Is it about the same as WMD in Iraq?

I commented here several times that every time one of those false alarms was raised, that my question was why don't they wait until they've verified it before reporting it? It's always breathless, it's always "this is the most credible evidence yet" etc. etc.

You might want to try re-reading Bev's original post, as well as all the posts up to this point. Bev is asking for input on something she's experienced with the software. It's as simple as that. SHE hasn't claimed it's a "smoking gun," nor is there anything to suggest it's a "false alarm."

The thread is brainstorming about an observed phenomenon. No claims, other than your trumped-up one, that is.

If you have SUCH antipathy for Bev and what she's doing that you can't be reasonable or objective about any of it, why don't you just ignore the threads? Put her on ignore. (We DO still have ignore with this new software, don't we?) Try it, you'll like the peace of mind. And the rest of us will enjoy the peace and quiet.

Eloriel

[ParanoidPat]

34. Thanks Eloriel!

I couldn't have said it better! :evilgrin:
It's really starting to get old! :)

[BevHarris]

37. Check your PM, Paranoid. n/t

Bev

[Cocoa]

36. how many snipes must die?

Regarding my ignoring these threads, I don't want to. I want to continue questioning a very questionable story. If you want to ignore my questioning, you can do so.

Who won the contest for the Flash script, btw. I hope the winner is announced here.

[papau]

35. Most likely Aschroft response is "So what"

In the optical Scanner second chance if "error" turned on in Florida white areas, but not in Florida black/brown areas, it refused to go out to see if conspiracy, saying that no proof was brought to him that this was not a co-insidence!!!

Likewise if Beth finds evil code that may, or may not have run on election day, Ashcroft - and US media that is in the pocket of the right wing - will just blow it off.

But A good - getting an auditablr trail on voting machines ala David Dill's quest - may be achieved - together with getting rid of the stupid idea that a vote counting machine has code that can not be reviewed by anyone.

And if Beth find code that makes fraud easier, the UK media will run with it - and US media may be embarrassed to the point they will ask Rove for the proper spin, and then run a story. And we get a little PR on the topic. But again Ashcroft/Justice/Congressional investigations require somepart of Americam government or media, to stop saying "yes Bush lies - so what - no one cares if he lies or the GOP cheat. and then the Rovian wink - we know everybody cheats"

[Devils Advocate NZ]

25. Startup Macro...

It seems to me that a startup macro in the file is running a piece of VBA code that is checking either the registry or a file for a value that tells the program to erase the data. If this is the case, it may be able to be fixed.

First of all, is the Access file an mdb or mde? The latter is a compiled version of the former, which means that any code embedded in the file will be not be viewable or modifiable. If this is the case, then you will be unable to do much about this problem. However, if it is an mdb then you may be able to figure out what is happening.

First of all, you need a fresh copy of the Access file that has not been opened and is therefore unmodified, reinstalling could do this, but not necessarily, if you have a copy of the file on a CD in its extracted form, that would be the best choice.

Now you have to disable start-up macros so that the file doesn't run any code when you open it. If I remember correctly, there is an option in preferences that you can set to do this, or you can try holding down shift while you load the file.

All going well, you should have the file open and no macros will have run. Now select the 'Modules' tab and if there are any VBA code modules in the file, they will be listed here. By viewing these modules (be sure not to run them, just edit them) and if you are familiar with VBA, you should be able to determine which function is erasing the data.

If you are knowledgable in VB you will then be able to disable the function without removing it completely, thus enabling the program to run correctly but not erase the data you wish to keep.

Of course, this all depends on how the program is structured, and without having a copy I really can't say for sure.

I suggest you find someone experienced in VB and VBA (especially in Access) who should be able to either fix it, or tell you that it is not fixable.

[toolfan]

29. Hey Devil's Advocate!

Where have you been? I have'nt seen you around DU in a while! If I'm blind and you were here the whole time, disregard. If not,


Welcome Back! :toast:

[Prisoner_Number_Six]

39. This may be a bit late in the game but

after reading all these messages mentioning Carnivore, PM'ing, and generally communicating with others by email, may I suggest (if you don't already) you start encrypting your communications to others, especially if files are attached, by using PGP? It's not my business, and I have no desire to know the details of your communications methods, but it's obvious you're playing with fire, and I for one don't want you to get burned. I recommend PGP 6.2 RSA, which is theoretically pre-"backdoor". Others here may dispute this, and may be able to suggest a more secure version.

Even when you burn something to a CD, it would be wise to encrypt it first, and keep your keyfile OFF your computer, and hidden in a secure place!

Hope this isn't out of line, but what you're doing is too important to the country, not just us here at DU.

ON EDIT: One of the features of PGP is something called "Secure Delete (or Wipe)"-- it gives you the opportunity to delete any file from your hard drive so it cannot be recovered. I also have at my disposal a utility that can securely wipe an entire hard drive to greater-than-DOD specifications, if the need arises. This is a hint from the paranoid portion of my brain... ;-)

[DEMActivist]

40. Excellent advice, P_N_S

thank you for the reminder to be secure and careful.

[hunter]

43. Oh Bother...

Forget the PGP and cloak and dagger stuff. If you do everything stark naked out in public nobody can say you are hiding a gun.

This applies to whatever Bev Harris is doing, but it also applies to the voting machine software.

The fact that the software and the operating system for these machines is so complex is plenty of evidence that the designers are at best criminally negligent and incompetent boobs, and at worst criminals committing various acts of treason, bribery, or other high crimes and misdemeanors ....

Maybe what we need here is the sort of hacking that makes "Fuck You Bush" the winner of the next presidential election, or maybe, if we are in more of a hurry, we can let them recall Davis in California and replace him with Micky Mouse. (Born in the United States, Mr. Mouse was!)

BTW, has anyone impounded some actual hardware? There's got to be a county election commissioner somewhere amiable to that... (Shhhh, don't ask, don't tell...)

Oh, yes Mr. Ashcroft, if you are reading this, you guys are freaks, and the backroom staff hates you, so they've been pissing in the punchbowl...

(Hah, hah, no, no, I really wouldn't know anything about that... I make up shit like this all of the time. Ask anyone. )

Peace

[BevHarris]

46. Agreed on the openness as much as possible

I think we should all just barrel ahead, letting unpredictability and the swarm do what security cannot -- are you kidding? Security? Encryption? I think that stuff would quickly succumb if we really get challenged.

That being said, my system was definitely compromised at 1:35 a.m. Sunday morning. I just assume anything I do may or may not be seen. A window popped up from my firewall saying "a new network is now in place" (my machine is not on a network) -- it then said to click to put it in the safe zone, but offered no exit should I choose not to. I disconnected by modem from the wall and powered off.

My system, which I've always been able to restore to any number of previous dates, now will not let me reset anything before 1:35 a.m. Sunday July 6. Sucks.

Well, there went my DNS. Couldn't get it back until I got a repair person to reset the system. Messages all over my event log -- "tried to dial out to unknown server, failed" -- So, shortly, I'll switch to a computer with nothing much on it for all Internet connectivity.

That's about as much inconvenience as I can stand, though. I have zero tolerance for computer fixes, finding it easier to just swap in a substitute machine and keep backups on disc in various locations.

Truly I'm not a techie at heart.

Bev

[nostamj]

48. OMG

hang in there!

[ianbruce]

51. Bev, you may need to have your drive professionally examined...

... in a secure environment. I don't want to sound alarmist, but if it's trying to dial out, or establish communication with anything other than your own ISP, you could be the victim of a trojan, or a surreptitiously installed spyware app.

An attack at 1:35 a.m. on a Sunday morning sounds about right.

[BevHarris]

55. Yeah, I figured that. Sunday was "hack day" wasn't it?

That would be suspect in this file mutation business, except that I first discovered the mutation on an entirely different system that is connected to nothing, and the file I was using had been on that system for over a week.

Bev

[Jackpine Radical]

41. And whether or not you recover this file,

you need to be thinking about how to avoid setting off similar tripwires in any future files you encounter. Your analysis of the present problem ought to lead to some file-handling procedures that will avoid detonating any future data files until you're ready to observe and record their behavior. If they did this once (for whatever reason), they likely did the same or similar things in other instances.

Another thing--on the question of whether or not this little booby trap has any significance, just ask yourself why anybody would go to the bother of creating this for no reason. Even if it's a smokescreen or a distraction, a smokescreen to cover...what? A distraction from...what? Somebody didn't just do this to keep Bev and the Insiders Club busy, because they never anticipated you. What or whom did they anticipate needing this for?

Kinda like one of those locked-room mysteries, nicht wahr?

[BevHarris]

44. Well, everyone assumes I'll figure it out

But I don't have the skills or the equipment. People are on vacation...this is a very good lead, probably something that can be diagnosed and identified in a modest amount of time.

It needs someone with the following:

1) Software that can restore hard drive settings to previous levels
2) Recent version of Access
3) Ability to isolate new items to the registry and also the ability to analyze Access macros
4) Willingness to install on a computer, and I would suggest one that is off line and that you can wipe free of viruses afterwards.
5) Willingness to tinker with the file to figure out what the trip wire is.

This is an important task for two reasons:

1) As you say, identifying the mechanism will guard against other booby-trapped files in the future. In fact, now I REALLY wonder about the San Luis Obispo election file, which was nuts before we even looked at it. Maybe someone who came before us examined it a little too much?

2) Little holes in the dam can cause big cracks. Some diagnoses would not cause a hole in the dam; others will unleash a flood of questions.

Please PM me if you want to try your hand at diagnosing what made this file go boom.

Bev

[Fredda Weinberg]

45. I would have offered once

upon a time.

[BevHarris]

47. You have all the files -- go for it, I'll be the first to applaud you.

Petty differences aside, this stuff is important. And I mean that: If Fredda cracks the case, she would deserve our unreserved appreciation and respect.

Fredda, this is straight up: It's one of the data files with votes, possibly used for an L&A test I would guess. You don't even need to open in in GEMS or in Access. One of mine imploded after the third time I opened it in Excel. It's mutation was identical, right down to the exact change in number and placement of votes, to one that imploded after the nth time of opening in back-and-forth in Access and GEMS.

Bev

On Edit: Check that -- it needs GEMS to decompress from gbf mode into mdb mode, but it need never be opened. GEMS decompresses when you tell it to "load" and after it extracts, you just close that program and reopen the file in Access.

[Fredda Weinberg]

49. I've got GEMS installed

You've got my email address. Send me your screen shots and I'll see what I can reproduce.

[BevHarris]

54. Fredda, I'll bury the hatchet in my own thigh if you come up

with a replicable answer that helps us understand why this file was set up this way.

You won't need screen shots, you'll just need Cobb County. I'm pretty sure you have it.

Just get it into mdb format and visit the SumCandidateCounter table to see how many votes it contains. Now, if it contains zero, let me know -- that happened to one researcher, but that has something to do with a function from GEMS, easily solved. If it has over 14,000 votes, you have the original data. Note that the 14,000+ is actually two copies of the same data. If it has either 168 or 342 votes, you have a mutation.

That's all we need to know at first. If you have a file with over 14,000 votes, get a screen shot that includes file name and number of votes, with the top panel of votes. Then play around with date and time, setting your system forward at least 1-2 weeks, and also do many different kinds of views.

See if the data changes in that table when you do any of the above.

Going to press shortly, I'm looking at the writer's story draft right now. It would make nice icing on the cake if we learned something interesting about this file and were able to replicate it with another independent researcher.

Bev

[Fredda Weinberg]

56. cobb county? nope

I've got alameda ca primary election 0302

Send me a link and I'll take a look at whatever file you have.

[Fredda Weinberg]

59. Got it now

168 records in SumCandidateCounter

GEMS recognized the gbf extension and turned into an mdb

[Fredda Weinberg]

60. But it looks like lots of garbage was removed

It took an almost 5 MB file to 18.5 k.

Nothing suspicious so far.

[OrdinaryTa]

61. Export the Tables

Programmers can make it difficult for you to exceed the number of accesses or the time allotment, if that's what's going on here. Sounds like it might be. But Access is just another relational database, and everything in an RBDMS is based on tables. Forget about the mdb stuff versus mde, etc. Now that you know there's some sneaky shit afoot, reload the data into a new machine and export the tables. Then you can work away with them to your heart's content. Trust me, there is nothing that can be attached to a table that results in the program giving you the finger after X amount of time or X number of accesses.

If it was date-sensitive, it wouldn't have worked at all when you first loaded it. If it's chronology-sensitive, resetting the clock won't fool it. If it's sensitive to the number of accesses, that's in the program part of the RBDMS, not in the tables. Remedy: export the tables!

[BevHarris]

62. Thanks. Will do.

Bev

[Fredda Weinberg]

63. It doesn't start life as an mdanything

it starts in a proprietary archive format - I could see GEMS process it as it was converted to a local database.

[OrdinaryTa]

66. Proprietary Format

I don't know what GEMS is - is that GE Medical Systems software? They compress and de-compress medical images. Maybe they are into database stuff as well. If the data Bev is using is compressed in a proprietary format that's independent of any particular database management system, forget about all the programmer's tricks, the dates, the accesses, the chronology. It's some kind of glitch, somewhere.

But if the GEMS file is intended to decompress into an Access database, AND the program self-destructs after X number of accesses or X amount of time, the remedy is to get the program working as it was when Bev took the screen shots, then promptly export the data tables into some other database software: dBase, Paradox, MySQL, Oracle, etc - even another instance of Access. I'd treat the original file the same as a virus-infected file, especially if you don't have an idea where or what the glitch is.

However if there's code associated with the file, which other people have mentioned here, that would imply that it's intended to decompress as an MDB. But you are saying that's not the case.

[Fredda Weinberg]

67. GEMS is Global Elections Mgmt System

and it's obviously meant to take its proprietary backup file and generate an mdb. I can see it processing the .gbf (GEMS backup file) file.

[Pale_Rider]

72. Is there any seed data that gets into the tables of ...

... the new database? Repopulated rows?

[Fredda Weinberg]

73. From the look of the conversion application

I'd say that data is split on archiving and rejoined.

If I thought there was anything suspicious, it's plain enough to find the modules that do this. But I haven't reproduced the original scenario, where rows disappeared from the database.

If I had the screenshots, I could check the data against the table I'm seeing.

[Pale_Rider]

76. We probably could all use screenshots ...

... anyway, I just wondering if there was data in the .gdf file that was used to create the .mdb file. I'm assuming that this .gdf is a export data definition file for Access. Recreates schema and perhaps pre-populate data into Access database tables?

Did Bev verified the row counts using Excel 2002?

Did someone execute a Reset Election? What does the audit log show?

[ParanoidPat]

75. Good to see you...

....Check your inbox! :hi:

[ianbruce]

53. Fredda, you owe me a book.

Will Pitt... Greatest Sedition is Silence... Flash video... Technical Difficulties...

Remember?

[Fredda Weinberg]

57. PM your shipping address

no PO box please

[BevHarris]

64. IAN -- kinda urgent -- if you get a chance, call me

message with numbers on your voicemail.

Bev

[Jackpine Radical]

50. Sorry, Bev.

"Please PM me if you want to try your hand at diagnosing what made this file go boom"

It's beyond my competence and equipment. I'm a psychologist, not a computer geek.

[hunter]

74. I was in San Luis Obispo county yesterday...

...but I didn't happen to throw any electronic voting machines into the back of my truck. This old pirate wants to stay retired.

The field here is very large and I don't think any turf wars of the sort that are brewing between Bev Harris and Fredda Weinberg are warranted. It is my (very sadly and) experienced opinion that we have captured the dog that bit us, and now entire armies of us are examining this beast for rabies.

Thus far I'm still leaning towards the "amoral incompetent boob" scenario, but I'm willing to throw in a few clever weasels who have figured out where the holes are, but please, please, don't be heartbroken if a few of them turn out to be Democrats. But still, I'm not willing to concede that we have touched ultimate evil here... not yet...

I think the Davis recall election will be "illuminating" as Sean Connery once said in the third installment of Indiana Jones, and if at least, so far, it turns out that the guys who are collecting signatures are not crooks... but bloody hell, for eighty cents a sig I could concoct stuff out of the phone book with the very worst of them, and I must tell you it would warm my heart if Darrell Issa has got himself severely screwed since that idiot doesn't seem quite smart enough not to ever to spend his own money on dirty politics...

Anyways the list of California Counties using possibly tainted election software is quite illuminating.

Oh yeah, you, John Ashcroft. You are still an idiot. I think you should confess now, or the God I fear, in Her Very Black and very bare breasted Almightiness, will soon be tossing your detached balls to Her dogs.

Is this a sermon, or a mortal sin? I don't know. PM's are always welcome here. I am going to bed, because I need to have a few more nightmares.

Peace be with you all,

Hunter Hamilton

[Pobeka]

65. Backing up data

I'm woefully under-informed on the project, so disregard this if I'm only displaying my ignorance... (and point me to the "standard reference" links about the technical side of the project, if any).

I'd be burning any data files gathered from the internet to a CDROM before opening them with *any* application. Not just 1 but 2 CDROMs. Then you don't need to worry about the data getting changed -- you can always recover it from the CDROM.

Are their any unix-geeks looking at the data? -- we tend to have a leg up in many cases because of the open-nature of unix (i.e. we know what the hell is going on with an application because we have the source code). Dunno if there are unix apps to read the database files but it may be a source of enlightenment.

Bev, keep up the good work. If people can once again have confidence in the voting system it will be a tremendous boon to democracy!

[juajen]

42. Hi, Bev

Glad you're back. I feel so dumb when I read your posts, but have a deepseated conviction that we were screwed. Keep on keeping on, and stay safe.

[aquart]

52. Bev and all code detectives

I struggle to follow along (because I know nothing, nothing) but follow I do, because these threads, full of curiosity and determination and struggle, fill me with peace and hope and pride.

Been a long time since anything did that.

Bless you all.

[loudsue]

58. Yep! A lot of us lurk on Bev's threads 'cause we "aint gotta clue"!

But we're cheering her on, along with our WAY wonderful DU techies! I'm just awed and amazed....and EXTREMELY hopeful that us regular folks can have our right to vote back again.

:kick: Kickidy kick :kick:

[draftee]

68. with an access database you might try

holding shift when you click the (PRISTENE COPY) to open it.

Then check macros. Holding shift should disable the macros.

Worth a try.

[Fredda Weinberg]

70. Whatever is removed, it was done in the conversion

It's shrunk before I open it.

[DEMActivist]

69. Bev, specific numbers we were looking for

This required Center staff to visit all 159 counties and individually test: 23,000 touch-screen voting units, 8,000 encoders, 420 optical scan units, and 159 servers.

http://ie.kennesaw.edu/prog_rev/ss_reports/year_2_ss_reports_serv_res_centers/CntrElectionSys.pdf

[hunter]

77. This deserves a kick!

Don't ask why, I'm retired.

:kick: