>>1731266

Posting some info on how to get bitcoin addresses from hashes.

Example, Snowden's tweeted hash:

ffdae96f8dd292374a966ec8b57d9cc680ce1d23cb7072c522efe32a1a7e34b0

To get two addresses out of it, you do (in Python):

from pybitcoin import BitcoinPrivateKey

pk = BitcoinPrivateKey('ffdae96f8dd292374a966ec8b57d9cc680ce1d23cb7072c522efe32a1a7e34b0', compressed=True)

pk = BitcoinPrivateKey('ffdae96f8dd292374a966ec8b57d9cc680ce1d23cb7072c522efe32a1a7e34b0')

pk.public_key().address()

And you get: 1EnDZkT8Thep9sfbAy5gwg23EHhZw7tYwg

Then you can find the address here: h ttps://blockchain.info/address/1EnDZkT8Thep9sfbAy5gwg23EHhZw7tYwg

The second address comes by using the compressed option:

pk = BitcoinPrivateKey('ffdae96f8dd292374a966ec8b57d9cc680ce1d23cb7072c522efe32a1a7e34b0', compressed=True)

pk.public_key().address()

1L3Zqv68zsXxNs53r25dKcUgjDe1119Rhj

Which is: h ttps://blockchain.info/address/1L3Zqv68zsXxNs53r25dKcUgjDe1119Rhj

>>1731266

Bitcoin addresses from Kerry hash:

1D7f2VtZz7HHmdhpgn82nDhfu1b3PN5TaU

1KWsRE9FjFTZgBzKyjv6UQQGwKACbQgR9e

Ecuador:

1JZL5DtxtsPk5MuAhQgsDd5ZYGaKVbiRta

16YJC3wJtAUjYWsCRXgYed9iyfL8AqqXpB

UKFCO:

1Pf71gkiDPZNaS1DrnexsA33t394A2JBmf

1HsJsAsDT3yJLBHJFBioTLQDGWi5DJvbdm

Used same procedure as with the Snowden hash tweet

>>1731444

no idea. What is interesting is the amount of the first transaction. 0.000911 BTC is deliberate and meant to draw attention to the transaction.

Those two addresses that sent the 911 transaction…anything interesting about them? Anything interesting about the amounts of spent BTC from the snowden address?

>>1731999

Each transaction has a little bit of extra data. String transactions together and you can build files from the added data.

The problem is finding out which transactions are the start of the file. Also, once you find the start, where do you go from there? Usually this is done by connecting transactions based on the amount of bitcoins sent.

So for example: .000911 bitcoins would show an important file. Then ascend the amount with each transaction: .000912, then .000913, then .000914…ect.

Follow this through and you will get the complete file.

>>1733023

Bring the file up within a hex editor (ghex on linux for example) and look for the header of a file type.

For example, a PNG has a header that looks like this: "89 50 4E 47"

If you find that sequence within the file you've just found the beginning of a PNG. You can look at any PNG and it will have the same header. Build a list of headers for common files used by wikileaks and you can then grep for them within larger containers.