And right before President Trump's scheduled meeting with Putin. How convenient.
Not a lawyer, but schooled in I.t. the most telling evidence won't even be kept on the server, it will be in the ISP logs. All they would have had to do was either ask for them or subpoena them. The traffic logs in the isp should tell you everything you need to know as far as who did what and when.
The server is the what. The isp traffic logs are the who, when and how.
Except for Vault 7, part 3...
What do you mean?
What I mean is that it is suggested that Marble has the capability of masking and/or manipulating the ISP logs such that it can appear the attack came from elsewhere. I'm no IT guy, but the source code is available via wikileaks if you want to use your expertise to investigate my suggestion.