79 lines
3.0 KiB
Markdown
79 lines
3.0 KiB
Markdown
# Phase 0.9E-R2 local download provenance
|
|
|
|
Date: 2026-07-19
|
|
|
|
Result: `MEDIAFIRE_URL_EXACT`
|
|
|
|
This evidence is host-only. No PS5 address, request, connection, transfer,
|
|
restore, target build, or execution was used.
|
|
|
|
## Local object
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| name | `Y2JB-Autoloader-403-1240.zip` |
|
|
| size | `504159435` |
|
|
| SHA-256 | `805e3f87f0c371223619ffc7d3a7b3c0d41a1fae8a8b1171d9e2f162659e8291` |
|
|
| creation UTC | `2026-06-23T14:10:39.0466596Z` |
|
|
| modification UTC | `2026-06-23T14:11:10.6992328Z` |
|
|
|
|
The file was read without changing it. Its `Zone.Identifier` alternate data
|
|
stream is 327 bytes and has SHA-256
|
|
`70928a3d66cbb9f584596414c4fe535b498dd5ed7c5f55bbeae4efeb146ea841`.
|
|
It contains exactly the `ZoneTransfer` section and these fields:
|
|
|
|
| Field | Safe evidence |
|
|
|---|---|
|
|
| `ZoneId` | `3` |
|
|
| `ReferrerUrl` | host `www.mediafire.com`, path `/`, no query; full-value SHA-256 `9a0ff5a3e34286b2e53192003fca8b6c7b00ad6df3c681765da04ccaa54c0919` |
|
|
| `HostUrl` | host `download2434.mediafire.com`, file key `jq3fcutuwbb1mrb`, filename `Y2JB-Autoloader-403-1240.zip`; full-value SHA-256 `a39f05923d0a5368ea5138c1974ac109bb09f8ab795c6edb8e470d8dfe4d784c` |
|
|
| `LastWriterPackageFamilyName` | absent |
|
|
| `AppZoneId` | absent |
|
|
| other fields | none |
|
|
|
|
The transient signed path component is deliberately redacted. It was neither
|
|
committed nor reproduced here. The complete value remains only in the
|
|
unchanged local ADS.
|
|
|
|
## Browser metadata
|
|
|
|
The bounded search covered existing Chrome Default, Chrome System Profile,
|
|
and Edge Default Chromium History databases. The query was limited to the
|
|
exact filename, size, filesystem-date window, MediaFire host, and file key.
|
|
Brave, standalone Chromium, Opera, and Opera GX profiles were absent.
|
|
|
|
Three read-only database copies were made because browser databases can be
|
|
live-locked. Chrome Default, Chrome System Profile, and Edge Default each
|
|
returned `NO_MATCH`; no download rows were exported and the originals were
|
|
not changed. The temporary copies were removed with the rest of the research
|
|
directory.
|
|
|
|
Browser classification: `NO_BROWSER_HISTORY_MATCH`.
|
|
|
|
## Exact MediaFire page
|
|
|
|
Only
|
|
`https://www.mediafire.com/file/jq3fcutuwbb1mrb/Y2JB-Autoloader-403-1240.zip/file`
|
|
was requested. Static HTML was 333321 bytes with SHA-256
|
|
`655e4c3c2e5c423019b0195ca863ee8906f7ca02601b773b39688a590bf7fcb7`.
|
|
It displayed:
|
|
|
|
- filename `Y2JB-Autoloader-403-1240.zip`;
|
|
- size `480.8MB`;
|
|
- uploaded value `2026-06-11 15:32:16`;
|
|
- upload country `United Kingdom`;
|
|
- the same MediaFire file key.
|
|
|
|
No public account/uploader, user description, tutorial, maker, server digest,
|
|
or exact server byte count was exposed. The download object was not
|
|
downloaded again. The local ADS plus page provide
|
|
`MEDIAFIRE_OBJECT_METADATA_BOUND`, not `MEDIAFIRE_OBJECT_BYTE_BOUND` and not
|
|
maker/source provenance.
|
|
|
|
## Boundary
|
|
|
|
The download-origin classification is `MEDIAFIRE_URL_EXACT`. That describes
|
|
where the local bytes were downloaded from. It does not prove who created
|
|
them, which public source generated them, whether they were restored, or what
|
|
is currently on the PS5.
|