[136] Metadata Falsificada: The Cover-Up File in Gino v. Harvard - Data Colada

Gino v. Harvard" />

Menu

Francesca Gino’s lawsuit against Harvard is still ongoing. (The trial, if it gets to that, is scheduled for December 2026) While the case drags on, both sides keep filing documents with the court, and most of those documents are publicly available (htm). This post is about a recent filing: Document #222 (pdf).

(this post is cross listed on substack htm)

The Cover-Up File

On October 1st, 2023, Gino claimed on her website francesca-v-harvard.org that she had found an Excel file that Harvard should have used in its investigation but didn’t. As she put it, "our unequivocal conclusion is that [Harvard Business School] used the wrong dataset in its investigation . . . The correct dataset . . .  is 100% consistent with the [published results]"  (htm) [1].

Note: in this post, text appearing in [brackets] within quotations indicates that the quote has been edited for clarity.

Harvard countered that the file "was fabricated by Professor Gino and placed on her laptop"  [2].

Harvard refers to this file as the "Cover-Up File", and I will follow suit.

Gino took her post down, but did not recant her claims about the Cover-Up File  [3].

Document #222 is key in Harvard’s claim of a Gino cover-up. The document includes a 42-page PDF containing a data-forensic report by Julian Ackert (htm), an expert hired by Harvard. The report lays out extraordinarily detailed information about computer files moving in and out of Francesca Gino’s laptop over the years.

To get started, imagine you were the analyst tasked with evaluating the legitimacy of the Cover-Up File. What’s the first step you need to take? Finding the file.

Step 1: Finding the Cover-Up File

Harvard had two copies of Gino’s work laptop. One from when they started the investigation in the Fall of 2021, the second from the tenure revocation proceedings in 2024. The forensic analyst found the Cover-Up File only in the 2024 copy. In the 2021 copy, there is a file with the same filename, in the exact same folder, but with different contents [4]. This isn’t great for Gino’s story.

Step 2: When was the Cover-Up File added to Gino’s laptop?

Because the file was found in the 2024 but not the 2021 copy of Gino’s laptop, we know it was added between those years. That’s a wide window. Exactly when it was added seems forensically relevant.

Helpfully, computers keep track of these things. Most relevant to us, they record in the "last-modified" field of each file, when they were last saved. For Excel files, last-modified times are saved in two places:

In the Excel file itself (henceforth, the Excel date)

In the operating-system’s file catalog (henceforth, the macOS date)

The Excel date for the Cover-Up File is "September 23rd, 2023″ [5]. That’s just eight days before Gino wrote on her website about finding the file. This sounds bad, but it need not be. If Gino found the file it would make sense for her to open it. If she then saved it (possibly with auto-save), the Excel date would update. All we learn from this timestamp is that someone using Gino’s laptop accessed the Cover-Up File on September 23rd, 2023 .

The macOS date for the Cover-Up File, in contrast, is older, much older.

It is July 17th, 2010   [6]. So:

Excel said:    "this file was last modified in 2023".

macOS said: "this file was last modified in 2010".

It turns out this pattern of dates, a macOS date 13 years before an Excel date, is "highly irregular" [7] and it led the forensic expert to conclude that the "metadata in the 2023 Cover-Up File was manually backdated" [8]. This means the macOS date was tampered with, it was manually moved back to 2010.

The underlying issue is this:

When you save an Excel file, both the the Excel date and the macOS date update (they match)

When you copy an Excel file, only the macOS date updates (so macOS is newer)

Because you can copy a file after you save it, but you cannot copy a file before you save it, the macOS date can be newer but not older than the Excel date.

OK. This leads to the next question: where was this backdated file before it was put on Gino’s work laptop?

Step 3: A Black USB Drive (Serial #: 21013403D7FFA005) [9] .

Mac computers have something called the "Unified Log". It’s a record of actions taken on the computer. The log for Gino’s work laptop shows that on September 23rd, 2023, the day the Excel file was last saved, Gino’s work laptop was opened for the first time at 5:31 PM [10]. Just one minute later a black USB drive was inserted into the laptop, and 18 seconds later the Cover-Up File was copied onto the laptop [11].

The Cover-Up File had the same name as a file already in the folder it was copied into, so this means that  the Cover-Up File literally covered up (i.e. replaced) an existing file [12].

The analyst notes that on a Mac computer, when copying a file that would overwrite an existing one, a warning pops up [13]. That...