8chan served with search warrant [pdf]
The below was from the twitter account of 8chan in regards to Poway and the NZ shooting.<p>-------------------------------<p>8chan (8ch.net) ‏Verified account @infinitechan Apr 28 <a href="https:&#x2F;&#x2F;twitter.com&#x2F;infinitechan&#x2F;status&#x2F;1122494322283167745" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;infinitechan&#x2F;status&#x2F;1122494322283167745</a><p>The Poway shooter&#x27;s post on 8chan was taken down NINE minutes after creation. There are only screencaps available and no archives exist since the post was deleted so quickly. The loudest groups publicizing this crime and giving attention to this CRIMINAL are the fake-news media.<p>-------------------------------<p>8chan (8ch.net) ‏Verified account @infinitechan Mar 16<p>The 8chan administration is responding to law enforcement regarding the recent incident where many websites were used by a criminal to publicize his crime. We always comply with US law and won&#x27;t comment further on this incident so as not to disrupt the ongoing investigation.<p>=================================<p>From what I can tell the current 8chan is a fork of <a href="https:&#x2F;&#x2F;github.com&#x2F;ctrlcctrlv&#x2F;infinity" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ctrlcctrlv&#x2F;infinity</a><p>It does seem that the IP addresses are stored with the POSTs if this is the code they are still using or are based on <a href="https:&#x2F;&#x2F;github.com&#x2F;ctrlcctrlv&#x2F;infinity&#x2F;blob&#x2F;2bc5b6dbf31af50f54e73f88569496e19b143aad&#x2F;inc&#x2F;functions.php#L1265" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ctrlcctrlv&#x2F;infinity&#x2F;blob&#x2F;2bc5b6dbf31af50f...</a><p>On a side note, even if the posts were erased from the database, with the salt for the hashing function of the IP addresses known which make the 3 byte ID, the board and thread id, you could recover the IP addresses &amp; aliases and cross-check with the ISPs to see which ones were accessing 8chan at the time.<p>Here is a code on how the IDs were generated, at least at one point in time:<p>return substr(sha1(sha1($ip . $config[&#x27;secure_trip_salt&#x27;] . $thread . $board) . $config[&#x27;secure_trip_salt&#x27;]), 0, $config[&#x27;poster_id_length&#x27;]);<p><a href="https:&#x2F;&#x2F;github.com&#x2F;ctrlcctrlv&#x2F;infinity&#x2F;blob&#x2F;2bc5b6dbf31af50f54e73f88569496e19b143aad&#x2F;inc&#x2F;functions.php#L2745" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ctrlcctrlv&#x2F;infinity&#x2F;blob&#x2F;2bc5b6dbf31af50f...</a>