S01E01 - Framing Colby
Two envelopes. One white, one blue. One contains the real forensic evidence from the E Corp hack. The other contains the same evidence with a single modification: Terry Colby’s IP address planted in the .dat file.
Elliot carries both into the FBI meeting. He hasn’t decided yet. Then Colby opens his mouth, insults Angela, and that’s that. The modified evidence goes to the FBI. Colby gets arrested.
TL;DR
| 🎬 Reel or Real? | 🎲 possible but flimsy. editing a .dat file is trivial. Surviving a real forensic investigation with it is a different story |
What Elliot Does
During the E Corp server incident response, Elliot finds a .dat file on the compromised CS30 server. It contains IP addresses used in the attack, plus a message: “LEAVE ME HERE.” It’s fsociety’s calling card.
Mr. Robot gives Elliot Terry Colby’s IP address. Elliot edits the .dat file, replacing one of the attacker IPs with Colby’s. He prepares two versions of the evidence (one clean, one modified) and takes both to the FBI handoff meeting.
It happens right there in the room. FBI traces the planted IP back to Colby’s terminal. CTO of the world’s largest conglomerate gets arrested.
One text edit. No exploit, no shell, no malware. Just a guy who changed a number in a file.
The Invalid IP
Here’s a fun detail. The IP address shown on screen is 218.108.149.373.
Not a real IP address. IPv4 addresses are four numbers separated by dots, each between 0 and 255. That last segment, 373, is out of range. It’s a prop error, acknowledged on IMDB’s goofs page. It isn’t the only one. During the DDoS on E Corp earlier in the episode, 410.145.110.22 appears on screen, and that one fails on the first segment: 410 is out of range too.
Any forensic investigator who looked at this address would immediately know it was fabricated. In the show’s universe, nobody checks. Which brings us to the real question.
Would This Work?
Short answer: it would start an investigation. It wouldn’t survive one.
An IP address in a log file is a lead, not proof. Three judges in three different states have ruled that an IP address isn’t a person. An IP identifies a router, not the human behind it. One of them, Judge Gary Brown, compared it to a telephone number: it tells you a location, not who made the call. The EFF makes the same point: an IP address alone doesn’t identify a suspect.
In a real investigation, the FBI would:
- Check ISP logs: Colby’s ISP would have records of what his IP was doing at the time of the attack. If those logs don’t match the .dat file timestamps, the frame falls apart.
- Examine chain of custody: the evidence came from Allsafe, a third party. Who handled it? Was it sealed? Any decent defence attorney would challenge the integrity of evidence that passed through an outside contractor’s hands.
- Correlate with other evidence: network flow data, firewall logs, Colby’s actual device. A single IP in a single file, with nothing else pointing at him, is circumstantial at best.
But the show understands something real: investigations have momentum. Once the CTO’s IP appears in the malware file, the narrative writes itself. E Corp is under attack. The press is watching. The FBI needs a suspect. Colby fits. By the time anyone does the slow, careful forensic work, he’s already in handcuffs and the damage to his reputation is done.
Nothing about this is technical. It’s social. Elliot didn’t exploit a system. He exploited a process.
Closing
Colby loses his job and his reputation over one edited number in a text file. Not because the evidence was good, but because it was good enough for the room it landed in.
That’s the thing about digital evidence. It looks precise: IP addresses, timestamps, log entries. But the precision is only as reliable as the people who handled it. And Elliot was one of those people.