S01E01 - Framing Colby
Two envelopes. One white, one blue. One contains the real forensic evidence from the E Corp hack. The other contains the same evidence with a single modification: Terry Colby’s IP address planted in the .dat file.
Elliot carries both into the FBI meeting. He hasn’t decided yet. Then Colby opens his mouth, insults Angela, and that’s that. Blue envelope goes to Tyrell Wellick. Colby goes to prison.
TL;DR
| 🎬 Reel or Real? | 🎲 possible but flimsy. editing a .dat file is trivial. Surviving a real forensic investigation with it is a different story |
What Elliot Does
During the E Corp server incident response, Elliot finds a .dat file on the compromised CS30 server. It contains IP addresses used in the attack, plus a message: “LEAVE ME HERE.” It’s fsociety’s calling card.
Mr. Robot gives Elliot Terry Colby’s IP address. Elliot edits the .dat file, replacing one of the attacker IPs with Colby’s. He burns two copies of the evidence to disc (one clean, one modified) and takes both to the FBI handoff meeting.
It happens right there in the room. FBI traces the planted IP back to Colby’s terminal. CTO of the world’s largest conglomerate gets arrested.
One text edit. No exploit, no shell, no malware. Just a guy who changed a number in a file.
The Invalid IP
Here’s a fun detail. The IP address shown on screen is 218.108.149.373.
Not a real IP address. IPv4 addresses are four numbers separated by dots, each between 0 and 255. That last segment, 373, is out of range. It’s a prop error, acknowledged on IMDB’s goofs page.
Any forensic investigator who looked at this address would immediately know it was fabricated. In the show’s universe, nobody checks. Which brings us to the real question.
Would This Work?
Short answer: it would start an investigation. It wouldn’t survive one.
An IP address in a log file is a lead, not proof. Three federal judges in three different states have ruled that an IP address isn’t a person. An IP identifies a router, not the human behind it. One judge compared it to a telephone number: it tells you a location, not who made the call.
In a real investigation, the FBI would:
- Check ISP logs: Colby’s ISP would have records of what his IP was doing at the time of the attack. If those logs don’t match the .dat file timestamps, the frame falls apart.
- Examine chain of custody: the evidence came from Allsafe, a third party. Who handled it? Was the disc sealed? Any decent defence attorney would challenge the integrity of evidence that passed through an outside contractor’s hands.
- Correlate with other evidence: network flow data, firewall logs, Colby’s actual device. A single IP in a single file, with nothing else pointing at him, is circumstantial at best.
But the show understands something real: investigations have momentum. Once the CTO’s IP appears in the malware file, the narrative writes itself. E Corp is under attack. The press is watching. The FBI needs a suspect. Colby fits. By the time anyone does the slow, careful forensic work, he’s already in handcuffs and the damage to his reputation is done.
Nothing about this is technical. It’s social. Elliot didn’t exploit a system. He exploited a process.
Closing
Colby loses his career, his freedom, and his reputation over one edited number in a text file. Not because the evidence was good, but because it was good enough for the room it landed in.
That’s the thing about digital evidence. It looks precise: IP addresses, timestamps, log entries. But the precision is only as reliable as the people who handled it. And Elliot was one of those people.