We have seen (here),that the notorious Cools post was made on Sept. 5, 2003, by a computer with a user agent that will have looked like this:
- "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))"
As we saw in the last post the details in red here show that the Cools poster, had a computer running Windows 98 and had a version of Microsoft Exporer 6 that had been supplied by Rogers cable (hence the "Rogers"-part of what is in red). The computer also had Real Player (version 1.3) installed and used it to visit the site.
We also know that Warman visited freedomsite.org on October 15, 2003, leaving behind this log entry:here). Moreover, he did not use Real Player to visit the site (thus no "R1 1.3").*
But this means the user agent data is not identical. So, what do we have to prove Warman wrote the Cools post? An IP shared by almost a million people, and a computer that is differently configured. One might begin to manufacture scenarios in which Warman made both posts, but they're getting into lottery-like odds. At the very least, the forensics require that the posts were made from different machines.
*Note. Commenter "freemarkets" points out (surely correctly) that the Real Player had to be both installed and playing in order for it to register in the user string. See now here.
Edited and revised for clarity and accuracy.
For more commentary see this more recent post.