Carbon14 1.0.0

OSINT tool for estimating when a web page was written.

Carbon14

OSINT tool for estimating when a web page was written.

From Wikipedia:

Radiocarbon dating (also referred to as carbon dating or carbon-14 dating) is a method for determining the age of an object containing organic material by using the properties of radiocarbon (¹⁴C), a radioactive isotope of carbon.

Rationale

While performing digital forensics or OSINT, it might be crucial to determine when a certain blog post has been written. Common CMS's easily permit to change the displayed date of content, affecting both websites and RSS feeds. Moreover, the dynamic nature of most web pages does not allow investigators to use the Last-Modified HTTP header.

However, most users do not alter the timestamps of static resources that are uploaded while writing articles. The Last-Modified header of linked images can be leveraged to estimate the time period spent by the writer while preparing a blog post. This period can be compared to what the CMS shows in order to detect notable differences.

Installation

You can install Carbon14 using Pip:

pip install carbon14

Or as a tool with uv:

uv tool install carbon14

Usage

Carbon14 accepts the target URL and an optional author name.

usage: carbon14 [-h] [-a name] url

Date images on a web page.

positional arguments:
  url                   URL of the page

optional arguments:
  -h, --help            show this help message and exit
  -a name, --author name
                        author to be included in the report

The tool prints a simple report in Pandoc's extended Markdown format which can then be redirected to a file (or with tee). For example:

carbon14.py 'https://eforensicsmag.com/extracting-data-damaged-ntfs-drives-andrea-lazzarotto/' > report.md

Here's a snippet of the output:

# Internal images

--------------------------------------------------------------------------------
Date (UTC)           Date (Europe/Rome)   URL
-------------------- -------------------- --------------------------------------

[...]

2017-03-06 14:27:17  2017-03-06 15:27:17  <https://eforensicsmag.com/wp-content/uploads/2017/03/image06-1.png>

2017-03-06 14:43:04  2017-03-06 15:43:04  <https://eforensicsmag.com/wp-content/uploads/2017/03/image04-1.png>

2017-03-06 14:48:22  2017-03-06 15:48:22  <https://eforensicsmag.com/wp-content/uploads/2017/03/image02-1.png>

We can infer that work on that article began on March 6, 2017.

Using proxies

Carbon14 uses the Python requests library, which supports standard proxy environment variables. This means you can route traffic through a proxy without adding command-line options.

Temporary proxy usage for a single command:

HTTP_PROXY=http://127.0.0.1:8080 HTTPS_PROXY=http://127.0.0.1:8080 carbon14 https://example.org

Persist proxy settings in your shell session:

export HTTP_PROXY=http://127.0.0.1:8080
export HTTPS_PROXY=http://127.0.0.1:8080
carbon14 https://example.org

If you use Tor, point those variables to your local HTTP proxy bridge. A common setup is Tor + Privoxy, where Privoxy listens on 127.0.0.1:8118 and forwards traffic to Tor:

export HTTP_PROXY=http://127.0.0.1:8118
export HTTPS_PROXY=http://127.0.0.1:8118
carbon14 https://example.onion

You may also unset variables to go back to direct connections:

unset HTTP_PROXY HTTPS_PROXY

Markdown report

The Markdown syntax is text-based and lightweight. This means that the report can be used or printed as-is, like a normal text file. Optionally, examiners might want to convert it to a different format such as HTML, ODT or DOCX.

This optional step can be performed with Pandoc:

pandoc -s report.md -o report-web.html
pandoc report.md -o report-libreoffice.odt
pandoc report.md -o report-msword.docx

Pandoc can also be used to generate HTML reports with custom CSS files, PDF reports and several other outputs. Please refer to its documentation for further details.