03 · Evidence archive
The document exists in two forms: a native DOCX and a derivative PDF.
One preserves metadata and construction history. The other preserves only what the page looks like. They tell different stories.
Document inventory
| File | Format | Date | Provenance |
|---|---|---|---|
1776 Thesis.docx | DOCX (OOXML) | Dec 30, 2020 | Sent by Flores to Tarrio via Telegram. No longer available in original form. |
telegram-cloud-document-1-5145562784171294938.docx | DOCX (OOXML) | Dec 30, 2020 | Telegram-archived copy. SHA-256: c8522cb1.... Subject of this forensic analysis. |
signal-2026-06-20-200443.pdf | PDF 1.5 (rasterized) | Feb 8, 2022 | Rasterized recreation. 9 pages, each page is a JPEG image at 200 ppi. No native text layer. Metadata stripped. |
signal-2026-06-20-200414.pdf | PDF 1.6 | Mar 9, 2022 | Companion document: “Superseder_March 7_FINAL” covering Tarrio private messaging. Native text layer preserved. |
Chain of custody
| Step | Action | Holder | Date |
|---|---|---|---|
| 1 | Armes creates precursor document (Google Doc) | Armes | Aug–Sep 2020 |
| 2 | Armes shares precursor with Flores (Google Drive) | Armes → Flores | Late 2020 |
| 3 | Flores assembles final DOCX, edits with Grammarly | Flores | Dec 29–30, 2020 |
| 4 | Flores sends 1776 Thesis.docx to Tarrio (Telegram) | Flores → Tarrio | Dec 30, 2020 |
| 5 | Telegram cloud stores archived copy | Telegram servers | Dec 30, 2020 |
| 6 | House Select Committee collects document from unknown source | Committee | 2021–2022 |
| 7 | Rasterized PDF created (Feb 8, 2022) | Unknown | Feb 8, 2022 |
| 8 | PDF produced to Rehl defense in discovery | Government → Defense | 2022–2023 |
| 9 | DOCX exported from Telegram, analyzed forensically | Independent | Jun 2026 |
Gap: Steps 6–7 are undocumented. We do not know who created the PDF, from what source, or why. The original
1776 Thesis.docx is not in the public record.Grammarly artifacts
The DOCX contains Forensic two Grammarly DOX plugin variables embedded in word/settings.xml. These prove Grammarly was actively editing this document and establish a server-side trail.
| Variable | Value | Meaning |
|---|---|---|
__Grammarly_42____i | {"DataPartCount":1} | Document submitted as single part |
__Grammarly_42___1 | {"DocId":"132537363747608562","SessionId":4} | Grammarly document ID & at least 4 editing sessions |
Strategic value: Grammarly DocId
132537363747608562 is the key to recovering full edit history, session timestamps, IP addresses, and author account identity via subpoena to Grammarly, Inc. (548 Market St, San Francisco).Document identity GUIDs
The DOCX carries two persistent identity GUIDs that survive metadata stripping and format conversion:
| ID Type | Value |
|---|---|
| w14:docId (Word 2010+) | 39D9AE9F |
| w15:docId (Word 2013+) | {8C755BB9-038D-4E0C-982A-5C94BCB64F6B} |
These GUIDs are baked into the document XML at creation. If Armes’ or Flores’ machines are ever recovered, matching these IDs would be definitive identification of the source device.
Legal analysis
Brady implications
- The PDF’s Feb 8, 2022 creation date is exculpatory: it shows the document is a recreation, not the original
- If the government knew this and did not disclose it, that is a colorable Brady claim
- D.D.C. standing Brady order requires information to be produced in its original tangible format
Authentication issues
- Rasterized PDF cannot be authenticated as the original planning document
- No chain of custody for the PDF creation process
- No /Producer, /Creator, /Title, or /Author metadata in the PDF
- ModDate identical to CreationDate despite incremental save—metadata manipulation
Precedent: The government’s production of a metadata-stripped PDF as substitute for original digital evidence mirrors the pattern identified in United States v. Raniere (E.D.N.Y.), where a paralegal-created PDF concealed camera-card tampering for over four years.
Chain of custody: 9 steps from Armes to independent forensic analysis.Next: Forensics →