 | 1 | initial version |
If the file was altered by remote means and you were capturing at the time and the traffic wasn't encrypted (or you somehow have the encryption key) then you might be able to infer that. In all likelihood this isn't the case.
