In the timeline you present, how did you get access to the Google sarches Zucker...

unfasten · on Aug 14, 2011

If you're talking about the following:

    6:20:09 A.M. EST
    At about six in the morning, Mark Zuckerberg searches for "universal facebook” on Google,
    finding the Universal Face Book on the Quincy House houseSYSTEM web site.
    roam175-29.student.harvard.edu - - [06/Jan/2004:06:20:09 -0500] "GET /facebook/ HTTP/1.1" 200 5436
    "http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=universal+facebook&btnG=Google+Search"
    "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5) Gecko/20031007 Firebird/0.7"

Then he knows about the search term because of the referrer being logged in his HTTP server logs. This is the standard Combined Log Format. http://httpd.apache.org/docs/1.3/logs.html#combined describes each field if you're curious about the others.

ez77 · on Aug 15, 2011

Thanks! I guess now I don't understand how he was able to associate roam175-29.student.harvard.edu with Zuckerberg. But probably that is a small deduction game for such a hacker! (No sarcasm, just in case.)

thinkcomp · on Aug 15, 2011

When a member signed in their hostname was recorded in the database with a timestamp. The Apache logs, database fields and database timestamps match.