The Digital Forensics Report from the Norwegian University of Science and Technology has more information, describing how they used statistical analysis to determine that there has in fact been manipulation of the playback number data at particular times, and shows the python code they used.

https://www.dn.no/staticprojects/special/2018/05/09/0600/dok...