I am going to take a guess on how the CrowdStrike event might have happened. This is based on two (2) observations:
(1) CS said they have always followed the same process in the past without issues
(2) (personal observation) When certain NAS drives get full and you modify a file, it ends up with all NULL bytes.
Here's my guess on how their process was:
Typically, when their content file is ready, they push it to their farm of QA test machines for testing and also to this NAS drive that's ready for deployment. And when all of their test deployments are successful, they press this BIG RED button that picks up this content file from the NAS drive for global deployment.
During their prior deployments, this NAS drive had plenty of free space and deployments went well. Now, when the NAS was full, upon copy, it produces a file with all NULL bytes.
In summary, the content file they tested with was not the file that got globally deployed.
