Deleting embarrassing e-mails isn't easy, experts say

[babylonsister]

http://www.realcities.com/mld/krwashington/news/nation/17074852.htm

Fri, Apr. 13, 2007
Deleting embarrassing e-mails isn't easy, experts say
By Robert S. Boyd
McClatchy Newspapers

WASHINGTON - If Karl Rove or other White House staffers tried to delete sensitive e-mails from their computers, experts said, investigators usually could recover all or most of them.

The House Committee on Oversight and Government Reform is investigating whether the White House or the Republican National Committee erased "a large volume of e-mails" that may be related to the firings of eight U.S. attorneys.

Rove's lawyer, Robert Luskin, denied Friday that his client, President Bush's top political adviser, intentionally deleted his e-mails. He said Rove thought they were being stored on other machines as well as on his own.

Deleting a document or e-mail doesn't remove the file from a computer's hard drive or a backup server. The only thing that's erased is the address - known as a "pointer" - indicating where the file is stored.

It's like "removing an index card in a library," said Robert Guinaugh, a senior partner at CyberControls LLC, a data forensic-support company in Barrington, Ill. "You take the card out, but the book is still on the shelf."

Similarly, the bits and bytes - the 0's and 1's of computer language - remain on the computer's hard disk until they're overwritten by another file. Portions of the file also are scattered in various locations on the disk, so some parts may not be overwritten for years, if ever. This is a random process directed by the machine's operating system, over which the user has no control.

"People think they can delete e-mails, but that's not always the case," Guinaugh said. "Two years from now I could still find a file I deleted today."

more...

[Mandate My Ass]

1. It's hard work...

No wonder Iraq is a mess, it's hard work deleting 5 million emails.

I saw a Cold Case Files episode once where years later, they finally solved a suspicious "suicide" in which the husband was the main suspect until suddenly a suicide note was found. They later discovered the husband had written the suicide note on the computer after his wife was dead. He thought had scrubbed it but they got him for murder one.

[Pavulon]

2. That is incorrect

it depends on the system. Most corporate systems back retention policy with a method of destroying data. So when you create an email in domino for example the system starts a clock. At x days the email is archived (copied then original destroyed). The archive lives on tape or disk that is encrypted from the block up with a key. I will use decru as an example. Once the system determines the data for april 1 needs to be destroyed a job destroys the key used to encrypt the data. At that point the data is not recoverable by any documented means. Its gone.

If they are sloppy and just leave the data around and it is backed up to non protected media then it could be recovered. Provided the tape was not degaussed or block erased.

[Jeroen]

3. Self destructed post n/t

[On the Road]

4. This is the Part I Like:

As an investigator works, he may run across evidence that someone had installed scrubbing software or changed the date and time that a file was created.
"That would be suspicious," Guinaugh said. "It might indicate that something nefarious was going on."

Scrubbing software will serve to deepen the doodoo. Or maybe Rove deleted the emails manually. In which case large amounts may be recoverable. And that will deepen it also.

[BlueJazz]

5. Very True but...with the resources offered to Men of power....

...like Karl, I would go much further into this matter.

I would ask myself "Who would Karl or one of his flunkies call to erase files"
I would then find this person and question the hell out of them.

[Jersey Devil]

6. I doubt they'd look on his computer

Sure, maybe the average Joe who doesn't know much about computers would have a problem deleting email but not someone with a whole staff of techies at his dispostal. Heck, Rove could even have done it himself. They sell cheap programs that overwrite free space 7 times (NSA standards) or even 35 times (Guttman standard) like Webroot's Window Washer. Those emails would be incapable of being retrieved.

It's the server where they'd find them in archive files, assuming they didn't do the same thing. These guys are not dopes. Why wouldn't the gop server wipe them as well after a phone call from Rove's henchman?

[johnnydrama]

7. but

Isn't the catch that if these emails have been scrubbed, and overwritten by industry standards, then that fact alone basically is admitting to a crime.

You can't claim innocent deletion if you scrub them with programs like those.

[Wilber_Stool]

9. Wouldn't it be a gas if he deleted all the e-mails

but forgot all the pictures of little girls.

[boston bean]

8. It's not that hard to do, just select all and then delete.

But then you have to make sure you delete the deleted emails in the delete folder.

I wonder if they looked for them there.

:evilgrin: