If I'm not mistaken, can't emails and other documents deleted

from a computer be retrieved?

It's bullshit that those e-mails can't be found somewhere by a good tech.

so why not?

But I'm sure in this case they've got plenty of experts who were able to make them "irretrievable."

How do you think they bust people for child porn? Even after you delete them, files still remain on your hard drive. They can be removed, but from what I hear, it's a very laborious process, and one best handled by experts.

It's harder if your mail (etc.) is stored "on a server" out of your control.
Then your files tend o end up on many backup tapes from which they
can not be/will not be be deleted.

Tesha

proably. If you know what your doing and erase, rewrite, erase, rewrite...repeat ..repeat and then...repeat 100 more times, probably not. The trick is to rewrite numorous times (100+) over the same sector wth random text.

to make it impossible to retrieve data from the disk. You can use any number of cheap commercial programs like Window Washer or Evidence Eliminator to do it automatically each time you shut down the computer.

That only eliminates the copy on your computer! There are a minimum of two other copies out there that must be eliminated to completely destroy the information in the e-mail. There may be more depending on whether there are systems in place to automatically back up all data running through the system.

The first copy you need to worry about is stored on the mail server of the recipient. The second is on the recipient's own computer. You can typically set your mail server to delete messages when downloaded which doesn't actually 'erase' the message, it merely removes the pointer in the drive's FAT table (File Allocation Table) that tells the drive to save the information in that sector by not overwriting it. If you can get to the mail server before that section of memory has been sufficiently overwritten, you can use several techniques to electronically determine what was previously stored there before the latest few sets of data were written to it.

After the media has been written to several times, it becomes harder to electronically distinguish with any accuracy which data set is which, so you must then physically look at the media for clues. You can use a STEM (Scanning Tunneling Electron Microscope) to physically look at the media in the drive to determine with some accuracy what was previously stored on those sectors by examining the slight offset of the tracks and bits that the head in the drive laid down with each successive write operation. The head never writes to exactly the same spot from one pass to the next.

The 'bits' are so small and closely packed that they are affected by the thermal expansion coefficient of the materials that make up the drive. As the drive heats up and cools down a number of small changes take place within it that cause the track and bit patterns to shift ever so slightly. That's what forensics examiners rely on to retrieve the data from a drive. They look for the edges where the previous data was not completely overwritten. :)

Steven P. :kick:

7 times :)

I know next to nothing about computers and found your technical explanation incomprehensible but a real "turn on" :D

And you're right! You can prove "malicious intent" to destroy evidence in light of the well known data and document retention policies in effect. :)

A turn on eh? So um whatcha doin' later? There's a motel down by the Interstate where we could umm 'meet up', say around midnight? I can explain to you how the TIR (Total Indicated Run-out) and the NRR Non Repetitive Run-out) in the shaft of the spindle motor stack up and determine the maximum offset of the bit pattern.

Steven P. :evilgrin:

then they couldn't be found without finding the hard drive.

they would leave the hard drives in those computers. They always cover their tracks.

"visible" data will be on the new drive.

because it would prove that it was DELIBERATE and not an ACCIDENTAL archiving problem ;-)

it. My partner works with high-security data. When we're done with a drive we drill holes in it. It's kinda fun actually. :D

Fairly easy to retrieve un-installed material if ya can find the files. It can be time consuming.

He said the government also makes "scrub" software. When a government document is deleted, it gets scrubbed, BUT it leaves a very, very slight impression and the gov then reuses the hard drive?? Or what ever it would be (I'm computer illiterate :(), and they copy over that slight impression hundred maybe thousands of times in a random fashion to cover up the initial info on the drive. They also make software that UN-scrubs the drive so whatever is on it initially, can be retrieved. He also said it's virtually IMPOSSIBLE to delete something completely. IOW....they're screwed.:) The guy was smart as a whip and knew what he was talking about, but since I'm computer illiterate, how would I know? ;) He DID SOUND like he knew what he was talking about.

I'll have to catch the replay, or listen to the archive.

My name is Jason. I posted in another thread in GDP regarding this issue. Here is the thread-
http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=132x2437261

I am going to post later this weekend about the full scope of this issue from a technical perspective. Nutmegger and I are going to collaborate on this.

If anyone has any info on law regarding file deletion @ the WH, please PM me.

FWIW, my undergrad is BS-IT (information technology)and my post is MS-CIS (computer info systems). I know just enough to be dangerous.





www.lyingorstupid.blogspot.com

thanks for the info, and keep up the good work.

DUers RAWK!!!!!!!

:thumbsup:

back up tapes. Fitzgerald mentioned that the emails were not archived in the usual manner? or something like that. That made me wonder if what he is saying is that he knows they obstructed justice by the way they went about hiding the emails.

I myself have access to some software what will retrieve any data that has been deleted...and this is all shareware stuff. Just do a G-search and you'll find some stuff.

If I want to delete some stuff (such as a PDF bank statement) I use a scrubber which writes the sector millions of times with random bits. Depending of how many times that area is written over will determine how hard it is to retrieve. If you use the max setting, it virtually cannot be retrieved.

Oh and yes, I'm a Computer Science major!:evilgrin:

Science Major too! Was that you?

He posted some info in another thread.

http://www.democraticunderground.com/discuss/duboard.php?az=show_mesg&forum=132&topic_id=2437261&mesg_id=2437645

:hi:

I have to DU mail that guy a hearty thumbs up!!

:)

and you can set it to wipe the file of choice by over writing it up to seven times. once a file is wiped such as this it is non retrivable. And the option was government or something like that wipe. I don't have it installed on this computer or I would check.

Doesn't the government have like cookies or something in most of our computers, monitoring what we do on here?

::Shrugs::

If you're so worried about that, maybe you shouldn't be posting on here.

Ya think?

By the way, Welcome to DU

:hi: