Caller on Randi Rhodes Just Said Emails Are Retrievable!!

[orleans]

this computer "nerd" who is getting a masters in ??? computer something or other said:

when you delete an email it goes to a deleted email folder
when you empty that and it vaporizes your computer still has it but he said it's as if it is written in pencil that has been erased--you can still get it though

he said the defense department has something called scrubbers--a software you can download--and the scrubbers start putting other deleted emails on the erased pencil marks, and marks them randomly to super hide what the original said.

he said there is another software that you can also get that will counter the scrubbing software. this will take all the scrubbing that has been done off the computer so you can see the original pencil lines

he also pointed out that if a scrubbing software was applied to white house computers they are really f*cked because it's against the law to delete emails. and now the white house is saying they were accidentally erased--but if they find the scrubbing software on the computer then we know for sure what they're up to.

SOMEONE TELL FITZGERALD TO SUBPOENA THE COMPUTERS AND START CHECKING THIS OUT!!!

[Rick Myers]

1. That's true...

In FACT, there are forensic labs that claim data can be recovered if the hard drive is REFORMATTED 9 times!

[newblewtoo]

6. Claiming and doing ....

There are many variables in data recovery. Mail server crashes can be nasty business, intentional or not. I am always skeptical about data recovery claims.

[Rene]

49. Would that be Cheney's/Libby's hard drive they need to check or

a centralized network server. Do you think they've already replaced all the hardware and rebuilt the servers?

Where do you think the White House's LAN is run from....is it actually in the building or in a Data Center they're networked to? If they're networked on a LAN, I bet ALL that email is recoverable.

[bballny]

2. He's rightt they are there-n/t

[zulchzulu]

3. Servers get backed up...even Fitz's email app has Sent emails...

There indeed are backups made somewhere...

[Mr Rabble]

4. That was me. Thanks for paying attention.

Its even more serious than what I was able to talk about on air.

I would be more than happy to explain this if you like.

[orleans]

7. that was you on randi's show? well, great job and thanks for

calling!!

yes, do tell. if you have the time here--i'd love to hear whatever you have to say about this. please tell.

[Mr Rabble]

12. Yup. My name is Jason. I call into Randi's show...

occasionally. There really is a lot to tell about data retrieval and recovery. There is also a lot to tell about DoD protocol regarding the handling of email.

First and most important perhaps is procedure and protocol regarding email. From looking at DoD spec for information handling, it can clearly be seen that the higher your clearance, the more redundancy must be built into your information systems. In the case of a high level staffer at the White House, this would mean that there would be multiple copies of everyones .pst file. The .pst is the file which stores all of Outlook's data; emails, contacts, calendar, etc...

Further, there would be- as a matter of protocol- multiple copies of this .pst. In addition to being stored on the local machine (PC) there would be a copy one the server. There would also be a copy in tape backup format. I can only assume that the WH would do a bit-by-bit backup at LEAST once a week, with incremental backup everyday. Unless Bush has appointed Captain Kangaroo as IT Director of the WH, this would be a foregone conclusion.

Further still, there would be an off site backup. This is rather routine for all large corporations, as an essential part of a disaster recovery plan.

Now, there is the possibility that it would be very difficult to retrieve. The longer you wait-while using the computer- the harder is will be to get real data.

That being said, I have NO DOUBT that if they want it, they will find it. Period. The DoD has tools- which are not commercially available- which can heighten the level of recovery substantially.

Now, lets look at erasing data. As I said to Randi, when you delete something and it goes into your Deleted items folder, it really just gets overwritten. Again, as I said that is just like a pencil and eraser. Now since the DoD may have occasion to totally destroy data, they have developed a specific protocol which scrubbing software must follow in order to be certified. This certification process is difficult, expensive, and time consuming so many companies choose not to design this way.

Without going into the details of exactly how data is "erased" using DoD approved scrubbers, lets look at the pencil/eraser analogy. Using one of these programs would be the equivalent of writing a random series of numbers and letters more than a million times, all on the exact spot you wish to "erase". In effect, they are creating millions of layers of data, on top of the original data.

Since I can only speak about what the FBI can do with any real authority, let me say that the FBI has tools which will recover anything, from any computer, in virtually any condition. The only thing I can think of doing which would totally destroy data on a hard drive would be to physically destroy the disc with a blowtorch, or acid.

Remember, this isn't private sector data recovery (which is excellent in many cases) this is the federal government. As much as our current administration are killers and thieves, there are still some very clever people working there, and they have some incredible tools at their disposal.

In conclusion, if they did indeed delete emails, that would be a crime. If they then used any type of scrubber, that would again be a crime. The question is, will anyone bother to find out.

I also have other thoughts about the recent searches of Yahoo, MSN, and Google. I will be posting here and on my blog this weekend.

http://lyingorstupid.blogspot.com /

Any questions?

[feelthebreeze]

15. Just for argument's sake...

Let's say he doesnot know this. Is there a contact site or number any of you DUers have on Fitzy, so we can forward this to him? Worse case scenario, he knows all of this and also sees how we the people are keeping up with him.

[newblewtoo]

17. physically destroy the disc

How about a degausser. They are fast, efficient, and DOD approved if I remember correctly.

[Mr Rabble]

19. Maybe so. My point was...

that the only way to really make sure its gone is to totally destroy the disc.

[newblewtoo]

20. True

Of course there are problems with back-ups and off site storage as well. Using the same tape day after day can be a real problem.......Never doing a disaster recovery drill until it is needed is another. It is amazing the number of things which can go wrong with the hardware and software.

[Mr Rabble]

21. Of course. That why

you need to have a very comprehensive disaster recovery plan.

And I just looked up the spec- DoD 5220.22.

This outlines exact procedure for deleting and erasing files.

In large organizations like the Fed. Gov. the IT library and its documentation is overwhelming. There are ALWAYS procedures and policies in place for every conceivable thing.

[newblewtoo]

27. Contracting Out

I remember two major exchange server crashes in about as many years. In both cases back-up and restoration was virtually useless. There were lots of procedures and documentation. Several contractors were fired but data was 'gone' too. Lots of DOD is now 'contracted out'.

[Mr Rabble]

28. Agreed. Its not always gonna work.

Ive lost entire servers. It happens. However, I have never tried a data recovery specialist for a server. In my situation it was not feasable.

In the situation with the Cheney emails, I believe everything will be done that can be done.

[newblewtoo]

29. I hope

you are correct but given the record I would not place large sums on it.

[EVDebs]

50. Traces of the 'obstruction of justice' are still left behind....

These events are far far far from a 'perfect crime'. Truth and the light of day, the great disinfectant must take their course. War fever in the body politick, once run thru, hopefully will cleanse the system. Foreign critiques and now the new British DSM memo ... Keep the pressure on. US media will be forced to cover.

[spuddonna]

18. You were great!

The pencil eraser analogy was awesome! I'd tried explaining the idea of why you'd do a "govt wipe" to my dad and he didn't understand because he had the impression of a static 1 or 0. It really isn't that simple, and I think the pencil eraser analogy is perfect!

"If they then used any type of scrubber, that would again be a crime. The question is, will anyone bother to find out." God, I hope there are some high-tech people involved in Fitz's investigation!

Also, great comment on Negroponte...

[orleans]

22. thanks for all the detail. got another question...

you said:
Since I can only speak about what the FBI can do with any real authority, let me say that the FBI has tools which will recover anything, from any computer, in virtually any condition. The only thing I can think of doing which would totally destroy data on a hard drive would be to physically destroy the disc with a blowtorch, or acid.

does that mean you're fbi? worked with them? doing research? (intreiguing...)

that wasn't my question.
here's my question: is fitzgerald aware of this? does he know these missing emails are retrievable? how can we be sure he knows he can still get at them?

[Mr Rabble]

23. You are most welcome. In two parts

I can speak for what is done at the FBI as I have contacts who work there in a forensic networking capacity. I have seen this type of work being done at the office where they work. This work that I witnessed was non-classified work, regarding data recovery and forensic networking.

I have been wrestling with the idea of blogging about other things which I have witnessed which were illegal, although I am concerned about how this might effect my relationships with these people. I can say this- Be afraid.

With regards to Fitzgerald, I can only assume that he is well aware of what can be done in this arena. While I have a cursory understanding of the technology and its implications, I am by no means an expert in this area. In fact, without looking at the DoD spec, I didn't know protocol for data erasure (DoD spec).

I would be willing to bet that Fitz knows that he can recover email. Further, I am willing to bet that the Bush Crime Family know this as well, and is doing everything they can to cover their tracks.

[orleans]

30. pretty dark here:

I can say this- Be afraid.

very cryptic

(but i don't *want* to be afraid. afraid of WHAT?)

i missed a lot of randi's show today--i heard her mention martin luther king, saying "i may not get there with you" and the fact that she is in the public eye so her absence would be noticed and missed. i heard her say that she has said that to cindy sheehan--stay public. and i think she mentioned tice from (nsa?) and how when he came out with this he went on tv and went public.

perhaps if you're going to say anything--and it is noteworthy/newsworthy/important/relevant then maybe blogging is not the way to go with it--maybe contacting randi again--although she keeps talking about her phone being tapped--or going to a major newspaper. or tv. and stay in the public light.

[Mr Rabble]

31. Of what our government is doing with info gathering.

What is being done by information analysts and gatherers- at least at the FBI- is illegal and certainly immoral. This much I can say without revealing any confidences. Further, I would really not be the one at risk for speaking about what I know. Rather, people with whom I have learned this information would potentially be at risk.

Lets just say that for the government to find out from my DU account who I am, and who I am in contact with, through internet, phone, and snail mail, would be a simple exercise. That why I say be afraid. Not only can they find this stuff out, there are in the practice of finding this stuff out.

No warrants. No PC. No reason.

Because they can.

[imlost]

52. Fitzge should be aware of all of this! Specially if he is working with FBI

The FBI IT guys can do just about anything. They are highly trained and very intelligent.
I worked at a former company where there services where needed and trust me they can figure out just about anything.
I can't go into detail because of confidentiality agreements but they know what they are doing.
This was a much smaller case!

[Duer 157099]

24. whoa... hold on there...

Unless Bush has appointed Captain Kangaroo as IT Director of the WH, this would be a foregone conclusion.

You mean "doin'-a-heckuva-job-Brownie" Bush, that Bush? Camptain Kangaroo probably exceeds his standards.

Having recently experienced a major crash, I take your words as comforting.

[Mr Rabble]

25. Be forewarned-

A true data recovery of a hard drive done by a specialist can be VERY costly. While I have been able to restore most lost files and crashed machines with relatively little hassle, I have also seen an invoice for $2200 for a 20gb recovery.

You just never know...

[Duer 157099]

32. Yeah, I know

But thanks for the warning. I'm still in the pre-recovery phase, but from a glance, it looks like major damage (not physical, though). The few files I tested that were recovered were not what the file name said they should be. That sounds serious to me! lol... oh well

[KatyaR]

34. HEY, HEY, HEY!!!!!

The Captain was VERY smart!

[Peggy Day]

45. are you available for elections? just kidding. nt

[Clark2008]

8. I know a little about this, having first worked in the tech

industry and now for a computer learning center.

The hard drive, even reformatted, still keeps a carbon in the coding, for lack of a better explanation.

But, I think you should start a thread and explain this, if you haven't already.

[Imalittleteapot]

11. Wow. You were great. What did she call you -

the geekiest geek in the world? She loves you!!!

I knew that information was retrievable, but you made it make sense to all of us non-geeks.

Thanks emperor72!

[renate]

26. wow! good for you!

[tkmorris]

5. Well, it depends

While it is true that even though something has been deleted the information still exists on the hard drive, it becomes harder and harder to retrieve any meaningful information as those sectors get overwritten. I would wager that enough time has gone by that those emails are gone for good.

I wish that wasn't the case, but I believe it is.

Edited for clarity.

[JuniperLea]

9. Recipient computers too

So an email between two people is on at least two computers.

If they scrubbed, they should be rubbed... out!


Sorry...couldn't resist

[BigYawn]

10. You can also "scrub" the scrubing software itself..

Even the process of defragmenting your drives can
overwrite a lot of empty space where most of the deleted
material was located before deletion.

The so called scrubbing process can be performed at
various levels of intensity. Some scrubbers can write
random patterns 2 dozen times on the file being scrubbed,
making it impossible to reconstruct in any meaningful way.

[JMDEM]

13. I don't think so!

True -- if an email is deleted it may end up in a "discarded" folder, where it still exists. If deleted from that folder, it still exists on disk, although the index to it is lost, and the space it originally occupied may be reallocated and reused to write other files.

But once the disk space the email was written in is written over, it is GONE.

The erasing programs the Defense Department (and many corporations) use bypass the normal routine of simply deleting the index to the file, and literally rewrite every bit on disk of the original file -- with "zeros" or "ones" -- it doesn't matter. Once those bits (or rather the magnetic material representing the bit) are overwritten, there is no way to determine what was originally there. No way.

Let's say you had a bunch of light switches -- some on, some off. The pattern of on and off positions was actually a message. Then someone came along and turned all the switches to the off position. How could you tell which ones had been on and which ones had been off originally? You can't do it. Same idea with the information on a disk that has been completely erased.

I guess it is theoretically possible to detect some anomoly in the magnetic material of a disk that would indicate that the prior bit had been the opposite of what it is currently -- but this is assuming only one "rewrite". And ithis detection would not be consistent. Plus, if the bit had been overwritten more than once, there is no way to tell what it had 3 or 4 "writes" in the past.

Most people get fooled by these TV shows where they show someone erasing stuff from their computer, then it is recovered by the police. The police can often do this because most average citizens don't realize the whole scheme of how computers use indices to files, then in the erasing process, only the index is changed and not the file. However, any serious computer scientist, system admin, or security expert would know of the "deep erasing" programs that can eliminate everything. Heck, I think Norton's offers such programs commercially for just a few bucks.

[JMDEM]

16. Ah -- backups and copies

My above post failed to consider the backups and copies and "Store and forward" issues discussed in other posts on this thread. Ah.... so there is a large possibility that the emails do still exist as copies in multiple places. It would be very difficult to track down all of those copies. Excellent points!!!

[lapfog_1]

14. Email... and net postings (like this)

are, by and large, store and forward protocols... and anything that is stored is likely retrievable from any of the places where it got stored. (mail servers of various flavors, your local hard disk, web servers, backups of same, and so on). Scrubbing them all is difficult, to say the least. Even scrubbing your local hard drive to remove files is difficult. One has to write and re-write the same disk sectors your email or web browser cache landed on.. usually numerous times with specific patterns. Going to the "internets" and finding all of the copies and doing the same is near impossible.

Encrypt everything. Use off-shore anonymous web and email forwarders. Hope that enough do it that you are lost in the crowd.

[Nutmegger]

33. I'll post what I said in a simlar thread in GD

I myself have access to some software what will retrieve any data that has been deleted...and this is all shareware stuff. Just do a G-search and you'll find some stuff.

If I want to delete some stuff (such as a PDF bank statement) I use a scrubber which writes the sector millions of times with random bits. Depending of how many times that area is written over will determine how hard it is to retrieve. If you use the max setting, it virtually cannot be retrieved.

Oh and yes, I'm a Computer Science major!

[Mr Rabble]

35. Thats what Isaid on the radio today

and why I am trying to convey above. Now just imagine what DoD actually has access to.

I was a CS major also. I went on to get an MS-CIS.

[GregW]

36. Millions of times?

US DoD 5220.22-M calls for 7 passes, and you use millions?

Are you *sure* you're a CS major, or just overly cautious?

[Nutmegger]

37. Um just overly cautious

Call me paranoid but I always go waaaay beyond any govt standard.

Perhaps millions was a bit of an exaggeration but the software that exists does have the ability to go way beyond five scans.

[orleans]

39. "youre paranoid"! (? just doing what i thought you wanted someone to do)

(smile) n/t

[Mr Rabble]

38. Yeah, millions.

DoD spec calls for seven. Depending on classification of information, the spec can change.

Most commercially available shredders will run thousands (if not more)of passes over a sector, even though they only "need" to run seven.

Since I don't work for DoD, nor do I write spec for them, I don't have a need to memorize this sort of information.

[Nutmegger]

40. Thank you for clarifying

I didn't think I got it wrong!

[Mr Rabble]

41. Nope, you are on point.

Its real easy to get sidetracked here over semantics. Which, in the end are not at all relevant to the underlying issue here.

If they deleted emails, it was against protocol, it was illegal, there is a copy somewhere, and they will be found out.

[orleans]

42. let's hope they're found out! n/t

[NancyG]

43. I thought the WH used Lotus Notes

which has very powerful backup capabilites.

And law states multiple copies and backups required for WH correspondence and that it is illegal to delete.

Also, anyone who replies to a note copying the original has proof the original existed. What I mean is that if they scrubbed a grouping of emails, and in just one case the original is missing and a reference to the original is copied in a replied or forwarded email, there is proof of illegal erasing of WH correspondence.

[Mr Rabble]

44. Exactly correct. Do they use Lotus Notes?

I have not looked into this yet. Do they use Notes?

[annabanana]

55. yes. It's Lotus..Lotus for all of Washington DC

It was apparently a contract that was supposed to be expanded nationwide, but never was.

[The Backlash Cometh]

46. Well, then, if they confiscated Cheney's computer during that

Phillippino spy raid, then they have everything they need.

[rasputin1952]

47. Doesn't it seem far too 'convenient' for these files to be 'missing'...

That is my main point of contention. Every time something comes up that will embarrass/show this president for what he and his admin are, things are 'missing' or classified out of existence.

These people are so corrupt, they cannot speak the truth on anything. The American people are duped everyday by the wild-eyed scenarios that come out of this administration, and because they refuse to follow through on looking into some of these claims, they are beholding to their own ignorance.

Sure, there are times when National Security is of primary importance, but this administration has taken that excuse to new heights. I don't think it is in the interest of National Security to expose bush and his cronies for the bedwetters they are, in fact, by doing so, it will enhance National Security.

Strange how all of the messages of average citizens are recoverable in a split second, and 'somehow', what the WH sends out is irrecoverable, I can't believe that, and they are lying like the fools they are.

And they want to push for "democracy" around the world...some shining lights of democracy these jerks are...They are dragging this nation into the Dark Ages...

[CantGetFooledAgain]

48. Agreed. Those emails are conveniently "gone" for good

I'm thinking that most likely, there would be an alternate and much smaller mail system (other than the main WH mail server that would be used to store the thousands of routine emails sent every day, and would get backed up).

For example, Rove and Scooter and pals might have their own POP3 server (does not store anything) and just download everything to their PCs. They would deliberately not back these up. And when something like Plamegate broke, those hard disks would be destroyed and replaced with shiny new ones. Anyone asking for the emails would be told the disks crashed and are gone forever. An email between Rove and Scooter would mean that there were two disks to be destroyed. And if the disks are still around, all they do is claim that they are gone.

It really doesn't even get into a data recovery situation at all.

If I were up to no good, this is probably how I would do it. I really doubt that any rules and regulations regarding information preservation are being followed by this bunch.

[Mr Rabble]

53. I would imagine that there is protocol for this.

I am just guessing here, but I seem to remember that during the Clinton witch hunt there was a complete revamp of the rules regarding data storage. I think there was quite the dust up over email deletion which led to substantial investigations into 'lost' emails, although I don't remember how this turned out. I am going to look into this today. If anyone has any info about this please PM me.

In fact, I cant imagine that there would be anything less than multiple layers of redundancy with regards to WH email. Anything less would be criminal. And if this administration has changed the rules regarding email handling there would certainly be a paper trail for that as well.

[GOPS Worst Fear]

51. My Suggestion: Get A External Hard Drive.Better Yet get 2.

One that can be removed at a moments notice. IF you have any subject material that you think could be used against you..spun against agianst you, in a court of law, keep that one of the external hard drive.When your not using that Hard drive switch it out with the other Hard drive. Put the other one in a safe haven where only you can find.

[Wordie]

54. Maybe Fitz ought to ask the NSA to help out...

for "national security" reasons, of course.

If there are records of all our emails and other communications floating around someplace in the cyber-ether, then cerainly somebody ought to be able to retrieve the WH ones. Turnabout's fair play, guys.