Reply #8: Computerworld -- When an e-mail is deleted, does it really go away?

[L. Coyote]

For missing White House e-mails, experts offer retrieval tips
Deleted e-mails can sometimes leave behind data debris
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyId=19&articleId=9016599&intsrc=hm_topic


April 13, 2007 (Computerworld) -- When an e-mail is deleted, does it really go away?

That's one of the central questions facing congressional investigators who want to know what happened to e-mails sent by White House staffers using unofficial e-mail accounts run by the Republican National Committee.

White House officials said yesterday that many of the e-mails may have been deleted. Experts said today that may not be exactly true.

Whether it's the congressional inquiry into deleted e-mails among White House officials or similar probes of companies entangled legal troubles, there are a host of tools and techniques that can be used to recover and analyze the data left behind.

These computer forensics tools have helped to uncover and restore long trails of information-filled e-mails in corporate scandals, from the demise of Enron Corp. to the pretexting debacle that hit Hewlett-Packard Co. last year. No matter where the information is stored -- or whether it was created by individuals, government agencies or corporate employees -- the methods used to try to recover data are similar.

Mark Menz, a Sacramento, Calif.-based computer forensics expert, said investigators start with the obvious by looking for deleted e-mails on data center backup tapes. The next steps depend on what e-mail system is being used, he said, whether it is Microsoft Exchange and Outlook, Lotus Notes and Domino, Web-based e-mail systems such as those offered by Yahoo, Microsoft or Google or some other messaging system.

...........more.........