{"id":10494,"date":"2007-04-12T14:59:33","date_gmt":"2007-04-12T18:59:33","guid":{"rendered":"http:\/\/www.thecarpetbaggerreport.com\/archives\/10494.html"},"modified":"2007-04-12T14:59:33","modified_gmt":"2007-04-12T18:59:33","slug":"gone-but-not-forgotten","status":"publish","type":"post","link":"https:\/\/stevebenen.com\/thecarpetbaggerreport\/gone-but-not-forgotten\/","title":{"rendered":"Gone, but not forgotten"},"content":{"rendered":"

It’s one thing for White House staffers to break the law preserving documents; it’s another to have to admit it publicly; but it’s something altogether different when those emails come back from the dead<\/a>.<\/p>\n

“[D]eleted” doesn’t mean what it used to, according to computer forensic experts. Indeed, deleted emails and files, even years-old ones, are recovered all the time.<\/p>\n

“We do it every day of the week,” said Beryl Howell of Stroz Freidburg LLC, a Washington, D.C.-based firm that specializes in recovering lost data for businesses complying with court orders, criminal investigators and others.<\/p>\n

Companies turn to Howell’s firm when they “have a duty to preserve certain emails,” not unlike the White House in this scenario. “Companies are sanctioned when they do not preserve electronic data,” even if it means putting technicians to work extracting bits and bytes of “deleted” data that has not yet disappeared from hard drives.<\/p><\/blockquote>\n

“They look at their backup systems and backup tapes,” Howell said, adding that “with any electronic storage media, you can do forensic recovery and find deleted data.”<\/p>\n

Computer forensics expert Rob Lee added that that “the only way someone could claim something has been destroyed is if the emails themselves have been wiped” from a hard drive or tape backup, he said, “overwriting every piece of data.” That requires special software designed explicitly to cover any trace of deleted information.<\/p>\n

And if that’s what happened here, wouldn’t that be a tad suspicious?
\n
\nA few related thoughts…<\/p>\n

Talk Left has a helpful suggestion<\/a>: “Congress should issue a forthwith subpoena duces tecum for the server itself.” Why not?<\/p>\n

I’d also be interested in knowing the date<\/i> some of these deletions occurred. If, for example, emails on the RNC’s server started getting purged after administration officials were instructed to preserve documents, wouldn’t that almost certainly constitute an obstruction of justice charge?<\/p>\n

Moreover, the press corps seemed “inquisitive” about the missing emails during the White House press gaggle this morning. Paul Kiel explained<\/a> that there was a policy change on staffer’s RNC emails in 2004. During the first few years of Bush’s first term, the RNC would purge emails after 30 days. After 2004, the RNC wasn’t responsible for deleting emails; the White House staffers were. In order to do this, the WH aide would have to delete the email twice — once from the inbox and again from the trash folder. A reporter asked if that meant that staffers made two affirmative decisions to delete certain emails. Spokesman Scott Stanzel responded:<\/p>\n

Since 2004, the RNC has had a policy of excluding White House staff from their automatic deletion policy, which means that the RNC every 30 days has automatic deletion policy. Since 2004, it’s our understanding, that White House staff who have political email accounts provided by the RNC have been excluded from that policy. And in terms of the double delete, what you’re talking about is the user’s ability, if they are sitting at their laptop, and decide that, ‘gosh, I’ve got a hundred emails here that I just — are cluttering up my inbox, I want to put them in the deleted file, and I right-click the deleted items to empty my deleted file.’ It’s possible, possible, that those records could have been lost….<\/p><\/blockquote>\n

Reading the transcript, you can almost hear Stanzel sweating….<\/p>\n","protected":false},"excerpt":{"rendered":"

It’s one thing for White House staffers to break the law preserving documents; it’s another to have to admit it publicly; but it’s something altogether different when those emails come back from the dead. “[D]eleted” doesn’t mean what it used to, according to computer forensic experts. Indeed, deleted emails and files, even years-old ones, are […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[617],"tags":[],"class_list":["post-10494","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/stevebenen.com\/thecarpetbaggerreport\/wp-json\/wp\/v2\/posts\/10494","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stevebenen.com\/thecarpetbaggerreport\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/stevebenen.com\/thecarpetbaggerreport\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/stevebenen.com\/thecarpetbaggerreport\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/stevebenen.com\/thecarpetbaggerreport\/wp-json\/wp\/v2\/comments?post=10494"}],"version-history":[{"count":0,"href":"https:\/\/stevebenen.com\/thecarpetbaggerreport\/wp-json\/wp\/v2\/posts\/10494\/revisions"}],"wp:attachment":[{"href":"https:\/\/stevebenen.com\/thecarpetbaggerreport\/wp-json\/wp\/v2\/media?parent=10494"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/stevebenen.com\/thecarpetbaggerreport\/wp-json\/wp\/v2\/categories?post=10494"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/stevebenen.com\/thecarpetbaggerreport\/wp-json\/wp\/v2\/tags?post=10494"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}