Thursday, April 12, 2007

"The dog ate my email..."

That's right.

If you have not been following the news from the hellmouth of scandal that is Shrub's Administration in Washington, here's the latest: Some of the documents being sought by the good guys investigating the US Attorneys firings are emails sent by the various evildoers. One problem: email is one of the items covered by the Presidential Records Act; the documents belong to the American People because they are created and sent on behalf of the citizens of 'murika by their erstwhile public servants.

You with me so far? There's more. It seems that certain members of the Bush Crime Family have been sending email from their White House computers with email accounts on servers and Internet domains owned not by you or me, but by the Republican Party. That's right, guvmint bidness (bless you, Molly Ivins, for those words!) done through the innernet on servers controlled by political hacks. Obviously, emails sent through Karl Rove's prince.of.darkness@republicanscumbuckets.com address are not going to be covered by the requirements of the Presidential Records Act for archiving.

And guess what? When the good guys (a.k.a. the House Committee on Government Oversight, chaired by Rep. Harry Waxman (D-CA)) subpoenaed the servers and the contents of the mail accounts, it appears that some of the crucial contents were deleted.

This is utter bullshit. Time to don my tech hat:

Unlike the homework fed to Rover, email is fairly easy to recover so long as the server's hard drive has not been secure-deleted by writing data to every disk sector. When Joe Typical Windows User "deletes" an email in Outbreak Excess, Incredifail, Thunderturd or Eewdora (or any file in Windows Exploder!) the email or file is not wiped from the hard disk. As a general rule, most "deletions "are little more than the program deallocating or losing referance data that shows where the email is. The actual data is still there, it's just unallocated. The space may soon be overwritten as storage is allocated by the operating system . . . but by and large, files can almost always be recovered unless the entire drive is overwritten, aka, secure delete.

Also: what about BACKUPS? Guys, any admin worth his credentials will have a backup plan and have made backups.

Third: Email is transferred from server to server when it is sent via a protocol called SMTP. An illustration of how it really works. I'm using Mac OS X Mail over a connection to ATT aDSL to send a email to my brother who is connected via an EarthLink dialup connection and accessing his EarthLink email address. My email travels from my computer to AT&T's outgoing mail server . . . and AT&T's server may relay the email to one of several other servers who may relay it one or more times until it hits EarthLink and winds up alongside his spam for cheap meds from Canada. Mail is relayed. Copies of these emails may exist on any of these relays.

Fourth: One word: Carnivore. Email, the Other White Meat.

The words of the day are "Infotech Forensics."

0 comments: