-
Apr 3, 2008 11:40 pm US/Central
-
Digg |
Facebook |
E-mail
|
Print
Good Question: Is Deleted E-Mail Really Gone?
(WCCO)
In the rape trial of a former University of Minnesota football player, a key piece of evidence is something a cell phone owner thought he had deleted: a video, which was later recovered by federal investigators.
Erin Paulson, of Winona, Minn., wondered, "Where do deleted e-mails go?"
"To you, it looks like it's gone into the deleted items bin and it's gone forever. In reality the e-mail still sits there," said Dave Schultz, manager of Legal Technologies Consulting at Kroll Ontrack, an Eden Prairie firm that has carved out a niche as one of the largest computer forensics firms in the world.
Kroll Ontrack digs into computers to find data that was either intentionally deleted or accidentally lost, often for use in court cases.
"The prosecutors and lawyers have realized that there's a gold mine when it comes to electronic media," said Schultz.
He said, when you click "delete" and then empty your deleted items, you're not actually eradicating the item. "You're actually changing the entry for that file on the file allocation table, and that's basically like a table of contents in a book," he explained.
That change makes the computer software think the file is gone. But in reality, the file is sitting in another sector of your hard drive, waiting. The file can either be scrubbed away by a special computer program, or over-written by new data when the drive fills up. But that could take years.
"Most people use Microsoft Outlook. That stuff's pretty easy to get back for quite a period of time," said Schultz.
When it comes to cell phone videos and text messages, that's an emerging area for computer forensic engineers.
"Cell phones are kind of the Wild West," said Schultz, but he added staff members are working to find new ways to recover that data, because it's key to so many different lawsuits.
As far as recovering files or e-mails off of computers, according to Schultz, "it's not very difficult if you have the right technology and the right expertise."
Kroll Ontrack has been in business in Eden Prairie since 1985, and it uses two commercially available forensics programs to uncover data, along with another tool the company developed to fill in the gaps.
"There are tools that are designed to go below the operating system, kind of at the zeros and ones level if you will, to look for files that are deleted," said Schultz. His advice is simple: "If you don't want to see it on the front page of the newspaper, then you shouldn't put it in your e-mail."
(© MMVIII, CBS Broadcasting Inc. All Rights Reserved.)