Deleting Information On A Computer - Don't Bet On It
Posted by Joe Cordes on Fri, Jun 17, 2011 @ 10:10 PM
In light of the recent plight of Congressman Anthony Weiner, I once again feel abliged to assist my fellow middle-aged citizens, by providing some sound advise when it comes to technology. Before using any relatively new technology (smartphones, text messaging, Twitter) or not so new technology (like personal computers and email) please understand that errors in judgement, (and otherwise) made using any of these technologies are unforgiving to the uniformed. Please make sure that you really want to send that email, text, tweet, before you press send. Maybe you ought to think about it some more? Maybe sleep on it? Once it's out there, its out there.
Computer Forensic Techs make a good living by recovering a variety of data that people believe that they have deleted, from computers, servers, smart phones and other "memory" devices . Email is one of the easiest items to revover and in most cases deleted emails can be recovered, even if you believe that they no longer exist on your computer. Deleted emails are routinely recovered by computer forensic experts from a variety of email clients (Outlook, Entourage, Thunderbird, etc.).
When emails are deleted from your Inbox there is still a chance that they reside on the server or in other areas of a computer. Computer forensic tools and methods allow for the data extraction and examination of email storage including information that had been previously deleted. In the simplestist of terms, there really isn't a delete button on your keyboard. Yes of course the button is there, but it never really deletes anything and once you send an email, don't expect that you can pull it back.
Same thing for other files that you think you deleted from your computer or server, like Word documents and photographs and audio files, pretty much anything. When a file is deleted using standard methods, the contents of the file are not actually erased from the hard drive; the operating system merely erases a pointer to the file so that the file does not appear in the folders or directories, the file is actually still there, you just can't see it. Contrary to popular belief, digital files are not vaporized when the delete button is pushed, and therefore, such files are usually recoverable and usable by a properly trained and skilled Computer Forensic Tech.
Senate hearings into the 2008 financial crisis disclosed that LLoyd Blankfein and some other top level executives at Goldman Sachs, sometimes used the acronym LDL in their internal emails. LDL stands for “Let’s Discuss Live" and was used as a kind of shorthand for “Let’s not put this in an e-mail.”
I think there is something valuable for us all to learn from Mr. Blankfein and his associates. Not everything needs to be memorialized in an email, or posted on facebook, or tweeted, or texted. Sometimes you just need to speak with people face to face.
Learn more - Computer Forensics Frequently Asked Questions.
Joe Cordes is the VP of Investigations at MSA Investigations.