AKIBIA'S PRACTICAL GUIDE TO ENTERPRISE TECHNOLOGY
Wednesday, September 16, 2009
Boston’s Missing Email Case Has Many People Asking Questions about Digital Forensics
On September 14, Massachusetts Secretary of State William Galvin ordered the city of Boston to seize computers and software used by Mayor Menino’s aide, Michael J. Kineavy. Under question is whether Kineavy may have violated state law by deleting emails. According to the news articles, Kineavy deleted emails from his inbox and trash folder every day, possibly before the city’s systems made a backup. Alan N. Cote, head of the public records division in Galvin’s office, ordered the city to hire “a qualified independent and competent technology expert to employ all reasonable means of recovering and restoring the missing records”.
The job of a digital forensics investigator will be to recover the deleted emails and possibly to report whether it was likely that they were intended to be deleted permanently or whether it was expected that they would remain available on central servers or backup media.
As the case is well covered in the local Boston media, many people have asked me “What’s the process behind this type of digital forensics investigation?” And, some people have even asked “So they can really recover those emails I’ve deleted????”
There are several steps to the process of recovering deleted emails:
- Identify systems which are in scope for the investigation. In a typical email client server environment, this includes the desktop and laptop systems containing an email client used by Kineavy to access the city’s mail server, the mail server itself, and backup devices.
- Create a forensically sound copy of the in-scope system hard drives and other media. A “forensically sound” copy is one that is made without altering the original and that can be verified to be an exact and true copy of the original. Specialty forensic hardware and software is available to ensure that the original media is not altered. A “hash”, or unique identification number, is generated for both the original and the copy. If the hash is the same, then the original and the copy are the same.
- Most investigators will make an additional copy, so that an archive copy which will not be changed is available. Then the investigator is free to use the working copy for examination, or even to create a copy of a working desktop, laptop, or server.
- Examine the working image file.
The final step is usually of the most interest to investigators and the customer. During this step, deleted material can possibly be viewed or recovered, evidence of misuse of systems can be discovered, even user credentials (passwords) can be discovered.
In this case, the location of missing emails depends on the operating systems and email systems in use. Generally, we might find the missing emails in local email storage files on the desktop and laptop machines, email storage files on the mail server, deleted file areas on all in-scope systems. The investigator will perform multiple searches for data which might turn up in unexpected places on the systems. Often, even though an email has been deleted, its content still exists in local storage files. In that case, it is easy to retrieve the email. The contents of deleted files also often exist on hard drives, and until those deleted file areas are overwritten with new data, or deliberately “wiped” (overwritten with random data), the information is available for retrieval. Finally, individuals or software systems might write data to other areas on a system for various reasons, allowing the data to be discovered there.
It might also be possible to determine whether the emails were deleted with the intention of destroying evidence. A regular pattern of email deletion with no additional measure taken to hide residual information or to hide the act of deleting emails would not be indicative of deliberate destruction of evidence. However, deleting specific emails or emails of specific time periods, actively overwriting unused disk space, encrypting data with unauthorized products, and similar proactive measures are an indication that an individual is hiding or destroying evidence.
One of the dilemmas faced by digital forensic consultants as well as customers is that it is difficult to predict the level of effort required to obtain the desired results. In this particular case, it should be relatively easy to recover recent emails (within the last month for example), but to recover emails from years in the past would require a great amount of effort, if they can be recovered at all. The stakes will determine the amount of effort spent on such an endeavor. Given the upcoming mayoral election and the public interest in this case, it seems likely that effort will be spent on recovering as much information as possible.
The answer is yes, my friend, they can recover your deleted emails.
