DU Geeks: is it possible to scrub traces of emails from an RNC server?

[npincus]

I don't doubt some serious overtime has already been put in at the RNC to scrub damaging emails from their server(s). If this has been done, is there a way to recover these emails? Are they ever truly gone?

Signed,

DU Techno-Boob

[meegbear]

1. Yeah ...

but I'm not gonna give them any ideas, thank you.

[EnviroBat]

2. Yes, most definately...

The problem is that they may scrub the drives, but can they account for the multiple copies of e-mail on other drives, on other servers and local machines? This takes considerable doing.

[gaspee]

3. Yup

It's easy to erase traces of e-mail off of a server... if you know what you're doing. Even using a linux server, a simple erasing of the file won't do it, but they have access to the best scrubbing software around.

Question is, can they scrub the receiving servers and every point they may have been forwarded to. My guess is yes. But these people see to be as inept at covering their tracks as they are at governing.

Hubris is my guess but they might be trying to get all their little duckies in a row now.

[Richard Steele]

7. Their basic incompetence may work in our favor this time.

Quote, "these people seem to be as inept at
covering their tracks as they are at governing."

And, from what we know of them, odds are that whoever
is in charge of the RNC's servers didn't get the job
because they are competent, they got it because they
"knew somebody".

There's every reason to believe that someone who would
be foolishly arrogant enough to do this in the first place
just might be too foolishly incompetent to cover it up.

As we've seen time and again, the Repubs "qualifications"
are just generally a framework of lies covered with hubris
and swagger. When they actually encounter a real CRISIS,
they tend to stand around blinking helplessly, surprised
that their "spin" isn't fixing things.

[gaspee]

14. they remind me of one of my sisters

When we were kids, she was a huge bully.

Her main tactic was doing stuff to get the rest of us in trouble. We all knew she did it, but her tactic- and it usually worked- was to stand her ground and say "prove it." She usually got away with it.

And these days, she runs a major collection agency. What a surprise, eh?

[murielm99]

15. More parallels to Watergate.

They had foolish incompetents and bunglers trying to do cover-ups, too.

There was the break-in at the Watergate, and at Ellsworth's psychiatrist's office. The whole plumbers idea was ludicrous and incompetent.

Just wait. We may yet see the same kind of foolishness exposed in the * administration. Actually, it seems inevitable, and sort of ironic. They expose a real spy, and bungle their own attempts at spying.

[William769]

17. What about the ISP'S server?

[Solo_in_MD]

23. No ISP involved, it is a leased server

[Solo_in_MD]

25. The server ops show no sign of incompetence

this all started with a single misplaced .sig by a user.

Its never a good thing to underestimate an opponent

[Little Wing]

4. Shouldn't be any problem from the NSA wiretap archives to pick up, right?

[hootinholler]

8. Beat me to it :D

:rofl: That would be too sweet.

Petards, etc.

-Hoot

[merh]

16. Ding, ding, ding!!!

Right answer!!!

[Donnachaidh]

5. wouldn't that violate the Patriot Act or any of the other BOGUS laws

put in place by der Chimpenfuhrer?

[Robbien]

10. Those laws only apply to non-GOPers

All the attornies are loyal bushies or are canned.

[Nederland]

6. Practically impossible.

Yes, you can erase it off the RNC server, but a dozen other copies probably exist on a dozen other places: backup tapes, other email servers, repeaters, etc. Even if you track all those down and erase those, traces still exist on the hard drives of those machines. The only real way to get rid of an email is to physically destroy every hard drive the email ever lived on. Not an easy task and one that is practically impossible to hide.

Email is forever for all intents and purposes.

[wtmusic]

13. And for all intents and purposes

so are posts on DU. Good thing to keep in mind.

[JoDog]

18. would there be

any proof of the scrubbing? I mean, would it be obvious that a scrub job had been done if an IT expert if they looked at the server?

[Solo_in_MD]

26. Your response is prima facie false

[C_U_L8R]

9. Nearly impossible to scrub em all

with every reply and cc, the email evidence spread onto yet more servers.
And it will be darned difficult for them to scrub every disk and backup tape .. at least without evidence.
And hey.. if all else fails.. the NSA is supposed to have scooped every email ever created.
Subpoena them.. hahahaha

[Marr]

12. God, I'd love it if the evidence were retrieved from NSA archives.

That'd be classic tragedy.

[Ganja Ninja]

11. They can scrub all they want to but they can't scrub away the

e-mails on the computers the e-mails were sent to. The stain of corruption is going to be hard to scrub out.

[in_cog_ni_to]

19. I thought any scrub could be reversed? There's always an IMPRINT left on the hard drive?

I know I read that here on DU. I'll see if I can find the thread.

[EnviroBat]

27. Nope, there is no physical "imprint" per se

What they have to do, or any of us for that matter is to use a program which overwrites all files on the hard drive with zeros. The problem is that overwriting the hard drive only one time with these zeros is not enough. Computer forensics can still retrieve the "deleted" files because there remains enough of the original file left for the recovery program to "fill in the blanks" if you will. A over-write program, or "scrubber" must be run at least 7 times, and ofter 9 or more times to be totally effective.

[progdonkey]

29. there's nothing like an imprint on a HD...

A hard drive isn't like a CD or DVD where there are etches or grooves in the disc that are then read, but rather a smooth platter with little bits of metal arranged in patterns that are then read magnetically. It's the same principal as a video cassette, only instead of flimsy tape that gets stretched and warped very easily over time (and has very little, if any protection from outside magnetic interference), the information is on much sturdier plates which can handle more reads over-writes.

You may be getting confused with the issue that simply deleting something doesn't actually erase that information from the hard drive but simply just tells the OS to ignore that information and allow it to be written over if necessary (which is in fact how you would actually go about "erasing" the information: you write it over with new information). Going back to the cassette analogy, deleting something in the OS is like putting a piece of tape over that little square hole on the cassette: you're telling the VCR that's playing it that it is free to record over everything on the tape, but until you actually do record something new onto the tape, the old information is still there, and will remain there until it's written over.

[rec_report]

20. LOL! That brush is adorable for this post -and, good question! n/t

[leftofthedial]

21. yes

but one might leave trace evidence of having scrubbed the computer

[IllLib]

22. kinda

Reformat with secure erase (which writes zeros to the drive). DOD is supposed to do this to all drives before they are retired.

This is just for the machines and drives you can get admin access to.

So yes, you can remove traces from any computer, but can you do it for all the computers that have cached a copy of that email? After all, you usually do not compute in a vacuum, you did write it and send the message to someone, yes?

What about the backups to the computers, especially the servers? Minimum, once a day for a week, save the weekly, recycle the dailies. Once a week for a month,save the monthly, recycle the weeklies. Once a month for a year, save all twelve months. Lots of backups to erase, data to lose.


Murielm99:
Why? Are the county democrats really really hot? :)

[Solo_in_MD]

24. Trivial and its not illegal

provided it was always operating that way

[jmowreader]

28. It's very simple actually

You buy a new hard drive (or, more precisely, a new SET of them), dump the old HD to tape, install the new drive, reload everything EXCEPT the gwb43.com domain, then burn all your backup tapes and the hard drives themselves.

Next, tell everyone who had gwb43.com e-mail addresses to get new computers and to destroy their old ones.

'Course, you look guilty as hell if you do this.