Forensic Data Expert: Deleted E-mails Aren’t Really Gone

Deleting an e-mail doesn’t always mean it’s gone forever.

“They’re not necessarily deleted,” said data forensics expert and Medford Police Det. Lawrence James.

James explained the process to WBUR in light of the recent controversy at City Hall. The state gave Boston city officials 10 days to find hundreds of e-mails allegedly deleted by a top aide to Mayor Thomas Menino.

(Andrew Phelps/WBUR)

The head of the secretary of state’s public records division, Alan N. Cote, wrote to Menino saying he believed e-mail correspondence had been “improperly deleted.” Secretary of State William Galvin said the deletion of e-mails is a violation of state public records law, which requires municipal employees to save messages for two years.

State officials ordered the city hire an independent computer forensics expert to track down those messages. The possibilities of recovering the e-mails are high, but the process includes many hours of work.

James said computer operating systems mark files for deletion but do not immediately wipe them off the hard drive.

“What (operating systems) do is, they tend to remove the information that allows the operating system to find the data. And then it assigns it to an area of the hard drive that is waiting to be reused by the operating system,” he said.

There is a chance the area of the hard drive where the e-mails were saved has been overwritten with new data. But if the information can be retrieved and reconstructed, James said, it would be acceptable as evidence in court — if that’s where the case ends up.

The examination of a single hard drive can take from 20 to 80 hours, James said, based on the complexity of the exam. The city’s expert will also be able to tell how the e-mails were deleted.

James explained how it might have happened.

“There are many possibilities … The e-mail server was improperly configured, it was purposely misconfigured to allow the user to delete them, or that some of the archive utilities were not running properly at that point in time,” James said.

City Councilors Sam Yoon and Michael Flaherty and South End contractor Kevin McCrea — the candidates to replace Menino in the upcoming mayoral race — say the e-mail deletions were calculated. Menino insists he has “corrected the situation.”

Martha Coakley, the state’s attorney general, said her office won’t get involved because it’s a political matter in the middle of an election.

WBUR intern Luciana Almeida compiled this report.

Related Links

• Menino on defensive in deleted e-mail controversy

• WBUR Topics: The Missing E-Mails