Thursday, April 12, 2007

Sen. Patrick Leahy says emails cannot be erased

I read an interesting article today where Sen. Patrick Leahy of Vermont (Democrat) states that e-mails cannot be erased.

His statement is as follows:

"You can't erase e-mails, not today," said Sen. Patrick Leahy, D-Vermont. "They've gone through too many servers. They can't say they've been lost. That's like saying, 'The dog ate my homework.' "

His critical comments are aimed towards the White House, who said they've lost some e-mails and are doing their best to recover it. Now borrowing from the senator's own words, can electronic dogs really eat electronic homework? Can e-mails actually be deleted? The short answer? Yes.

The long answer?

  • First let's correct Senator Leahy that it goes through "too many servers". The packets are transmitted through a variety of routers and switches on Internet backbones, but in the end, only two servers communicate to transmit the e-mail: the sender and receiver. [smtp]
  • The e-mail is then processed and stored, which can then be downloaded by email software, usually via pop3 or imapd. This all happens in a few seconds (assuming the 'average size' email).
  • The assumption made here by the senator is that the sender or receiver servers somehow contain or retain the e-mail indefinitely. The answer is no. The moment the user "purges" the email from his account, it does get deleted.

    • There are backup servers that may be involved in which case e-mails are not deleted and can 'easily' be recovered. This is unlikely since the White House publicly claims its been deleted. Their first attempt would to first recover it from backups versus come out embarrassingly that their emails are deleted.

  • Usually, there's copies of e-mails on the email software (ie: Microsoft Outlook's Sent Items or Outlook's Deleted Items folder). However, these folders may be purged automatically depending on the settings.
  • Any computer forensic experts knows that deleted data isn't actually deleted until the data 'space' is re-used again. Hence, if you delete a file you can still recover it for a certain amount of time since the space has not been taken up yet.

    • Imagine a bowl of cereal that you consider old and in your mind you're no longer going to eat it. You're too lazy to clean the bowl so you're just going to wait until you get new cereal before you empty that bowl. Technically, the 'old cereal' is deleted from your choice of foods but it is still there until you replace it with new cereal.
    • In the same way, files still exist on the computer until new files go on top of it.
    • If the data is too old and it's been replaced over and over again, the likelihood of recovering anything is minimal.

  • There's also crashes and data corruption. Your hard drive crashes, the mail server mail spools are corrupted, the server fails, backup disks get 'fried', etc. There are a number of ways data gets lost. No matter how rich you are, no matter how much money you've invested in a computer, there's still a likelihood that it could crash some day. That's life!

In summary, yes, you can lose your e-mail. In this case, the electronic dog can eat your electronic homework.

No comments: