Now, without considering the “forensic” approach, which I would consider extreme unless it was a legal/criminal situation, recovering mail can be tricky. The vast majority of mail is exchanged (spam not included) during normal business hours which is not conducive to capturing email on a regularly scheduled backup.

I’m not sure about Exchange and its archiving capacity, but in general I would argue that if you receive a message between the hours of 7am and 7pm that it didn’t sit on the mail server long enough to get backed up.

All that said, I hope they nail these war criminals to the wall once and for all and I don’t give a flyin’ leap if it takes a jaywalking offense to get the ball rolling.

Peace Bob. Hope the weather in Hawaii is better than it is here i Sounthern NH, where we are bracing for floods on the heels of this Nor’easter. Ugh.

Hi Bob,

Good analogy. So do you agree with the explanation that the bits that remain on the disk after files are “deleted” will only remain there until/if those blocks are re-used?

Basically– but some of the IT specialists here note that the magnetic media are not always perfect: change a 0 to a 1 and it changes– mostly. But every single atom may not flip the same way. The “bit” may “flip” from 0 to 1, but a ghost of that 0 may be left behind. Or so I’m told. I don’t have any special knowledge about that.

Bob in HI

Good analogy. So do you agree with the explanation that the bits that remain on the disk after files are “deleted” will only remain there until/if those blocks are re-used?

RickG @ 215

IMO computer forensics are overrated. … where does one begin? Try finding someone in a worldwide company of 50,000 people. Then take that public through ISPs, spam robots etc etc. How much email is spam? …

I don’t mean to push back on a subject I probably know much less about than yourself, RickG, but I would like to pose a couple of quick counter-questions:

How much time does it take to locate a particular term or phrase on the entire Internet, using Google?

and

How many acres of highly networked SuperCPUs and TeraMungous disk farms does NSA have?

I don’t know if this thread is still alive, but I look at it like this: When you “delete” files, think of a bookshelf where you delete a book by removing the binding, and snipping off the page number. All the pages are there, but they’re no longer held together, and their order is not self-evident.

Throw these pages in the wastepaper basket, and “delete” another book in the same manner. After you’ve done this for a bunch of books, dump the wastepaper basket in the trash bin.

Enter booklover, who has heard that the only copy of a certain rare volume has been “deleted” in this manner. S/He is told where the trash bin is, and told “good luck.” S/He knows that all the pages are in there somewhere, although some may be spoiled, so his/her task is to separate out all the pages, arrange them by book, and within book piles arrange the pages into order.

It can be done, but it takes a lot of work.

Bob in HI

Christy, your very credibility as a journalist depends on your correctness with the English language. Imus aside, simple useage and spelling are indicators of thoughtfulness, capability, completeness, competence, etc. So, spell check and preserve your credibility. ‘Separate’ has a RAT in the middle.

Testing…

…and usage has no “e”. People in glass houses….

eyesonthestreet @ 99

Mods:
what is the maximum number of comments per post?

Seems like its around 180, would like to know, thanks.

I once was posted the 400th in a thread

Last night I was in over 500. Maybe we’re gonna need a late late night thread about two hours after the Late Night FDL by someone on the Left Coast.

Bob in HI