CSO

Recently, the prosecutor in the CIA leak probe dropped a grand jury subpoena on the White House for all the relevant e-mail. Great idea but even though White House computer technicians apparently looked everywhere an entire week's worth of e-mail from Cheney's office was missing. The week was Sept. 30, 2003, to Oct. 6, 2003, the opening days of the Justice Department's probe into whether anyone at the White House leaked the identity of CIA operative Valerie Plame.

So what are some steps to take to recover deleted email? Generally deleted email, even though it was empted from the recycle bin, can be recovered. Common email programs, such as outlook, hold on to email that has been deleted. It takes a forensics tool to find it - but it’s usually there. It can be recovered from the user’s hard drive, servers, back tapes and other sources such as blackberries. A fact that seems to be frequently forgotten in these types of investigations is email spreads like a virus. It may be gone in one person’s mailbox but still exist in another’s.

Steps to take if important email, while invisible to most, may still exist? Forensically image the hard drive, maintain backup tapes, and extract deleted email that was retained on the server. Look for thumb drives, blackberries, CD’s or other devices that email might be stored on and image them as well. If all else fails, the fact that the email is gone may be more telling then whatever would have been uncovered.