January 21, 2002 (Computerworld) -- E-mails are messy entities, leaving little bits of themselves all over the network. That's why the attempts of employees in the Houston office of Arthur Andersen LLC to delete e-mails related to failed commodities exchange Enron were futile,
"It is impossible that [congressional investigators] cannot find data on those hard drives. There are too many computers involved," said Michael Sanders, a computer forensics expert who specializes in e-mail recovery at New Technologies Inc. in Gresham, Ore. "[They] will find enough information to make a story."
As e-mail travels through the network, it leaves bits, and sometimes entire copies of itself, that aren't affected when the Delete button is hit. And that doesn't even take into account the e-mail remnants left on users' hard drives or the periodic backups made of the server contents.
According to published reports, Andersen acknowledges that in October and November, its employees deleted e-mails related to their work as accountants and auditors for Enron.
While e-mail servers and applications vary in how they move and store electronic messages, all of them hoard information on hard drives in the same way if they're running on Windows-based PCs, Sanders said. He added that Lotus Notes is a particularly easy program from which to recover deleted messages.
Arthur Andersen uses e-mail software and servers from IBM's Cambridge, Mass.-based Lotus Software Group subsidiary, according to Lotus CEO Al Zollar. At a conference last spring, he discussed the possibility that Lotus might lose Andersen as a client.
Lotus declined an offer to comment for this story. Representatives for the other companies didn't return calls.
According to John Korsak, product manager for Lexington, Mass.-based Ipswitch Inc.'s IMail Server, a few firewalls are even configured to log information about e-mail passing in and out. For POP3 e-mail, the message spools to a temporary file on the e-mail server while it's being accepted. Though it may stay there for only a millisecond, Sanders said, a message can get stuck in spools, bouncing around from directory to directory.
Enron was using Ipswitch's IMail server, according to a list of technology assets sold to UBS Warburg, the investment banking arm of Swiss bank UBS AG, as part of Enron's bankruptcy proceedings.
Sendmail, a freeware application that is the most common mail transfer agent (MTA), also records a log of all the header information for each e-mail that passes through a server. Once the MTA assigns the message to a directory on a server, it may be backed up to a storage tape. After a user downloads the message from the server, it sits in the in-box view until it's deleted. From there, it goes to the deleted files view, and if deleted from there, it is simply removed from the user's display. But the message is still in the application and remains there until it's marked as free space by a process known as compression, or archiving in Notes. The message remains until the application overwrites it with a new message, which could take weeks or months.
Even then, it will still remain, in part or in whole, on the hard drive in what are known as swap files. If an end user copied the e-mail to removable media, like a floppy disk, the registry would have a record of that activity.
And with Web-based e-mail, the messages would be in the temporary files, even if deleted, until that space is overwritten.
If nowhere else, the data is almost certainly on the hard drive, Sanders said. "As an administrator, that would be the first place I'd look," he added.
Read accompanying story:
 |
The E-mail Trail
The typical life cycle of e-mail:
|
|

|
|
|
|
Mistakes such as putting down co-workers or burning bridges when you resign are surefire ways to darken your career prospects. Here's how to avoid them
Hype and promises abound in the IT world, but these six breakthroughs really will change your life, says author and former IT manager John Brandon.
Baby boomers are retiring and taking their knowledge with them. Why do so few in IT seem to care?
Computerworld editors share stories of their first PCs, including some classics and some real clunkers -- then we ask readers to share their early-PC tales.
Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS.
Four years from now, the IT field will be a vastly different place. Will you be ready?
|
 |
|
Critical Considerations for Data De-duplication
Critical Considerations for Data De-duplication
Register for this live webcast, airing May 22nd at 2pm ET!
Go to the webcast
|
|
|
Solving Real World Storage Problems
Download this whitepaper now.
As your storage needs grow, the cost of managing it need not spiral out of control.
Our vision - Universal Distributed Storage - is about:
- mainstreaming high endstorage functionality
- solutions built on industrystandard hardware
- a broad partner ecosystem
Our next generation of Server and NAS products - Windows Server 2003 R2 and Windows Storage Server 2003 R2 - will help you further reduce your storage costs.
Download this executive briefing
|
|
|
Managing B2B Web Channels For Success
Download this survey results white paper for free, compliments of Tealeaf.
(Source: Tealeaf) In March 2008, Computerworld invited Web site visitors to participate in a survey regarding their organizations' use of the Web. Specifically, the goal of the survey was to better understand organizations' goals and priorities
for their B2B Web channels in 2008. The survey was commissioned by Tealeaf, but data was gathered
and tabulated independently by Computerworld Research. The following report represents top-line results of the survey conducted among 250 respondents at organizations that leverage the Web for B2B commerce or self-service.
Download this white paper
|
|
|
White Papers
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
|
View more whitepapers
|
|
|