For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Enron Bankruptcy Case Highlights E-Mail's Lasting Trail
or
Other Computerworld Stories
|
|
|
|
January 21, 2002 (Computerworld) -- E-mails are messy entities, leaving little bits of themselves all over the network. That's why the attempts of employees in the Houston office of Arthur Andersen LLC to delete e-mails related to failed commodities exchange Enron were futile,
"It is impossible that [congressional investigators] cannot find data on those hard drives. There are too many computers involved," said Michael Sanders, a computer forensics expert who specializes in e-mail recovery at New Technologies Inc. in Gresham, Ore. "[They] will find enough information to make a story."
As e-mail travels through the network, it leaves bits, and sometimes entire copies of itself, that aren't affected when the Delete button is hit. And that doesn't even take into account the e-mail remnants left on users' hard drives or the periodic backups made of the server contents.
According to published reports, Andersen acknowledges that in October and November, its employees deleted e-mails related to their work as accountants and auditors for Enron.
While e-mail servers and applications vary in how they move and store electronic messages, all of them hoard information on hard drives in the same way if they're running on Windows-based PCs, Sanders said. He added that Lotus Notes is a particularly easy program from which to recover deleted messages.
Arthur Andersen uses e-mail software and servers from IBM's Cambridge, Mass.-based Lotus Software Group subsidiary, according to Lotus CEO Al Zollar. At a conference last spring, he discussed the possibility that Lotus might lose Andersen as a client.
Lotus declined an offer to comment for this story. Representatives for the other companies didn't return calls.
According to John Korsak, product manager for Lexington, Mass.-based Ipswitch Inc.'s IMail Server, a few firewalls are even configured to log information about e-mail passing in and out. For POP3 e-mail, the message spools to a temporary file on the e-mail server while it's being accepted. Though it may stay there for only a millisecond, Sanders said, a message can get stuck in spools, bouncing around from directory to directory.
Enron was using Ipswitch's IMail server, according to a list of technology assets sold to UBS Warburg, the investment banking arm of Swiss bank UBS AG, as part of Enron's bankruptcy proceedings.
Sendmail, a freeware application that is the most common mail transfer agent (MTA), also records a log of all the header information for each e-mail that passes through a server. Once the MTA assigns the message to a directory on a server, it may be backed up to a storage tape. After a user downloads the message from the server, it sits in the in-box view until it's deleted. From there, it goes to the deleted files view, and if deleted from there, it is simply removed from the user's display. But the message is still in the application and remains there until it's marked as free space by a process known as compression, or archiving in Notes. The message remains until the application overwrites it with a new message, which could take weeks or months.
Even then, it will still remain, in part or in whole, on the hard drive in what are known as swap files. If an end user copied the e-mail to removable media, like a floppy disk, the registry would have a record of that activity.
And with Web-based e-mail, the messages would be in the temporary files, even if deleted, until that space is overwritten.
If nowhere else, the data is almost certainly on the hard drive, Sanders said. "As an administrator, that would be the first place I'd look," he added.
Read accompanying story:
 |
|
|
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
 |
|
All Zones Application Performance Zone Enterprise-Class Security Zone Enterprise Solutions Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone The Data Center Management Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Critical Considerations for Data De-duplication
Download this whitepaper now.
Download this survey results white paper for free, compliments of Tealeaf.
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Update: Microsoft to appeal $1.3B EU fine
- XP SP3 cripples some PCs with endless reboots
- Windows Vista more secure than XP, says security company
- More top stories
Computerworld Technology Briefing: An open-source path to optimal virtualization Looking for a virtualization strategy that offers both the flexibility and reliability to meet the demands of mixed-source environments? Look no further than the fast-emerging open virtualization approach backed by some of the biggest names in enterprise computing. Together they are pointing the way toward higher data center performance without higher costs.Download this briefing
|
Provide a Better Customer Experience
Register now for "Provide a Better Customer Experience," a live TechWise TV broadcast. This webcast is free to view, compliments of Cisco. Click here to watch now
|
 |
 Virtualized iSCSI SANs: Flexible, Scalable, Enterprise Storage for Virtual InfrastructuresDownload this white paper |
 Case Study: Simplified DR Planning and ImplementationDownload this case study |
 Webcast: Disaster Recovery Simplified – iSCSI and VMware Site Recovery Manager Deliver ResultsView this webcast |
 Webcast: Data Protection and Disaster Recovery with iSCSI and VMwareView this webcast |
|
|