[FunkyZero]

Here are several points. And keep in mind, I have been in Tech for almost 25 years. Currently, I design and build out data centers, software platforms, storage and network security for a rather large and complex network consisting of thousands of clients.

1) User email has never been stored on a PC hard drive except for backup. You have always had to manually set your email reader to download emails. This is an archaic model to say the least. On all modern systems, email is stored on the server and sometimes (more often than not) cached on the PC so you have limited functionality when you have no network connection. On typical systems, when you delete an email, it is deleted from the server.

- On most email servers, when a user deletes an email, it is recoverable for usually 30 days. This is a typical setting for MS Exchange servers and it is the most common email server in use today.

- The US Government is required to archive and keep emails for accountability purposes. What this means is they must keep ALL emails for a given length of time (I'm not sure what the mandate is). There are software platforms designed just FOR this purpose. This software works as a wedge on your email server and sends copies of every email to the archive... out of the reach of the user. These emails can only be deleted by a system admin delegated with such privileges.

- I haven't seen a email server is YEARS that had a hard drive (singular) in it. today (and as with the case with the US government), servers have no hard drives in them. These servers are attached to a centralized storage platform via fibre channel, iscsi or other odd protocols. In these storage platforms, disks are built in RAID arrays consisting of MANY (sometimes thousands) of disks. The RAID concept stores strips or parity of data across all drives so in the event a drive or multiple drives fail, the data is redundant. The drives can be swapped out hot and the system rebuilds the lost strips or parity back to a normal state. this is a regular and common occurrence. I replace at LEAST one dead drive every single day in my arrays and SAN platforms and I've never lost one single bit of data.

- Backups: We know the email is stored on an email server. In this case, a CLUSTER of servers. This means that even if one or two servers completely crash and lost their data, the others remain online in the cluster and contain the redundant data. These are also backups up to backup media. In the old days, it was backed up to tapes. In todays world, that is too expensive and inconvenient. Data is backed up to other SAN or storage platforms and almost ALWAYS in a remote data center for disaster recovery purposes.

Her's the simple fact: that data was purposefully scrubbed, or they still have it. In either case, they are a) lying or b) need to be arrested on the spot. There is NO WAY those emails were lost in a crash. There are far too many redundancies in the systems... it would have to be a concerted and coordinated effort to get rid of the data... things are so redundant these days,, data is kinda like herpes... it's hard to get rid of... most especially in a government data center running redundant server clusters, offside replication and hard-core SAN platforms. They are flat-out lying and I'd bet my reputation on it.

[Junk Silver]

“...that data was purposefully scrubbed, or they still have it.”

Absolutely. It has to be one or the other.

What really disturbs me here is how brazen the administration has become, repeating their preposterous “crashed and thrown out hard drive” excuse and seemingly daring Congress to try to do anything about it.

I had the same feeling when the D.O.J. went after Dinesh D’Souza. We are being blatantly mocked.

[dennisw]

dittos and I am not an IT genius.... But the IRS and other governmental agencies like to keep it sloppy and stupid. They know how to make this work for them and it does.

IOW these monkeys do not behave in IT like a normal responsible private sector business

[Deek]

I agree

I have managed an Exchange System, and It is quite possible that the email is gone; but if it is gone, it is because several intentional steps were taken to delete the email. I don't think it is in the realm of possibility that it was an accident. The steps required:

1) Delete the email from the Exchange Server. In most cases a user can delete data from the Exchange server where the email is stored; in other cases, administrative privileges are required. Either way, this step must be done intentionally by someone. If this step is not done, the email is still there.

2) Copies of the email that are stored on the user's computer must be deleted. I have indirect experience with forensic recovery, as we used it when employees attempted to damage a disk beyond recovery, or when we had a disk hardware failure. I have never seen a disk hardware failure that was unrecoverable. It takes both knowledge and still to render a disk unrecoverable. Someone should get a copy of the forensics analysis report. They can tell how the disk was deleted, and likely what tools were used.

3) The backups of the Exchange Server must be overwritten or destroyed. What I know of Federal Data retention policy is very limited; but IT practices in even the smallest of businesses required that some daily backups (monthly or quarterly) be kept for an extended period of time.

There are a lot of other details that may apply as well, depending on how the system was managed; but at a minimum, the three intentional steps above must occur. There is one or more IT person that knows exactly what happened to those emails.

[Gideon7]

Microsoft Exchange provides a documented backup API that has been around for years. The technical description can be found here. This API is rather old (it dates back to at least Exchange 2000).

More recent editions of Exchange Server have switched to use the Volume Snapshot Server (VSS), which is documented here. The backups are then typically archived to a Virtual Tape Library (VTL) or equivalent.

Now, I don't know which edition of Exchange the IRS happens to be running (a lot of these sites are pretty old). Regardless of which API they are using, the point is that Exchange's backup technology is well established and had been a standard feature of Exchange for well over a decade.

[Yardstick]

The catch is that each IRS user was limited to 500MB of space on the server. Once they hit that limit they had to start archiving their emails locally on their machine. A person at her level and with her volume of email would have hit that limit quickly. As a result the vast majority of her emails were on the hard drive of her computer, and were lost when it crashed and was later recycled. This seems to be what the IRS is asserting in their latest excuses anyways. Do you think this is plausible? I.e. could the 500MB limit have made it possible for her emails NOT to have been backed up on the main server?

[Innovative]

” I replace at LEAST one dead drive every single day in my arrays and SAN platforms and I’ve never lost one single bit of data. “

Thanks for your detailed answer. What you said is what makes sense.

I think after the 9-11-2011 terror attacks data backup became even more sophisticated, backing them up at different locations in addition to local backups.

“They are flat-out lying and I’d bet my reputation on it.”

I believe you.