Posted on 05/18/2021 5:19:44 PM PDT by semimojo
Auditors hired by the Arizona state Senate backtracked Tuesday from claims that a key database had been deleted from Maricopa County's elections servers -- admitting in a hearing held by the Senate Republicans overseeing the audit that the data is intact and they'd been looking the wrong way...
But, Maricopa County officials explained and auditors acknowledged Tuesday, those conducting the audit had made a technical mistake and the database was never deleted...
RAID arrays, used in enterprise servers, are designed for redundancy: They split data among multiple hard drives in a way that allows the data stored on those drives to be maintained and automatically reconstructed in the event that a drive within the array fails.
However, RAID arrays can be constructed in a number of different ways, and Cotton said auditors did not know which construction Maricopa County had used -- which would have left them unable to fully access the contents of the server...
(Excerpt) Read more at cnn.com ...
You said: “If they receive a computer that is turned off they take the drives out and make a bit-by-bit computer of the drives. They use a completely different machine for data analyst.”
“Be smart and listen and check his credentials and company. The man does work for several government agencies and data recovery for large multinational corporations.”
So my comment stands. i.e. “its not that simple” otherwise “your man/company” (with the those credentials) would not have botched it on the first pass.
That's a reasonable question. Forensic IT work is not done by running a computer and looking at what it says. Instead you take out the hard disks and read their data from them directly, sector by sector, with a hardware write blocking circuit in the interface so that the data can't possibly be altered.
So there is no "raid array" in forensic work. Just a set of disk image files that you work with. Of course once you figure out the RAID configuration you then know if the drives are mirrored, or striped, etc.
You do the re-assembly of sectors to files that is normally done by RAID hardware and drivers using software tools looking at the disk image files.
Lol....and I got jumped on for saying they were a third rate outfit and amateurs...š¤. If they couldnāt figure out a raid setup Iād say they were not the sharpest ninjaās in the temple...š.
This has got to be one of the most amateur audits Iāve ever heard of. Using black lights looking for some mystery marks, not understanding how ballots are counted and what the documentation on the boxes containing said ballots meant, and so on. Arizona should ask for itās money back...
“Data in an MFT table has nothing to do with the RAID array configuration”
Really? How do you read the MFT on an NTFS volume before you have the drives properly configured in the raid setup?
I suspect there is not going to be a Perry Mason-like “I DID IT” kind of moment when they examine the database.
Especially if they have reasonable questions about why this or that might appear a certain way, I think the auditors have been told to pound sand by the Maricopa County officials, so a lot of things will probably need to be reverse engineered I think.
Great. If the election was rigged and the County deleted the database to hide that fact we should be seeing all kinds of revelations soon from the recovered database. Right?
The auditors are keeping their cards close to their vest. But if you took the time to listen to all the testimony today you would have heard plenty of disturbing information. Tons of ballots have been created because of spoilage (supposedly) without a link to a spoiled ballot (against the law and untraceable). Mismatch ballot counts. Batches (1.000s) of ballots not sorted and/or marked correctly and again impossible to trace (against the law).
Listen to all the testimony and do yourself a favor. They described thousands upon thousands of ballots not stored correctly, created (spoilage) without being marked to the original ballot to be verified. If anyone paid attention to what was said in today’s hearing, they would realize the election was rigged and they just started.
I’ve seen things that are contrary to that only 10 years ago.
That’s one way of doing it but then they open themselves to exactly what we saw here. The results being questioned because the reconstruction was not correct or flawed. You take the server, clone the disks sector by sector, then stick those cloned drives back in the server and and boot the system.
Every point you mentioned was an administrative process criticism. Have they talked about any evidence of fraud?
His testimony indicates that he figured out the RAID configurations and then looked at the MFT data. That's NTFS file system data, and is a layer or more likely layers above the RAID stripe mapping. And you should know that since you have designed disk controllers.
He testified that the MFT data indicated deletions had occurred. Assuming his testimony is accurate he didn't "botch" anything.
Saw contrary in what way?
These methods work. To claim otherwise is foolish.
https://search.usa.gov/search?query=NIST%20SP%20800-88&affiliate=dod_dcsa&utf8=%26%23x2713%3B
This has got to be one of the most amateur audits Iāve ever heard of. Using black lights looking for some mystery marks, not understanding how ballots are counted and what the documentation on the boxes containing said ballots meant, and so on. Arizona should ask for itās money back...
Silly to listen and believe the County and CNN’s response. Listen to the testimony of today’s hearing. They don’t seem amateurish at all. It is quite obvious to anyone with ears there are plenty of things to be concerned about. Unmarked batches of votes by the thousands, spoilage votes (ballots created by someone else than the voter and not link to a voter’s ballot).
And it is pretty crazy to believe there wasn’t mass cheating. Anyone with an once of common sense would know there was and it be going on for decades.
Uh, no. You don't do that. Unless you are just doing some minor internal debugging.
Actual forensic analysis is conducted on data not being modified on the fly by the operating system. As one example, how would you hope to recover previously deleted data in any situation if the first thing you do is start up the system again? The first thing that happens is all kinds of logs get written, files get created, and new data ends up getting written on top of the previously de-allocated, but potentially still full of data sectors. Oops, no longer in the state that the system was in before you started.
Check your freep mail.
” he figured out the RAID configurations and then looked at the MFT data.”
Did you read that and then go back and look at what you posted: “Data in an MFT table has nothing to do with the RAID array”
You don’t get to the MFT until you figure out out the raid config.
Every point you mentioned was an administrative process criticism. Have they talked about any evidence of fraud?
There were tens of thousands of administrative problems? Thousands of batches of ballots not linked to when the batch was run on the machine (impossible to trace or track these), spoilage ballots not linked to the voter’s ballot (impossible to determine voter’s intent), ballot counts way off, and yes the database deliberately deleted, easily proven.
If it walks like a duck, it’s a duck. Besides, as I mentioned cheating in democratic strongholds has been going on for decades. Kennedy won on the graveyard vote in Texas and Chicago. The most common phrase in Chicago on voting day, is vote early and often. There are several precints in Philly that voted 100% (impossibility) for Biden.
If you don’t think the democrats cheated, I don’t know what to say.
You do both! You always have the original drives to clone again for the low level forensics.
You just made my point for me. You don't in general if there is striping. So the mere fact that the auditor was describing how he reconstructed the RAID configuration by looking at the disk images and then looked at the MFT shows that the auditor knew exactly what the RAID configuration was, and used that information to analyze the data at the logical disk level.
The auditor clearly understood the RAID configuration. You can watch him describe it in the video of his testimony.
This is absolutely correct. I listened to the entire hearing and CNN is blatantly lying. The data WAS deleted. The audit team recovered the deleted files (I’m sure some folks at Maricopa gasped when they heard that...).
The discussion of how the RAID array was configured (0+1) was orthogonal to this point.
I suspect there is not going to be a Perry Mason-like āI DID ITā kind of moment when they examine the database.
There could be a Perry Mason-like “I DID IT” They never turned on the county’s machine. If the database was deleted, it will still be deleted on the County’s machine. Just turn the thing in court and have Perry Mason nearby.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.