US Presidential candidate Hillary Clinton has found herself the subject of an investigation into emails that she sent from a personal mail server – clintonemail.com – while she was Secretary of State.
The controversy is centered on whether Mrs. Clinton communicated any classified information using the unsecured server that was operating from her home in Chappaqua, New York.
Having previously delivered copies of tens of thousands of her emails in the form of hard copy print outs, Mrs. Clinton has now turned over the email server itself.
So, why does the Justice Department want the entire server?
All computers store information in places that are unknown to the average user. Whether it is the mobile phone in your pocket, all the way up to the most sophisticated servers, data you think you have deleted may be squirrelled away, in corners of the hard drive not retrievable by the typical consumer, such as the slack space where old ‘deleted’ files might lurk.
Enter the forensicators.
Digital forensics is not an entirely new science; however, given the constantly changing technology landscape, the science is continually evolving and growing.
One thing that is certain is that any time a computer performs any processing – from the simple act of placing a message in a folder in your email client, to restarting the machine – the original state of the information on that machine is changed.
How forensically sound and legally admissible is six-month old digital evidence? The legal word that describes damaged evidence is spoliation. Think of it as you would a piece of fruit found in the back of your refrigerator. Eeeew.
In most investigations, the evidence is best when it is seized as close in time to the start of the investigation. Longer times result in cold trails and easily challenged findings.
We may never know exactly what the Justice Department finds on Mrs. Clinton’s email server or how it will be used to settle the controversy, but it will be an excellent lesson for all to see the extent of the power of digital forensics.