Recovering White House E-Mail Not Easy

The Associated Press
Friday, April 13, 2007; 3:40 PM

NEW YORK -- Although a top Senate Democrat believes even a teenager could recover missing White House e-mails, experts said Friday that doing so could be tough _ but not impossible.

On Thursday, Senate Judiciary Committee Chairman Patrick Leahy of Vermont disputed the Bush administration's claims that e-mails sent on a Republican Party account might have been lost, insisting that e-mail is never fully deleted and "I've got a teenage kid in my neighborhood that can go get 'em for them."

"I read that and I laughed," said Mark Rasch, managing director for technology at FTI Consulting Inc. "Senator Leahy is wrong when he says it's a trivial matter, but it's also not correct to say they cannot be recovered."

The life span of e-mail has become an issue after the White House said it may have lost electronic messages from Karl Rove and other administration officials. Democrats in Congress want the e-mails for their probe of the firing of eight U.S. attorneys. In addition, by law, anything dealing with official White House business must be preserved.

White House officials say they will make a genuine effort to recover any missing e-mails dealing with official White House business and sent through accounts sponsored by the Republican National Committee.

About 50 past and current White House aides have had such accounts, according to the administration, to comply with a law banning the use of government resources to conduct political business.

Until August 2004, the RNC generally deleted messages automatically after 30 days. But even after the RNC ended that policy, individual aides have sometimes manually deleted e-mail. The White House has not ruled out that some could be related to the firings.

Rasch, a former Justice Department computer crimes official from the Reagan and first Bush administrations, said e-mail recoverability would depend on the amount of time and money devoted.

"Deleting them made them much more difficult and expensive to recover, and much more difficult to determine whether they exist," Rasch said. "Maybe they are unrecoverable, but you're going to have to spend a lot of time and energy to look and make sure they are absolutely unrecoverable."

Experts say such searches are now routine for major lawsuits and criminal investigations, and the White House isn't alone in losing key messages.

In March, Intel Corp. said it may have lost some internal e-mails that the chip maker was supposed to turn over as possible evidence in an antitrust lawsuit filed by archrival Advanced Micro Devices Inc. Intel blamed missteps, including its failure to tell some 400 employees to retain those documents.

Even so, there are many places where the messages _ or traces of them _ might exist.

Some may still be on staffers' desktop computers, laptops or even BlackBerry devices for accessing e-mail on the go. Even after a message is manually deleted, it may linger until the computer needs to reuse that space for another file _ and that's less and less likely as disk drives increasingly have more storage capacity.

That could happen even for Web-based e-mail.

"The way you can see the e-mail on a screen is to make a copy of it on your computer," Rasch said.

E-mail recipients may still have a copy. A House committee sent Attorney General Alberto Gonzales a letter Thursday requesting the preservation of all e-mails from and to White House officials who used non-governmental e-mail accounts.

The RNC and the service providers it uses have likely backed up their systems routinely _ and those backup copies may still be around, even months or years later.

"There are lawyers who go out to these providers and subpoena them just to make sure they don't have any tapes sticking around," said Michele Lange, staff attorney with Kroll Inc.'s Kroll Ontrack.

Robert Brownstone, law and technology director for the law firm Fenwick and West, said many organizations retain backups longer than intended because of inertia: They simply didn't get around to tossing the copies past their scheduled retention times.

"I would not say that any teenager could do it, but I would say there are many, many highly qualified computer forensics experts," he said. "Whether they will find every deleted message is doubtful but they should find quite a bit."

© 2007 The Associated Press