Wiped GCSB files could easily be retrieved, says computer expert

If any organisation can retrieve a deleted video file from a hard drive, the Government Communications Security Bureau should be able to do so.

The latest development in the political storm surrounding Prime Minister John Key and the GCSB involves a mystery video recording which may or may not exist, or may or may not have existed, but which the Labour leader David Shearer says was stored on a number of computers in the bureau but which has been deleted recently. 

For those who have missed the excitement of the last 16 hours, Mr Shearer went on tv last night and said there is a recording of Mr Key addressing GCSB staff in the bureau’s cafeteria in February this year, in which the prime minister makes a joke about Kim Dotcom.

This is an issue because Mr Key has said he had not heard of any GCSB investigation of Kim Dotcom at the time of his visit to the bureau. 

Mr Shearer says he has not sighted or heard the recording himself, but he has been told about it, apparently by his press secretary Fran Mold, whose partner, it was reported by Newstalk ZB this morning, is an ex-GCSB employee.

The bureau’s chief executive Ian Fletcher has since stated there is no such recording: the bureau “has made exhaustive inquiries of its records and its IT systems and can find no audio-visual recording of the prime minister's visit,' Mr Fletcher says.

Mr Shearer was reported this morning claiming the recording had been deleted from the GCSB’s IT systems and that until recently it was on the hard drive of a number of computers in the bureau.

Even if that were the case, though, such a file should be able to be retrieved, says computer expert Brian Eardley-Wilmot.

“A file that was created, say, three years ago and deleted two years ago would probably not be able to be retrieved, because when you delete a file what you do is remove it from the computer’s table of contents, not the file itself,” says Mr Eardley-Wilmot, who is chief executive of Computer Forensics.

“It makes the space occupied by that file available to be over-written by newer files, but does not actually remove it, although over time it is likely to be over-written.

“But if a file was created in -  hypothetically -  February this year, and was then – hypothetically  - deleted in the last seven days, it would be highly likely to be able to be retrieved.”

The Government Communications Security Bureau lists as one of its main roles as “assisting Government departments and agencies to protect their electronic information resources and communications systems.”
 

This article is tagged with the following keywords. Find out more about My Tags

Post Comment

27 Comments & Questions

Commenter icon key: Subscriber Verified

If that's the case, then the GCSB is not doing anywhere near an adequate job of wiping drives.

Reply
Share

Yep - they can't even get that right!

Reply
Share

Yep, more Keystone Cops and an opposition not up to scratch. Can this get any better? Beats TV this whole sorry saga!

Reply
Share

The US military used to use hard drive shredders... I think thats the only 100% secure method

Reply
Share

First it was an "unnamed and unnameable" agency in the High Court depositions, now it is tapes that may or may not exist in proclamations to highest ministerial authorities of the land..

GCSB seem to be a particularly slippery, unaccountable lot. Aren't they our "best and brightest" out there in the underworld doing their damnedest trying to protect and serve and all that?

Reply
Share

The organisations involved and their political masters have shown enormous incompetence in this whole matter.
Heads must role and transparency in dealings such as this must be reinstated.

liberte

Reply
Share

This article is speculation that a video can be recovered off a wiped hard drive --- based on speculation that hard drives exists in the first place.
.

Reply
Share

what a shambles

Reply
Share

Shearer is obviously wanting to take us back to the Muldoon era of "Reds Under the Bed". It's pathetic.

Reply
Share

Shearers looking more and more amateurish by the day - there may or may not be a tape, if there was a tape its been deleted by now, so therefore, there must have been a tape! what?

Then he somehow reveals his source...silly little man.

Such weak political point scoring , he should have just told us Key’s "fat German at the cafeteria" joke and left it at that.

Reply
Share

Having actually done IT work in a top secret organisation (MoD), the odds of anyone being able to recover data (if it exists outside of Shearer's imagination) that was wiped are remote. File shredders would almost certainly be compulsory to overwrite (repeatedly) free disk space. Recovery from a backup would be the only way to retreive such a deleted file.

Reply
Share

Very few physical disks get sent to the shredder.
It all depends on what platform the data was stored in.
If the video recordings were stored on a dedicated device, the data may have been overwritten limited space = limited amount of video available and old footage gets overwritten. I would presume that being a secure site, even the canteen, video would be archived, and there is where 'multiple machines' comes into play.

If the video footage actually existed, then it it still exists, these archives can not be deleted, there are offsite backups and the data is kept for years.

Either the video footage exists and we are being lied to, or the video does not exist and we are being lied to. Either way, its not unusual.

Either way, it would not surprise me in the slightest, if he was sitting in the canteen joking about dotcom. He will never take responsibility for the mistakes anyhow, he will just blameshift onto some poor staffer.

Reply
Share

The Police have computer forensic programs to easily retrieve anthing from computer hard drives, which will be successful unless the computer has been specifically "cleaned" and the hard drive purposely purged and overwritten.

I am sure there will be daily data backup of all data at offsite data storage as part of their disaster recovery procedure which will allow the files to be retrieved.

This screams of a coverup and conspiracy.

Reply
Share

Most teenagers can clean files from disk so they cannot be recovered - there are many ways to do it - basically they can only be recovered if that part of the disk that held the content is not over written. There are a number of tools and other processes to do that.

If this is the issue then forget whether Key did or did not know who this German person was - that is irrelevant anyway - the real investigation would need to be do we have the right calibre people working in this department - further the level of discretion required by people in this department if they are leaking information to outsiders that is a far more serious issue and that is what really needs investigating. There are some jobs where in the national interest you need to keep your mouth shut and get on with it.

Helping to score embarrassing political points on minor matters is not in their remit and if they feel it is then this is not the job for them.

Reply
Share

Yep - looks like yet another Labour Party / leftie attempted sting gone wrong again - because either Shearer is lying about the so called video and making up stories again - like his Mr. Rufus Painter story....

..or Shearer is accussing the Director and CEO of the GCSB of a "cover-up" and accussing them of lying - echo's of Goof here too...

So which is it Shearer?

Either way - Shearer has egg on his face again and once again is proven to be no where near the calibre of MP NZ requires... and he can take his corrupt caucus with him too when he gets the boot!

Reply
Share

Shearer really does have to learn that "the dog ate my homework" isn't accepted as an excuse for missing material. It's the kind of accusation that can only work when you have your own copy of the video to give to the press once the PM has denied it exists.

Reply
Share

The old adage "fiddling while Rome burns" has nothing on all this nonsense!

Reply
Share

All patriotic Kiwis need to check for spooks under their beds. you can't be too careful. Yawn.

Reply
Share

" The bureau’s chief executive Ian Fletcher has since stated there is no such recording: the bureau “has made exhaustive inquiries of its records and its IT systems and can find no audio-visual recording of the prime minister's visit,' Mr Fletcher says" Say what??

If I ran the bureau, I would know exactly:
a) If Key was there or not, and if so, what did he have to say, if anything?
b) I'd know exactly what recording devices I had installed and I would not need to make ‘exhaustive inquiries of its records’, if a audio visual recording existed or not. I would be able to go straight to it.

This comment sounds like a flummoxed and obfuscating Mr Fletcher or, a mickey mouse bureau where the left hand doesn’t know what the right hand is doing.

Reply
Share

CORRUPTION!!!!

The GCSB are the most highly trained IT professionals in the country this is their bread and butter ... the only reason this data is lost is because they where ordered to lose it. John Key is a criminal

Reply
Share

Wonder what former president Nixon would have advised key to do?

Reply
Share

Tell a big enough lie and most people will believe it,worked for Nixon,Clinton.....for awhile.

Reply
Share

But do they want to?There goes the budget of $50million if anything resembling Key acknowledging Kim on video. GCSB will be looking for new gear on Trademe.There surely must be another copy around somewhere.maybe Key can get his Hollywood buddies to make up one,that Dotcom isn't in.

Reply
Share

Shearer is not a good poker player is he,played his hand before he had the hard evidence,now he looks a fool.Unless there is another copy floating about,if so put it on Youtube so we can all have a look.

Reply
Share

Surprising some of the above comments. What are the known facts? Shearer says there "may be a video", and that it "might have been wiped".

Shades of the "straw man" fallacy, whereby one invents an incident, and then argues how terrible it is that that incident was allowed to happen.

Reply
Share

The only thing that has been wiped by this whole saga is Shearer's credibility.
An contrived scenario, designed for Political embarasement, which has backfired due to a total lack of plausible evidence from Shearer.

Reply
Share

I wonder if the Police will press charges, Shearer obtaining any info like this through a source inside the GSCB is illegal under the NZSIS Act 1969.

@Paul Marsden, thank god you aren't running the bureau, you sound like a half-wit.

Reply
Share

Post New comment or question

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.

NZ Market Snapshot

Forex

Sym Price Change
USD 0.7947 -0.0018 -0.23%
AUD 0.9044 -0.0036 -0.40%
EUR 0.6272 0.0007 0.11%
GBP 0.4955 0.0012 0.24%
HKD 6.1634 -0.0147 -0.24%
JPY 85.2230 -0.0160 -0.02%

Commods

Commodity Price Change Time
Gold Index 1248.5 1.960 2014-10-21T00:
Oil Brent 86.2 -0.850 2014-10-21T00:
Oil Nymex 82.5 -0.270 2014-10-21T00:
Silver Index 17.5 0.195 2014-10-21T00:

Indices

Symbol Open High Last %
NZX 50 5233.1 5284.3 5233.1 0.89%
NASDAQ 4429.2 4433.4 4419.5 0.12%
DAX 8934.5 8957.2 8887.0 0.57%
DJI 16615.3 16647.6 16614.8 0.12%
FTSE 6372.3 6397.8 6372.3 0.31%
HKSE 23300.5 23460.8 23088.6 1.37%
NI225 15038.2 15195.8 14804.3 2.64%