Electronic fingerprint trail in 'lost' Lerner emails?
Are Lois Lerner's emails in the IRS targeting scandal really 'lost' without a trace? If someone deliberately got rid of them or the hard drive was destroyed, would evidence be left behind?
This is a rush transcript from "On the Record," June 23, 2014. This copy may not be in its final form and may be updated.
GRETA VAN SUSTEREN, FOX NEWS HOST: OK, viewers, I know what you are thinking. I am, too. Is it really possible for emails to vanish without a trace? If somebody deliberately got rid of them, would there be any evidence of tampering left behind?
Compute expert, David Kennedy, joins us. Nice to see you, David.
DAVID KENNEDY, COMPUTER EXPERT: Good to see you again. How are you doing?
VAN SUSTEREN: Good. Two ways to get rid of emails. One is to erase them and the other is for your hard drive to crash. Tell me what the difference is.
KENNEDY: So, when you actually go in and erase a hard drive, there are certain applications, like your eraser and a few other ones, where it erases sectors in your hard drive. It completely erases it for good. No way to recover it. No forensics expert can recover it, versus a hard drive crash, which would be something mechanical. The hard drive spindle going wrong. Crashes where you would have to rebuild the hard drive. In those cases, you can recover the data and get all of the information out of it. If you are intentionally able to erase it, you would not be able to recover the data.
VAN SUSTEREN: Obviously, I can take a hammer to my hard drive and crash it. But is there any other way for me to deliberately crash my hard drive?
KENNEDY: If you take a hammer to the hard drive, you can actually rebuild that hard drive and probably fix it again, depending on how bad you smash it. When the actual hard drive crashes, recovering the data is actually really easy. This is why it is so alarming right now with the Lois Lerner emails and the six other individuals. If you have a hard drive crash, to send it to a repair shop to recoup the hardware failures that happen on the hard drive itself would be relatively easy to do. Otherwise, if you had software that destroyed the evidence or destroyed everything on the hard drive, you would have something that would erase sector by sector of the hard drive itself, it would make it unrecoverable at that point.
VAN SUSTEREN: I had an external hard drive and dumped a lot of pictures on it. It crashed. All of a sudden, I couldn't recover the pictures. I sent it to the manufacturers. They spent three months trying to recover my pictures. They couldn't do that. Instead they sent me a replacement hard drive, minus the pictures. They said it crashed and was unrecoverable. Is that different?
KENNEDY: Not necessarily. In that case, they may not have been able to recover it. There's companies that specialize in recovery of data. Most big organizations that have hard drive failures for key important people in the organization, can send them to these places called clean rooms and they can reassemble the hard drive and fix all the issues out there. In most cases, you can recover. In a very similar case, yes.
VAN SUSTEREN: Let me ask -- I think I may have asked this, but so I understand. Can you deliberately crash your hard drive?
KENNEDY: You can. You can deliberately crash your hard drive.
VAN SUSTEREN: How?
KENNEDY: There's applications out there that will actually erase and basically nuke your entire hard drive or cause portions of your hard drive to become unresponsive. So when you go to power your computer on, it would actually have issues that would be unrecoverable to the I.T. people to be able to do. It is possible. There's applications out there that would do that for you.
VAN SUSTEREN: Do you leave fingerprints when you do that, in the sense that you can tell someone deliberately crashed a hard drive, or is that indistinguishable from a faulty hard drive?
KENNEDY: It depends on the sophistication of the person doing it. In most cases, you can actually identify if somebody was deliberately trying to tamper with the hard drive to crash it or remove evidence. For example, if I were to use one of these cleaner applications, you would intentionally -- a forensic examiner like myself could actually go back and look at the type of information that's on there and see that it was actually erased intentionally. Same thing if you had a hard drive crash. You can see the last time it was booted up. The difference between that and look if it was intentionally crashed or not.
VAN SUSTEREN: What's your question you would like to ask tonight if you were at this hearing?
KENNEDY: Well, I mean, I think Chairman Darrell Issa had a list of 15 different questions that he was asking. I think those questions are actually spot on. They really get to the core of a lot of issues that are happening out there.
But one really alarming question I think right now that we're not asking is how many other people were affected by the email crashes. The people that were subpoenaed, out of the six they tried going after, all six of them had all the information taken out and weren't able to recover the emails. How many other people experienced this? And if you start sampling, you know, the organization of the IRS and it showed that it was only, you know, this select group of people, we have something really concerning on our hands right now that we really need to look into that would be potentially disastrous.
VAN SUSTEREN: Even though a failed hard drive or a crashed hard drive, personal, meaning personal to your computer, why would somebody else's computer, you know, down it the line in the next office have the same problem?
KENNEDY: Well, I mean, that's the thing that's alarming about this, Greta. If you look at it, it was Lois Lerner and six other individuals that were impacted by this as well. So if you have those people that are impacted as well, that's a really alarming statistic, in most cases that doesn't happen, especially in a 90,000-person organization. There is something we really need to get to the bottom of right now and we're not getting the answers that I think we need to actually investigate it.
VAN SUSTEREN: On a one-to-10 scale and the 10 being the most suspicious, the fact that six people including Lois Lerner had a crashed hard drive, what's your level of that's really bizarre?
KENNEDY: Probably at about an eight and a half or nine at this point in time. Things can happen. Computer crashes can happen. And if the I.T. organization was in complete disarray and they didn't know how to recover data, I can see this happening, which is why I still have a point there. But right now, it's about eight and a half or nine on the suspicious radar, for sure.
VAN SUSTEREN: Could my computer hard drive crash and cause Bret Baier in the next office, his computer hardware, his computer hard drive to crash?
KENNEDY: No, not at all. They are completely independent systems. In fact, what is so alarming about this, in most cases, is that they have another, you know, what's called an exchange server that is supposed to be backed up and data is on there, so if your computer crashes, you still have your emails and everything you would have normally had. So the fact that they lost the exchange servers, the back up tapes and actual hard drives themselves and six other people impacted by this, it is definitely a nine on the suspicious rating scale, for sure.
VAN SUSTEREN: How do you lose all the emails on the exchange server? If my computer breaks or crashes, by hard drive, how does the exchange server lose all those emails?
KENNEDY: That's the thing. It doesn't. What has to happen in that type of scenario is that they weren't actually backing up things appropriately. That's the first thing that you test in an environment, especially in information technology. You make sure that the backup is working and make sure you can recover the data. If it's not working, you make steps to make sure it doesn't happen again. In today's technology, and even in 2009 to 2011, this is a proven practice. This is a proven technology. This is something that everybody knows to do in every single I.T. organization. It's really alarming it happened here if that's the case. But it doesn't impact each other. A computer crash has no impact whatsoever on the servers themselves.
VAN SUSTEREN: David, thank you.
KENNEDY: Thanks, Greta. Good to see you.
Get all the stories you need-to-know from the most powerful name in news delivered first thing every morning to your inbox