A mine of hidden information
If you are one of the many people who has lost important work when their computer has frozen, or if your computer has, without any obvious reason, decided that the long document you have saved is no longer legible, it may surprise you to know that computers are really bad at deleting information. Of course, if you are someone, like a fraudster, who wants information to be deleted, this is a problem.
Modern computers are designed to store data as quickly and reliably as possible. They are built to optimise speed but to save data rather inefficiently. Computers are designed to ensure data is preserved, they are not good at getting rid of it when it is not needed any more. The reasons are quite complex, but in essence, if you delete something on your computer, it isn’t really gone. It takes too much time for the computer to erase data, so it usually does not do it.
Computers can store a lot of information. Think of a big bookshop — say Waterstones in Belfast — the data storage capacity of any of the cash registers in those stores is without doubt a multiple of what can be written in the books on every shelf of the shop. If you were to save every word in every one of the nearly eight million books in Trinity College Library as Microsoft Word files, they would fill around 12,000 gigabytes of storage — 12 terabytes.
Modern computers have so much storage they really do not need to ‘recycle’ space by deleting data. This may be a problem for many people. It represents a potential threat to people’s security and privacy. However, it allows forensic investigators, like me, to do our jobs.
Do you use your computer to browse the internet? Well it will usually preserve or ‘cache’ the contents of the websites you visit, even if you use private browsing. You might delete this cache — private browsing does it automatically — but the data isn’t really gone. It is still on the disk and it can be brought back. If you did a Google search on your computer three years ago, the chances are it is still in there somewhere. How about your electronic documents? Even if you write a letter, print it and shut the computer down without saving it, the text can still reside on your computer. Windows preserves it in case the computer crashes unexpectedly.
Do you have a back-up of your iPhone on your computer or on your iCloud? You may have one and simply not know about it. That back-up does not just contain your songs, it also holds SMS messages, emails, WhatsApp messages, photos and much more. The photo you took with your iPhone is not just a picture. It contains embedded information that can tell when the photo was taken, the GPS location of where it was taken, what camera settings were used, and much else. If you have used a USB stick on your computer recently, specialists can determine the make, model and serial number of the device, what files and folders were on it, when you used it and for how long.
As you might imagine, in an investigation all this material can be invaluable. IT forensics has become central to many criminal and civil investigations.
Therefore, while you may see this inability to delete data as a problem, for specialists like Grant Thornton, it often provides the solution, enabling us to quickly identify the key facts so clients can make important decisions.
For more information Andrew Harbison can be contacted at firstname.lastname@example.org Grant Thornton (NI) LLP specialises in audit, tax and advisory services