At the Frontline – Charles Holloway

Pen Hadow, the polar explorer kindly entertained me to dinner recently at the Frontline Club. Pen and I share an ancestor way back in the 19th century but until last year I was only dimly aware of his existence and had no idea we might be distantly related. I knew, of course, that he was the first man to walk unaided to the North Pole but that was it. I certainly do not share his proclivities for cold, dark and rather frightening loneliness!

My ignorance extended to the Frontline Club too. In fact I had never heard of it such is my parochialism in such matters. What I discovered was that the club operates out of the first floor of the building in Paddington where there is a restaurant of the same name and where I sat for 30 minutes nursing a warming glass of red wine instead of making my way upstairs to the club premises where Pen was patiently waiting. “Not much of an explorer then,” I hear you mutter… and you would be right.

The Frontline Club was started in the 1990s as a place where returning journalists could meet. John Simpson and Kate Adie might well have been there on their return from the frontline. They were not!

What is more interesting is that the club was founded by Vaughan Smith. I have to admit that rather like the club itself I had no idea of Mr Smith’s existence although the name sounded familiar. I subsequently discovered that Vaughan Smith not only lives in Norfolk but has had a famous guest in his house since before Christmas last year, one Julian Assange of Wikileaks fame.

So rather like the LinkedIn lists of people you may know, I was now not only connected to Pen Hadow but was only 2 connections away from John Simpson, Kate Adie and Julian Assange. Fame indeed!

These random thoughts were prompted by a discussion I had recently about slack space. Now I know that the readers of this blog generally know more about computers than I do (it would not be difficult) but I venture to tell you a little about slack space. In many file systems, each file starts at the beginning of what is called a cluster. This makes it easier for the computer to expand files as they increase in size. It uses up the space in the cluster as documents are created.

Any space left unused between the end of the last document in the cluster and the start of the first file in the next cluster is called file slack or more usually slack space.

If I have lost you, bear with me because I have almost finished and my point will become clear shortly. I take it that these days most people are aware that when you press the delete button and the data disappears from view, it has NOT been deleted but is merely hidden in the slack space. Forensic experts will tell you that they find much interesting material by looking at the data drive and “recovering” what has been deleted or hidden.

If you want to delete or remove data permanently you have to overwrite that part of the drive containing the data with a series of random numbers, such as zeros, and there are computer programmes to do this for you.

So far so good, but if you really want to prevent the clever forensic investigators from recovering what you have “deleted” you should think in terms of taking an axe to the hard drive or as one of my colleagues Emma Bolsover suggested the other day, drive a van over it.

I have experienced the horror of losing a CD of sensitive information I had entrusted to a security firm to courier across the country. Their van had been hijacked and the contents stolen. I was only partly comforted when told by the investigating CID officer that the thieves were more likely to have been interested in the bearer bonds in the back of the van than a mere CD and that in any case they had in all probability thrown it into a ditch by the side of the road where the water would have rendered the information unintelligible.

You can never be sure though. Data recovery specialists retrieved 99% of the information stored on the charred remains of a hard drive belonging to the ill fated space shuttle Columbia which disintegrated on entry into the Earth’s atmosphere, killing the crew and scattering debris across the southern USA. Not only was there disintegration and fire but the debris was discovered in a dried up lake bed (although not at the bottom of the Pacific Ocean as one story I had heard would have it). [See Shuttle Columbia’s hard drive data recovered from crash site, Computerworld, 7th May, 2008.] If that is not front line recovery I am not sure what is.

However, two other items have caught my eye recently thatI thought you would like to know about. One is an article by Pete Coons about the art of DeNISTing. [To DeNIST or Not to DeNIST, that is the question! Bow Tie Law, 22nd Jan, 2010]

Mr Coons asks “To DeNist or not to DeNist, that is the question.” For an excellent description of how to get rid of all the unwanted “stuff” before carrying out a review, you should read the short article. As usual with technology it is not quite as simple as it seems!

The second is the report of a case decided by United States District Court Judge T. John Ward called Green v Blitz. An article by John Blumenschein which appears on the Guidance Software site explains all. [Civil Contempt and Possible $500,000 Sanction for Withholding of ESI by Defendant, Guidance on eDiscovery, 9th March, 2011]

The case deals with a scenario where Blitz’s IT department routinely asked its employees to delete electronic documents. I hope it is clear by now that it is not an easy thing to do and that even if you are able to do so the courts will not look kindly on your actions. This case is of course a US case and has no authority in this jurisdiction but, as so often with these cases, what happens in the US today happens in Europe tomorrow.

You and possibly your clients would certainly then be in the front line and for all the wrong reasons.