How Do Email Servers Work? Please dont PARF...

[stomachmonkey]

Originally Posted by mistertate

My employer had an outlook email server crash this year and most of us lost everything. I assume my customers lost the same emails I lost. It was a PITA and embarrassing.

The DB nature of Exchange is a nightmare.

One of the earliest iterations of Outlook used a local DB, actually still does.

One day I send an email and immediately get a pop up that says "Your mail store has exceeded the DB limit, so sorry but you are ****ed" then it crashed and I lost two years of mail.

What was infuriating was they thought to create an alert for an after the fact condition but not one that said "Hey dip****, your DB is almost full, back it up or purge it or do something before you receive a piece of mail and lose everything" which would have been far more useful.

To add insult to injury two days later MSFT issued a patch that increased the max DB size and gave you the nearing capacity warning before hand.

[daepp]

From Reddit - a post from the tech who maintained Mrs. Clinton's server:

[john70t]

I have received threatening emails in the past, breaking laws, but they disappeared before saving.

There is this:
https://www.cnet.com/how-to/this-e-mail-will-self-destruct-heres-how/
Self Deleting Email, How to Send Self Deleting Mail

[flipper35]

Originally Posted by VincentVega

I've seen a few cases where something was supposed to be quarantined yet the target disk was full and things got hosed. I've also seen a backup routing fail leaving holes in you cant explain.

No parf intended, but this type of thing can be expected in a home brew system. Or, someone can rm * and everything is out the window.

Yes, but she is asking about the recipients.

For instance, you send me an email and then your system gets hosed. I still have my copy of the email.

[island911]

Originally Posted by john70t

I have received threatening emails in the past, breaking laws, but they disappeared before saving.

There is this:
https://www.cnet.com/how-to/this-e-mail-will-self-destruct-heres-how/
Self Deleting Email, How to Send Self Deleting Mail

Interesting.

HRC did make a joke a few month back about how she liked Snap-Chat, as the messages automatically delete themselves. --she's so funny corrupt fun.

Anyway, considering that she had her own server she certainly could have done the URL supported messaging (in your first link) but, clearly, as indicated in daepp's post, her IT guy never set up something so sophisticated.

I expect that she has something like that going now. Her whole team has to have squeezed a few brick on all of their email trail on display. I expect that they may use courier pigeons now. Possibly courier drones.

[HardDrive]

Certified MS Exchange admin here. It would be a non-issue for HRC's staff to make mail disappear from her server. The more disturbing question is who made them disappear from the federal system. There is zero chance that those emails were not archived. Zero chance that they were not on a back up tape at some point.

[stomachmonkey]

Originally Posted by HardDrive

Certified MS Exchange admin here. It would be a non-issue for HRC's staff to make mail disappear from her server. The more disturbing question is who made them disappear from the federal system. There is zero chance that those emails were not archived. Zero chance that they were not on a back up tape at some point.

Or they were never there to begin with.

I know squat about the Feds archiving system but It's unrealistic to think they don't get a ridiculous amount of emails a day.

To find and delete 30k emails spread over years would probably take quite some time.

Time I doubt they had.

It would seem to be like finding 30k needles in a million haystacks.

[RKDinOKC]

Since she was running a private server the users probably had accounts on her server so senders and/or recipients would not have emails from that server on any another servers. Also that way message retention policies could be put in place that would keep the messages on the server and not be allowed to store copies on the client's computer. No off-line retention of messages. These same retention policies can also be used to basically delete all the emails if you so desired.

You can also use retention policies to archive messages without any of the users knowing. Especially deleted emails. Only the top level administrator would know or have access to those archived emails unless the administrator gave access to another user. This is most likely why she had her own servers instead of using a service. A service would have top level access.

Retention and archiving policies are specifically to archive and recover messages to use in litigation. There is no reason why you couldn't use the same retention rules to make the server delete those messages. It just wouldn't be legal if your company was required to have archived messages. Probably why she had a personal server, it would not be required to provide legal access to messages for litigation.

The default install of an exchange server when you delete and email it stays in your deleted items folder for 14 days. Then it deleted from your client and no longer visible in your client. The server marks the message for deletion and holds it for 30 days. After 30 days it deletes it from the message store to save space in the message store/database.

Almost all operating systems now have a secure delete that writes zeros where the files was instead of just marking the space a usable again. There is also hard disk maintenance software that will defragment, or group the currently used files together and write zeros on the unused space.

[stomachmonkey]

Originally Posted by RKDinOKC

Since she was running a private server the users probably had accounts on her server so senders and/or recipients would not have emails from that server on any another servers......

Then...... where would the classified emails in question have come from?

[widebody911]

Originally Posted by stomachmonkey

Then...... where would the classified emails in question have come from?

the Russians uploaded them to WikiLeaks

[jyl]

Theory <> reality sometimes when it comes to document retention.

Once upon a time, the SEC was investigating the company I worked for, relating to communications we had with the management of a company shortly before that company disclosed information that sent its stock tumbling. We were required to produce all internal emails, documents, notes. We retained all such emails, of course, as required by Sarbannes Oxley and other post-Enron Federal law, and we had a whole IT and compliance team making sure of that. So naturally, our IT and compliance and legal people couldn't locate any of those emails. Fortunately I always archived my emails on my laptop, so we were able to produce them.

[HardDrive]

Originally Posted by stomachmonkey

Or they were never there to begin with.

I know squat about the Feds archiving system but It's unrealistic to think they don't get a ridiculous amount of emails a day.

To find and delete 30k emails spread over years would probably take quite some time.

Time I doubt they had.

It would seem to be like finding 30k needles in a million haystacks.

SQL doesn't lie. If its there, its easy to find.

[stomachmonkey]

Originally Posted by HardDrive

SQL doesn't lie. If its there, its easy to find.

Didn't say it was hard.

Just time consuming.

And even that's relative.

10 minutes is an eternity when all you have is 5.

[jyl]

Originally Posted by stomachmonkey

Didn't say it was hard.

Just time consuming.

And even that's relative.

10 minutes is an eternity when all you have is 5.

Maybe some underpaid, overworked sysadmin misplaced tapes or rewrote drives or botched some settings or - my point above is that things aren't always done just because they are supposed to be done.

My impression is, whenever there is an inquiry like this, emails turn up missing, and that is the case for large and small corporations, for government agencies, for past administrations, etc.

I think that, as a general matter, document retention is about as foolproof as cyber-security.

[stomachmonkey]

Originally Posted by jyl

Maybe some underpaid, overworked sysadmin misplaced tapes or rewrote drives or botched some settings or - my point above is that things aren't always done just because they are supposed to be done.

My impression is, whenever there is an inquiry like this, emails turn up missing, and that is the case for large and small corporations, for government agencies, for past administrations, etc.

I think that, as a general matter, document retention is about as foolproof as cyber-security.

True but in this specific situation the thought that a mistake would be so surgically precise as to effectively and efficiently eliminate all traces of specific activity spanning years is simply not realistic.

It would have caused massive data loss. Not something trivial that would or could have gone unnoticed.

Mistakes don't discriminate.

We are left to consider a coordinated intentional act.

Certainly possible but I think also very difficult.

We'd need to know more about the Feds backup infrastructure.

Tape is very efficient for this type of archiving.

You can't delete specific files from a tape archive.

To do so you'd first need to request an index dump of archives to find which tapes contain the data you want.

Then you need to access the physical media. Protocol is not going to let you stroll in and check out a tape or bunch of tapes and take them home like its Blockbuster on a Friday night.

You're going to have to tell them what you want retrieved and they are going to do it for you.

To delete it permanently you'd need to restore the archive to traditional disc media, delete the files then back up the altered source.

And then your time stamps will have a mismatch.

If the Fed is backing up to disc based media it's certainly easier but I'd be willing to bet those discs are also backed up, probably to tape.

Again all of this is certainly possible and doable given enough time which I don't think they had and even if you could pull it off I don't believe you could do it without leaving evidence all over the place.

It just does not seem plausible.

[RKDinOKC]

LOL Tapes...ask Nixon

[jyl]

I haven't paid that much attention to the details of the Clinton email thing. However, some quick searching shows that the 32,000 emails missing were claimed to be personal emails that were deleted, rather that government related emails. If these were in fact personal emails, to friends and family and other people not in the US government, then it would make sense that copies would not be found in the US government email systems. And if copies were in fact not found in those US government email systems, that would be consistent with the missing emails in fact being personal emails.

[sc_rufctr]

Originally Posted by HardDrive

Certified MS Exchange admin here. It would be a non-issue for HRC's staff to make mail disappear from her server. The more disturbing question is who made them disappear from the federal system. There is zero chance that those emails were not archived. Zero chance that they were not on a back up tape at some point.

This... But was Hillary actually backing up her server to tapes?

[Bill Douglas]

Yep, when I was administrator of various email servers a backup was run each night and the tapes kept for a month. The end of week ones were kept for a year and the end of month ones were kept forever. This is fairly normal procedure. So in Hillary's case someone is not telling the truth.

[KFC911]

Without actually knowing the infrastructure and policies of the systems, a lot of you obviously experienced techies and smart guys can only speculate . It all just depends....

I was a systems programmer, systems designer, communications guy before for some large corps that were simply excellent in this type of stuff...they had to be.

Once mined some critical data (a much smaller needle, in a much larger haystack than this). It's potentially doable, but certainly not easy imo...assuming blah, blah, blah