'Delete' Doesn't Mean 'Disappear'

By Rob Pegoraro

Saturday, April 14, 2007; D01

This might not seem obvious when you're struggling to locate the e-mail somebody sent you last week, but it's not easy to make an e-mail message vanish for good. A lot of the time, it's outright impossible.

Some executives at Enron found that out the hard way a few years ago. Some people in the White House -- who seem to have deleted important messages that they shouldn't have -- may be on their way to making the same discovery.

The secret life of e-mail isn't obvious from looking at your mail program. It sensibly simplifies things, presenting a message as a single object you can open, read, and then delete. Once you empty your mail program's trash, no trace of the message remains.

But under normal circumstances, nothing you delete on a computer vanishes immediately. The computer clears its own record of where it put the file, but the file itself won't disappear until enough other data gets written to that same spot. Given the vast size of most new computers' hard drives, that can take years.

The same thing happens with theoretically erased e-mail. Most mail programs don't store each message as its own separate document; instead, they squirrel away all your messages in one database file. When you hit the delete key, your mail program can just update its internal records to mark that message's location as vacant. You could say it conveniently forgets about the e-mail.

You can try specialized software that can overwrite a deleted file to prevent later retrieval -- for example, the Eraser program for Windows and Mac OS X's "Secure Empty Trash" option -- but those products may not work inside an e-mail program's database.

E-mail also leaves a long trail as it hops from computer to computer across the Internet. Most of the copies aren't kept, but at the receiving end, at least two can stick around: one on the mail server that delivers new messages to each user's computer, the other on the user's own machine.

So even if both the sender and recipient strive to make a message disappear, "data forensics" companies can dig it up. Brian Karney, the director of product management for one such firm, Guidance Software of Pasadena, Calif., bragged about how easy it is to unearth a long-buried message from the database file created by Microsoft Outlook -- the software used by many businesses and organizations, including the White House.

"Anybody can recover an e-mail," Karney said. "You just need to know how to look and find that stuff."

Encrypting e-mail -- something most users never bother to do -- can keep the contents of your correspondence secret. But it can't hide other data about the e-mail, such as subject, addresses, dates and times, which can be incriminating on their own.

Just because it's possible to find long-lost e-mails doesn't mean anyone is doing that with yours right now.

Your Internet service provider or Web-mail service, if it wants to stay in business, is not likely to eavesdrop.

And your office's IT department may be too busy to bother. Although a lot of companies say they monitor employee e-mail (55 percent, in a 2005 survey by two trade groups, the American Management Association and the ePolicy Institute), you can bet that most rely on automated software to do the job. It takes an exceptionally paranoid, well-financed business to hire people just to read the mail.

If, however, somebody thinks your correspondence in particular hides a sufficiently sordid secret -- especially if that somebody is a politician or a prosecutor -- all that can change.

So when you compose your e-mail, write carefully and write for posterity. You never know who might read it.

Living with technology, or trying to? E-mail Rob Pegoraro atrobp@washpost.com.