Wiped GCSB files could easily be retrieved, says computer expert

If any organisation can retrieve a deleted video file from a hard drive, the Government Communications Security Bureau should be able to do so.

The latest development in the political storm surrounding Prime Minister John Key and the GCSB involves a mystery video recording which may or may not exist, or may or may not have existed, but which the Labour leader David Shearer says was stored on a number of computers in the bureau but which has been deleted recently. 

For those who have missed the excitement of the last 16 hours, Mr Shearer went on tv last night and said there is a recording of Mr Key addressing GCSB staff in the bureau’s cafeteria in February this year, in which the prime minister makes a joke about Kim Dotcom.

This is an issue because Mr Key has said he had not heard of any GCSB investigation of Kim Dotcom at the time of his visit to the bureau. 

Mr Shearer says he has not sighted or heard the recording himself, but he has been told about it, apparently by his press secretary Fran Mold, whose partner, it was reported by Newstalk ZB this morning, is an ex-GCSB employee.

The bureau’s chief executive Ian Fletcher has since stated there is no such recording: the bureau “has made exhaustive inquiries of its records and its IT systems and can find no audio-visual recording of the prime minister's visit,' Mr Fletcher says.

Mr Shearer was reported this morning claiming the recording had been deleted from the GCSB’s IT systems and that until recently it was on the hard drive of a number of computers in the bureau.

Even if that were the case, though, such a file should be able to be retrieved, says computer expert Brian Eardley-Wilmot.

“A file that was created, say, three years ago and deleted two years ago would probably not be able to be retrieved, because when you delete a file what you do is remove it from the computer’s table of contents, not the file itself,” says Mr Eardley-Wilmot, who is chief executive of Computer Forensics.

“It makes the space occupied by that file available to be over-written by newer files, but does not actually remove it, although over time it is likely to be over-written.

“But if a file was created in -  hypothetically -  February this year, and was then – hypothetically  - deleted in the last seven days, it would be highly likely to be able to be retrieved.”

The Government Communications Security Bureau lists as one of its main roles as “assisting Government departments and agencies to protect their electronic information resources and communications systems.”