#Leveson : #Brooks & #McCann Have A Habit Of Deleting Messages.

Sample of computer forensics experts dispute how 'message from David Cameron' could have been lost in copying process

• 

Computer experts are puzzled how Rebekah Brooks's messages could have been deleted in the copying process, as she testified at the Leveson inquiry. Photograph: Amer Hilabi/AFP/Getty Images

MCCANNS deleted  their Mobile Phone messages around the time they claimed Madeleine was ' abducted'

http://www.mccannpjfiles.co.uk/PJ/DELETED_CALLS.htm

Rebekah Brooks's BlackBerry puzzled a number of experts on Friday. Specifically, they couldn't understand how a process that is carried out routinely – creating a copy of all the files on the device, or "imaging" – could have led to any loss of data.

Giving evidence at the Leveson inquiry, Brooks said that at least one message on her News International corporate BlackBerry sent by David Cameron had been "compressed" so that "there's no content in it".

Speaking on Friday morning, the former chief executive of News International had explained that her device was retained by the Metropolitan police, and then returned to the company in July 2011. "It contained, I think, about six weeks of emails and less so of texts, but about a month of texts," she said. "But we had to image [take a copy of] them and we had some problems with that."

Asked by Robert Jay QC, counsel to the inquiry, whether there were any emails or texts from Cameron or George Osborne on the device when she left News International, she replied: "No. Although when we got the image back, there was one from Mr Cameron that was compressed, so [it was] in June, but there's no content in it."

"So it's a complete mystery what if anything it might contain?" asked Jay.

"Yes," replied Brooks.

But the mystery to computer forensics experts was what could possibly have gone wrong in imaging the device's files. That is a standard process used when computer equipment and smartphones are seized, in which an exact bit-for-bit copy is made of the contents of any storage on the device.

That allows police and legal teams to consider it in detail, and even to create other digital copies – which by their nature will be a perfect copy of the original – that can then be examined without damaging the original copy that is retained as evidence.

Computer forensics is now a standard course, and smartphone makers offer police and authorised experts tools to make copies of files on their devices. That includes BlackBerrys. One difference about those devices, though, is that emails and other data stored on them is encrypted: it cannot be read directly without access to the user's password, although the administrators of the device – in this case News International – can lock or delete information from BlackBerrys remotely.

A former engineer at BlackBerry-maker RIM said: "RIM has tools that allow you to look inside the [device's] filestore but obviously everything is encrypted so you can't see what's in it. However, the imaging process is – as I said – a copy process. It makes no changes to the device."

Peter Warren, chairman of the Cyber Security Research Institute, who has taken a forensics course, said: "It's very odd … forensics compression technology should treat all messages equally."

He pointed out that if News International's or Brooks's legal team wanted a copy of the BlackBerry, "the simplest way to have done that would have been with BlackBerry Desktop manager [software, provided free by RIM] which would not have compressed the messages at all and would have given you reasonably [legally] admissible copy due to the protection that BlackBerry encryption gives you".

http://www.guardian.co.uk/technology/2012/may/11/rebekah-brooks-missing-blackberry-message