They may be recoverable if an active effort is made to get them. Word is the IG is investigating the ‘loss.’
Computer forensics experts are questioning the supposed loss of five months of text messages between two FBI officials who privately disparaged President Trump before helping investigate his campaign’s possible links to Russia.
Some experts say the messages, sent during a turbulent period between Dec. 14, 2016, to May 17, 2017, may not be gone forever.
The missing messages between Peter Strzok, a senior FBI official, and alleged mistress Lisa Page immediately precede special counsel Robert Mueller’s May 17 appointment to investigate Russia’s role in the 2016 election. Strzok was taken off Mueller’s team in August after discovery of his messages with Page, who previously left Mueller’s team.
“The loss of these text messages is an unbelievable coincidence – literally,” a House Intelligence Committee source told the Washington Examiner.
A one-paragraph official explanation offers little clarity on what happened, and the FBI declined to comment on the physical whereabouts of the couple’s government-issued Samsung Galaxy S5 devices or whether additional forensic recovery steps are being taken.
Some experts say, however, that it may be possible to recover the missing communications.
“A sharp digital forensic expert may still be able to recover them,” said Andrew Ziem, creator of BleachBit, the software that Hillary Clinton subordinates used to clear information from her private server. “In general whenever any software deletes any information, traces are left on the storage device, though they become disorganized like the proverbial needle in the haystack.”
Ziem said that “success requires physical access to at least one of the unlocked devices, and it depends whether the messages were accidentally or intentionally erased, as well as other factors. As the device is used over time, the chances of accidental overwriting become more likely, and because so much time has passed since the critical period in the Strzok-Page case, success is not likely. On the other hand, individual text messages are small, so maybe a few survived.”
Investigators “may be able to recover deleted text messages from the cellphones used by the parties,” agreed Dennis Williams, a partner at Pathway Forensics LLC who worked three decades with the FBI, including as director of the Greater Houston Regional Computer Forensics Laboratory.
Don Vilfer, a former supervisory special agent at the FBI who leads the computer forensics division at VAND Group LLC, said “we often find the messages in other locations such as on a local computer drive as a backup or on cloud storage.”
“If the users were using the Google cloud as a backup, messages could be found there. If the phone had been synced with the FBI desktop computer, or even a home computer, the messages could also be located on those devices. If the old phones are available, forensic exams of those phones could also recover the messages,” Vilfer said. “The particular FBI employees of interest in this case had texted that they would be using an alternative messaging system, iMessage. This is on the Apple platform and would come with similar sources of possible backups—iCloud, their personal iPhone or Macs etc. I suspect that is where some real meat might be as it relates to their discussions.”