These Are the Forensic Tests the FBI Is Running on Hillary Clinton’s Server

An expert explains how the agency may be trying to resurrect her emails.

El Nuevo Dia, Andre Kang/Zuma, iStock

Fight disinformation: Sign up for the free Mother Jones Daily newsletter and follow the news that matters.


Last week, Hillary Clinton finally apologized for using a private email server when she was secretary of state. That server is now in the hands of the FBI, but it took a while to get there. In December, the Clinton camp provided 30,000 or so work-related emails to the State Department after it deleted more than 31,000 emails from the server that it considered personal. In March, while declining to give a congressional committee access to the server, Clinton’s lawyer David Kendall said the emails stored on it had been permanently erased, or “wiped.” But weeks ago, with the email controversy showing no signs of subsiding, Clinton handed over the server to the FBI. The Washington Post reported Saturday that Platte River Networks, the Denver-based company that has managed Clinton’s email system since 2013, had no record of the server being “wiped.” So this could mean the FBI will be able to recover emails that the Clinton crew deleted—and that the bureau will be able to review all the emails and documents on the server to determine if materials, possibly including classified information, were handled properly.

The State Department is currently processing the 30,000 work-related emails Clinton returned to Foggy Bottom, and it is releasing monthly batches of these documents. But the full extent of what was on her private server remains unknown and is now a matter for the FBI to determine. We asked Jon Berryhill, a computer forensics expert and a former US Air Force investigator, to help explain how the FBI might try to resurrect the deleted contents of Clinton’s email server and what challenges the investigators might face. Here are some answers:

The FBI now has Clinton’s email server. What are they doing with it? “When handling any piece of any digital evidence, the first thing is to make what’s called a ‘forensic image copy’ of it, an exact working duplicate, so you’re not messing with the original,” Berryhill says. Once the copy is made, an analyst can quickly determine if there’s any recoverable material by looking at the computer data, which is built on a system of ones and zeros. If a preliminary look reveals nothing other than a trillion zeros, an investigator can quickly conclude there is no data to resurrect. Berryhill notes it should only take a couple of minutes to figure out if there is recoverable information on the server or if the server was purposefully wiped out.

After copying the server’s contents and taking a first look, what is the FBI’s next move? “The first thing I’d want to do is to go knock on the door of whoever it was who set the thing up,” Berryhill says. During the course of “a nice long conversation,” Berryhill says he would try to find out when the server was set up and how it was organized. He would look at the machine to confirm what he was told. Then he would be ready to see if “there’s stuff there that’s recoverable or not.” But Bryan Pagliano, the State Department staffer hired by Clinton to set up this server, has refused to talk with the FBI. “It’s an inconvenience,” Berryhill says. “A lot of times interviews like that are for background purposes, they’ll speed up the work, tell you where to look, where to start.” 

It’s been said that the server was “wiped.” What does that mean? Wiping a computer drive makes files unrecoverable by deleting them and then overwriting the space the files once occupied. Most people assume that wiping is the same as deleting all the files, Berryhill says, “but on the technical side, certainly on the forensic side, wiping is a very specific thing.” It depends on the process that was used. Sometimes the wiping is selective, he explains, “so there may be other copies elsewhere on that drive that they didn’t realize were there.”

Consider what happens to emails. After you email a document, the recipient can do several things once they open it: print the document, forward it to somebody else, save it to the documents folder on the computer, or delete it. As the sender, you can do the same things. Consequently, traces of the document—or even all of it—can remain on the email server, in the documents folder, in the printer’s temporary cache file, or in the sent email folder. “So it gets pretty complicated for people when they start trying to selectively wipe things,” Berryhill says.

Berryhill says he has been able to recover material that was deleted years earlier and, on the other hand, has been unable to access files that were on a computer that very morning. An investigator is most likely to recover material when the server is not heavily used and has a large hard drive. With a heavily used machine that has a very full hard drive, material will get lost and be overwritten much more quickly, and the chances of recovering it are less likely.

The latest news is that the server may not have been wiped, so does that mean the FBI can resurrect everything? Assuming the server was not wiped, computer forensics specialists might be able to recover all the emails—the work-related and the personal emails—that were once on the server. But this depends on the type of email system that was used, how it was maintained, and how the files were deleted. If a conventional email program was used, it might be possible to find all the emails in one big file. “If that file doesn’t exist, you can try to reconstitute it,” Berryhill says. “But it’s very, very difficult to reconstitute the whole thing because you’ve got a very big file, and the chances of recovering all of it are pretty slim—unless it was just deleted and nothing else has happened on the machine.”

Additionally, investigators could find an address book or contact list, and the header information attached to each email, which would include significant data, such as the sender, recipient, the time, and the date. “You could find evidence of attachments by name, and, depending on what you recover, you maybe be able to recover the attachments too,” Berryhill notes, adding that certain types of attachments—pictures, for example—are easier to recover. A crucial variable is whether the server was configured to have redundant drives. (In case one drive failed, others would still function.) Then pieces of these files could exist in many different places.

There are reports that the FBI is trying to figure out if foreign powers or hackers accessed the server. Will that be obvious? Given all the ways people can access computer systems, the FBI might find some evidence of this, but not necessarily. “A lot of that is going to depend on how the machine was configured, mostly in terms of the logs that it kept,” Berryhill says. He compares the process to keeping track of who attempts to get into your house. If you have good logs, then you can see who has tried to gain entry.

How long could the whole process take? Within a couple of hours, Berryhill says, “the analyst is going to have a good feel for the kinds of things that are there and what’s possible.” If there is information to pull from the machine, investigators will likely use automated tools to comb through the system, grab files and piece them together, but this could take weeks. “The time line of something like this gets drawn out usually because of other things and other people,” Berryhill says.” “If you put it on paper, you could have millions of pages out of a process like that.” Given that this involves lawyers, the FBI, the State Department, and a host of intelligence agencies, he adds, “it’s going to be really messy.”

WE'LL BE BLUNT

It is astonishingly hard keeping a newsroom afloat these days, and we need to raise $253,000 in online donations quickly, by October 7.

The short of it: Last year, we had to cut $1 million from our budget so we could have any chance of breaking even by the time our fiscal year ended in June. And despite a huge rally from so many of you leading up to the deadline, we still came up a bit short on the whole. We can’t let that happen again. We have no wiggle room to begin with, and now we have a hole to dig out of.

Readers also told us to just give it to you straight when we need to ask for your support, and seeing how matter-of-factly explaining our inner workings, our challenges and finances, can bring more of you in has been a real silver lining. So our online membership lead, Brian, lays it all out for you in his personal, insider account (that literally puts his skin in the game!) of how urgent things are right now.

The upshot: Being able to rally $253,000 in donations over these next few weeks is vitally important simply because it is the number that keeps us right on track, helping make sure we don't end up with a bigger gap than can be filled again, helping us avoid any significant (and knowable) cash-flow crunches for now. We used to be more nonchalant about coming up short this time of year, thinking we can make it by the time June rolls around. Not anymore.

Because the in-depth journalism on underreported beats and unique perspectives on the daily news you turn to Mother Jones for is only possible because readers fund us. Corporations and powerful people with deep pockets will never sustain the type of journalism we exist to do. The only investors who won’t let independent, investigative journalism down are the people who actually care about its future—you.

And we need readers to show up for us big time—again.

Getting just 10 percent of the people who care enough about our work to be reading this blurb to part with a few bucks would be utterly transformative for us, and that's very much what we need to keep charging hard in this financially uncertain, high-stakes year.

If you can right now, please support the journalism you get from Mother Jones with a donation at whatever amount works for you. And please do it now, before you move on to whatever you're about to do next and think maybe you'll get to it later, because every gift matters and we really need to see a strong response if we're going to raise the $253,000 we need in less than three weeks.

payment methods

WE'LL BE BLUNT

It is astonishingly hard keeping a newsroom afloat these days, and we need to raise $253,000 in online donations quickly, by October 7.

The short of it: Last year, we had to cut $1 million from our budget so we could have any chance of breaking even by the time our fiscal year ended in June. And despite a huge rally from so many of you leading up to the deadline, we still came up a bit short on the whole. We can’t let that happen again. We have no wiggle room to begin with, and now we have a hole to dig out of.

Readers also told us to just give it to you straight when we need to ask for your support, and seeing how matter-of-factly explaining our inner workings, our challenges and finances, can bring more of you in has been a real silver lining. So our online membership lead, Brian, lays it all out for you in his personal, insider account (that literally puts his skin in the game!) of how urgent things are right now.

The upshot: Being able to rally $253,000 in donations over these next few weeks is vitally important simply because it is the number that keeps us right on track, helping make sure we don't end up with a bigger gap than can be filled again, helping us avoid any significant (and knowable) cash-flow crunches for now. We used to be more nonchalant about coming up short this time of year, thinking we can make it by the time June rolls around. Not anymore.

Because the in-depth journalism on underreported beats and unique perspectives on the daily news you turn to Mother Jones for is only possible because readers fund us. Corporations and powerful people with deep pockets will never sustain the type of journalism we exist to do. The only investors who won’t let independent, investigative journalism down are the people who actually care about its future—you.

And we need readers to show up for us big time—again.

Getting just 10 percent of the people who care enough about our work to be reading this blurb to part with a few bucks would be utterly transformative for us, and that's very much what we need to keep charging hard in this financially uncertain, high-stakes year.

If you can right now, please support the journalism you get from Mother Jones with a donation at whatever amount works for you. And please do it now, before you move on to whatever you're about to do next and think maybe you'll get to it later, because every gift matters and we really need to see a strong response if we're going to raise the $253,000 we need in less than three weeks.

payment methods

We Recommend

Latest

Sign up for our free newsletter

Subscribe to the Mother Jones Daily to have our top stories delivered directly to your inbox.

Get our award-winning magazine

Save big on a full year of investigations, ideas, and insights.

Subscribe

Support our journalism

Help Mother Jones' reporters dig deep with a tax-deductible donation.

Donate