Sample of computer forensics experts dispute how 'message from David Cameron' could have been lost in copying process
Rebekah Brooks's BlackBerry puzzled a number of experts on Friday. Specifically, they couldn't understand how a process that is carried out routinely – creating a copy of all the files on the device, or "imaging" – could have led to any loss of data.
Giving evidence at the Leveson inquiry, Brooks said that at least one message on her News International corporate BlackBerry sent by David Cameron had been "compressed" so that "there's no content in it".
Speaking on Friday morning, the former chief executive of News International had explained that her device was retained by the Metropolitan police, and then returned to the company in July 2011. "It contained, I think, about six weeks of emails and less so of texts, but about a month of texts," she said. "But we had to image [take a copy of] them and we had some problems with that."
"So it's a complete mystery what if anything it might contain?" asked Jay.
"Yes," replied Brooks.
But the mystery to computer forensics experts was what could possibly have gone wrong in imaging the device's files. That is a standard process used when computer equipment and smartphones are seized, in which an exact bit-for-bit copy is made of the contents of any storage on the device.
That allows police and legal teams to consider it in detail, and even to create other digital copies – which by their nature will be a perfect copy of the original – that can then be examined without damaging the original copy that is retained as evidence.
Computer forensics is now a standard course, and smartphone makers offer police and authorised experts tools to make copies of files on their devices. That includes BlackBerrys. One difference about those devices, though, is that emails and other data stored on them is encrypted: it cannot be read directly without access to the user's password, although the administrators of the device – in this case News International – can lock or delete information from BlackBerrys remotely.
Peter Warren, chairman of the Cyber Security Research Institute, who has taken a forensics course, said: "It's very odd … forensics compression technology should treat all messages equally."
http://www.guardian.co.uk/technology/2012/may/11/rebekah-brooks-missing-blackberry-message