IRS: Bad Sectors or Bad Intentions?

obama_open_governmentIn my previous article, I mentioned that all the attention paid to the details of Lois Lerner’s hard drive crash was just a red herring. I believe that the IRS attempting to use the hard drive crash excuse is simply the least important link in the chain of a comprehensive “innocence by incompetence” campaign. However, as weak of an excuse as it is for the IRS, the technical details of Lois Lerner’s hard drive could actually could end up being a smoking gun if we investigate far enough.

As I mentioned in my last article, I’ve seen more than my fair share of hard drive failures in the course of my 20 year professional career. I am very familiar with the functioning of hard drives, both in their mechanical and digital operations. So allow me to offer a quick primer on hard drive failure.

Any hard drive failure is commonly referred to as a hard drive “crash”. Technically the term “crash” has a very specific meaning in reference to hard drives – a head crash, if you care to know – but non-technical people may use the term “crash” to refer to any number of hard drive problems. Usually most people will say a hard drive crashed if the failure prevents data being read from the drive by normal methods and/or the computer will no longer boot from that drive. However, there are many less serious problems that could seem like a hard drive “crash” to non-technical users and restoring the drive to normal operation in those cases would not be difficult for a technology professional. More serious failures involve problems with the physical drive mechanism and may require the drive be sent to a data recovery specialist or forensic lab with highly sophisticated equipment to retrieve data.

In my experience, hard drive failures are unfortunately far too common. I have no problem believing that a hard drive crash could have befallen the computer used by Lois Lerner. Sure the timing seems questionable, but from a purely technical standpoint, this isn’t the smoking gun by itself. We must begin by questioning the specifics of the actual drive failure. Was it an actual head crash or a less serious glitch? Unfortunately the IRS has reported that the hard drive in question has already been recycled so no further attempts at recovery can be made, nor can the true cause of the hard drive failure be verified. All we know is that an e-mail from an IT manager to Lois Lerner in August 2011 said, “The sectors on the hard drive were bad which made your data unrecoverable.”

At this point I don’t believe the technical diagnosis of the hard drive failure nor the details of the recovery efforts made by the IRS IT department have been made public. These details need to be uncovered because if we know the diagnosis of the failure of the hard drive, we can begin to understand if the drive and data on it was intentionally destroyed. Alternately, we can also begin to deduce if the IRS IT department was using proper procedures during the recovery attempt and if there was any intentional wrongdoing within the IT department – or simply further incompetence.

According to the e-mail trail provided after Lerner’s hard drive failed, the data on the drive was deemed so important that the IRS IT department even went to the unusual lengths of sending the hard drive to their criminal investigation division’s forensic lab so they could attempt data recovery. A forensic lab often is able to piece together some data from a failed drive even if all the data on a drive is not recoverable. For a forensic lab to not be able to recover any data at all is highly unusual. This indicates that either the drive was wiped clean using advanced data deletion technology or it suffered extreme damage. Extreme damage is a rare occurrence for normal hard drive failures. Because the drive was sent to a criminal forensic lab, in theory the forensic specialists should have been able to tell if the hard drive was intentionally damaged or if there was anything unusual about the condition of the drive.

Lerner’s hard drive was reported as crashed on June 13, 2011. It wasn’t sent to the forensic lab until August 5, 2011. That’s a long time. Talk to any technology professional who is competent in data recovery and they will tell you the longer a failed drive is running in an attempt to recover data, the more damage that can be done. What was the IRS IT department doing that it took two months before they determined the drive was so bad it needed a data recovery lab? Especially if it was later determined that the “sectors on the hard drive were bad”. That type of failure should have been fairly obvious early on. Regardless, “bad sectors” do not take out all the data on a hard drive unless virtually the entire drive was damaged. In theory it could be possible that the efforts over two months by the IRS IT department could have damaged the drive beyond the point of data recovery even by a forensic lab. That would be a fairly inexcusable case of incompetence – or an intentional effort to scrub data from the drive. Either way it’s not a show of good faith on the IRS’s part.

Bottom line, there appears to be a chain of IT employees at the IRS that had access to the hard drive at any point in time, as well as “HP experts” and forensic specialists at the IRS’s criminal investigation division. If there is in fact a cover-up, the weak link in the chain may very well be any one of these IT people. Assuming they are not as politically motivated as IRS officials, it may be possible to get expert testimony from any one or more of the IT people that worked with and examined Lois Lerner’s hard drive that would conclude the drive had been tampered with or intentionally damaged. At the very least, we could find out why no data could be retrieved at all.

My hope is that if Lois Lerner’s hard drive is a smoking gun, one of the IT people involved will be brave enough to testify to this. The world could use another Edward Snowden right about now.