This technical note was produced by Shell to Sea to counter the misleading implications about file deletions found in the GSOC July 2011 ‘Interim Report’ into the Corrib cops 'rape tape' incident.  It was published as part of a Shell to Sea response into that report.  GSOC had used language to suggest that the recordings of the incident itself had been interfered with, a suggestion that was picked up and incorrectly reported by many sections of the media as fact.  RTE were later forced to issue an apology for their inaccurate reporting.

Appendix D TECHNICAL NOTES

Corrib Garda rape comments recording of March 31st, 2011
and the Garda Ombudsman investigation into incident
Prepared by Dublin Shell to Sea

The digital video camera on which a Garda sergeant and Gardaí recorded themselves talking about raping a prisoner also contained recordings – made several weeks earlier – of confidential academic research interviews. These older files were deleted before the camera was handed to the Garda Ombudsman (GSOC). GSOC’s Interim Report (July 2011) of its investigation treats the technical information about the deletion of these unrelated files in a deliberately misleading manner. This resulted in journalists mis-reporting the facts of the case. In order to address this, Dublin Shell to Sea is providing technical notes about file deletions and about what appears to have happened in this case.

1. GSOC sent the digital video camera to Forensic Science Northern Ireland (FSNI) to attempt recovery of deleted files. Presumably, FSNI has a high level of technical expertise: even if GSOC was unaware of the technical details of file deletion described below, the report they received from the FSNI lab would have provided this information as background.

2. GSOC’s Interim Report says the video recording of the incident on March 31st was “recovered”. The use of the term “recovered” is highly misleading, since the two video files created on March 31st had not been deleted and so could be viewed by anyone with the camera, without the need for any “recovery” procedure.

3. When a file is “deleted” from a drive, all that happens is that the information about the location of the data sectors on the drive that make up that file is removed. This allows them to be overwritten by a subsequent recording. Such a deletion is easily reversed, so if a secure deletion is required the deletion procedure must not stop at that point. The cheapest procedure for secure deletion is called “wiping” or “shredding”: this involves the data sectors being overwritten with new information. For instance, the United States Department of Defense considers overwriting acceptable for clearing magnetic media within the same security area/zone, but not as a sanitisation method. In the case of a video camera, an acceptable method is to delete the file, then make another video recording to fill the hard drive with new data and then delete that new file that has been created.

4. Our understanding is that in order to overwrite the single file of the unrelated confidential interview that had been made some weeks prior to the March 31st incident, the six additional files referred to in the GSOC report were created. There were six files rather than a single file because of a faulty camera battery, which meant the camera repeatedly shut off after short periods of recording, requiring the battery to be re- charged and recording started again on six successive occasions in order to overwrite the sectors occupied by the original confidential file that had been deleted.

ENDS

This text is from Garda Ombudsman: spin and misinformation

How the Garda Ombudsman blatantly misled the public over the March 2011 Corrib Garda rape comments recording and undermined the women who brought the recording to public attention- Published by Shell to Sea April 5th, 2012

The PDF can be downloaded from the Shell to Sea site