Skip to content

Get Judicial Watch Updates!


Judicial Watch • JW v IRS TIGTA Written Testimony 00596

JW v IRS TIGTA Written Testimony 00596

JW v IRS TIGTA Written Testimony 00596

Page 1: JW v IRS TIGTA Written Testimony 00596


Number of Pages:4

Date Created:April 18, 2017

Date Uploaded to the Library:April 18, 2017

Tags:drives, Lerners, servers, tapes, 00596, written, backup, Server, exchange, tigta, testimony, process, senate, Lerner, Congress, IRS

File Scanned for Malware

Donate now to keep these documents public!

See Generated Text   ∨

Autogenerated text from PDF

Recovery err-arts ortcrrner tRs emptoyee Lcrs Lerner
Feh-uary P015
Charrrnan Chartetz, Ranhrng Membev Cummtngs, and members otthe committee. oeen requested cone here todaytc orcvrde update agencys ons
thus far smplmg recover the mrssrhg eameils ottormer IRS emptcyee ,cre
Lerner June13,2014, tetter the Senate Frnance Commttee, the reported that was comptotrhg its document production tor Congress cencernrng anegatrcns that the
IRS targeted cenarn 501c(4)opptrcants, Ihc tRs rea rzec that the pcductren the
maits Luis Lemer, the tormer director the Exempt Organrzattur-s dtursron, Had
gaps the 5mm! predueren tRs repcned that attempts hurt mtsstng
matrs, they rearrzeo that June 2011, Letne; IRS taptoo computer suffered hard
rtrrrre crash, and theretcre some her ermatts ooutd not recovered
The tottowrng Monday, June16,2014,TGTRmmated Invesltgattm rrrtc the
circumstances surroundrng the mresrng mails and the hard onue crash One week
tater, June 23, 2014, TtGTA recerved tattertrorn Cherrman Ron Wyoen and
then Rankmg Memosr Orrrrr Hutch cttne Senate Ftnance Committee, :rat requested
TIGTA termatty tnuestigate the matter rnctudrrrg perform rts own anatysrs whether
any data can satvageu and pcouoed the committee
The ctrcumstanms snrrouhorhg the loss data, the hard dnve crash art! the manner
wnich the IRS hanoted rte ezactronrc medra, are atrt unde- rnuestrgatron, however,
have oerrcdrcath updated certarn Comrnrttees Congress 106thth this uemrnrttee,
ocnoerning our progress recoverrrg the emails, out heue net drscussed the
tnvestrgatton rtsett
There are two parts ofrry mrssrer here One part attempting recouerthe eamatts
and second part tnvesttgale the ctrcumslarces surroundtng the mtesmg emarr
Untit the inucstrgatrcn comptet the taets and cmumstances understand
them can and have changed carty hasrs eucrd speculahng and reachrng
conclusions that ZerlUm out hetalse, investigators mtlstavald drawing any
conclusions until all the lacts are owe the Amelcan people ensure that
continue thoroughly an: lmpatlally investigate this mat ergamelv the tacts
and evrrierioe order get the. truth That said, thlsi lrna cannot provide any
iniorrnation the lnveslgaliorl sunoundirio the lRSs loss otdata and hard drive
crashes that :0qu negatively impact our aollity complete the livestlgahon well raise aueslioris into the integrity the investigailve process, but this time Will
provide ogress report our ellarls recover missing small;
The manages ernail tor its 91,030 ernp pvees retiring the through
Microsett Exchange Servers that are packed periodica rig backup tapes
These Microsoti Exchange Servers, also reterred earl-ail servers, are comprised
hundreds hard drives thatarc placcd irita server racks until Mai, 2011,11e eemall
senrerthat handled Lois Lerner email tretllo was located the New Carrollton,
Maryland Faderal Building Durino zotl, the migrated from the e-mall server the
New Carrolltun new Bamall server located the Malzinsbug, WestVlglnle
Computing Center Atierthe migrated its eemall system lvlad-nsburg the me.
tunied of! the Erma server New Carrolltol however, was latt place, possibly precammnary measure should the new e-rria server ivlartinstiurg lail
employees reporiec that the New Carmlllol email server hard drives were removed
troni the senrer, erased and destroyed
or. June 30, TlGTA demanded thatihe plovide all backup taoes used
backup Lerners e-mail account, specitically all haukuu tapes used lar emails
dulillg the tinia period ofJal 2095 (hrougl Dec 3t, 2011. These date ranges were
selected ensure that rained ary overlap emails accounted tor mld-yeal
equlpmem changes. result Dths cemarld, Drl July 2014, the ldentl the pacttup tapes that rnet this cmenan and TlcTAiaok pcssessien otall the
identitred 744 hankun tapes
with regard nine the 744 backup tapes hasec how they were ooniigured the
backup rrachine, the was unable deierrnine ihe dates they were used Because
this, IRS lechnicians helieved lives possible the nine tapes had been untouched tor
years and thus could contain clear data relevant the irvestigation EecaJse TIGTl-t
dic not have the unique necessary hardware, these rims tapes were provided the
Federal Btlleau lnvestlgatlol order determine the times Camamed any dais
and they did, retrieve Alterihe analerd the nine tapes and validated their
equipment reviewing other ndam backup tapes, they reported their equipment was
tunciionihg propsw and they rcportcd the ripe tapes were blank TlGTAthen provided
those same nine tapes recognized industry lead? eleclrmlc data recovery, and
they cohilrrned the nine tapes were tact blank
Arier coriirrning the irnial nine tapes were plank and tearing the: the remaining 735
tapes were overwritten Titre interviewed the IRS Serra?! expert and identitied the
specitic barkup tapes that watlld have cmlalned the earliest copies oil are ,erner
mail box The backup tapes cons sted sets attaces These baekup sets
were created sequeehal weeks lrcm Novembcrzo, 202 through December 25,
2012, Theiive backup sets were expected produce totat ciiive separae Copies
Leis Lernet eemail ccxes, one ccpytcr each week the hachap hand carried three the iive sets t~ese backup tapes the industry exeen tor
data recovery aric extraction and attertheir examination and Extraction atda they
plcvided TIGTA With Exehange Database tiies trcrn this set dftapcs November tai
2014, TIGTA searched the database rites and identified the frst Lois Lernereemai! box
This maiibox contaned _cis Lertet e-rriaiis date back tar 2001 The resuit
this ehait vaiidated that the tapes have not been ever written am: that they ccrtained
mails that are reievani the red tested time range search tar eemails TiGTA then
processed the remaining sets backup tapes the same manner tater hurting that
each backup sets ccrtarned cne Lerner e-inai boxy tar tctat athve
mailboxes exactiy expected the canciusicn cflie process ttm identitied
79,840 Leis Lernorcemais which aimast percent weie dupticetes Remaving the
duplicates resutted 32774 Lois Lerner unique eervails criticatiy imacnanttn rate
that these 32,774 eemais need ccmparcd Wif the eemaits and documents the
has aiready produced Congress crdertc ceteimiie itthere are any newiyidcntificd
eernaiis Cunentty, are tinaizzmg the ptochemeiil atsattware accernciish this
match noted eariier ~estirncry, the iRs eema systs rcutes e-rnait messages
through email severe that camarised hundreds hard drives tiust cemcieted
testirricny about the status our examination baciup tapes .dciated With the
rnaii system and new want discuss the status the hard drives that were the
rnaii serverin May 20th one rnanth pricrta when Leis Lerncrs iaptop hard crive
crashed Juiy 11,2014,TIGTA disccvered :ratthe 1am drives tram the decairihissibned
New Carroiilon aemait servervvere not destrcyed premcusiy repcrted the IRS
the same day TIGTA secured the 750 hard dnves hat are teved aart the aid
New oarrbiiton ineit server TIGTA conducted areiiminary examination die timtett
sctccticn atthe hard dnves and dctcrhined :hat based iniarrnation that cautd
seen from these hard drives :nese drives more than iikeiy horn the emaii server
that processed Lcis Lernei emails zutt and prime Important note lhathc
maii servers process and keep copies e-inaii trattic the hundreds that are
spsclficaily positioned server acts The IRS did riot retain ecord ctthe taycut
indicating where each the speci hard dnves was ccsiticned the racks, without
understanding the exact arder which the rard drives vvere piaced the server racks
nding any ccmpiete and reievant e-rnaite wDuld very and iabci inEnStVe,
ndt trnpdssibie addition itary afrc hard drives are damaged cauid pd-entiaiiy
impossibietc recoverany usaate made rccantty dclcrm hed tha are unable anything tut-,rervvith the hard drives and have initiated the process contrary
rai eii initiai reasibiiity ariaiysis ofthe 760 hard drives the recognized naustry exhe etectronic data recave ess than tvvd weeks ago iearned that there may rave heeh bacKup tapes nicer
than the briginai 744 backup tapes an-eined .tu 2914 have taken
passessian additicnat 424 tape: and are the stag understaiaing
they have been erased and any loese otdertapes centam eamat ordata rmerest the rnvesugauan summary date have wound 32174 umque sma that were backed
Lots Lerners eman box are the pvocess camparrng these armatls what the has atready produced Congress determrne fact recover any new
mens- are etsu lhe process having the eama server nerd drwes analyzed
detennine there are any readabie e-rnans hai recovered from these hard
drives And natty are eontrnumg delemme there are ary otner sources met
may confam Luls Lerner Bamatls noted earner, tnis ongcmg invcslvgation ard have prov ded the infarmatron
that berieye wru not hindsr cur ablhly eontrnue rnvesxigetvnn while simukaneously
pmwdmg Cmgress with the progress the Erma saaren
Thank you