FBI Seizes Server Providing Anonymous Remailer Service
sunbird writes "At 16:00 ET on April 18, federal agents seized a server located in a New York colocation facility shared by May First / People Link and Riseup.net. The server was operated by the European Counter Network ("ECN"), the oldest independent internet service provider in Europe. The server was seized as a part of the investigation into bomb threats sent via the Mixmaster anonymous remailer received by the University of Pittsburgh that were previously discussed on Slashdot. As a result of the seizure, hundreds of unrelated people and organizations have been disrupted."
makes it possible to look for deleted or over-written information that might not exist on a duplicated disk.
Deleted stuff is never erased, just marked as "free space" by the OS.
Overwritten data, these days, is unrecoverable, even if only overwritten once. There has not been a single criminal case that I can remember where data was overwritten and then recovered on modern drives. The standard of multiple overwrites for true erasure is from the days when disks were physically huge, and the recorded area was huge, and head alignment wasn't always the greatest thing in the world.
Go read the epilogue to Peter Gutmann's paper
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html
A simple dd of the original drives would have given investigators all the information that was available, including deleted files.
--
BMO