Cyber Expert Finds And Recovers Alleged Deleted Files During Arizona Election Audit In Maricopa County

A cyber expert involved in the Arizona election audit allegedly recovered deleted files pertaining to the Maricopa County election, according to The Western Journal.

The expert, Ben Cotton founded CyFir which is a digital forensics and cyber risk solutions company.

Cotton stated that he found the deleted file directory when he was reviewing the Master File Table.

The Master File Table, MFT, is a “record of all of the directories and the files that are contained in that partition and a pointing — and a pointer to where that data resides on the hard drive.”

Cotton discovered that the “EMSPrimary” [Election Management System] had been deleted.

“In the course of performing that MFT discovery, I discovered a MFT that clearly indicated that the database directory was deleted from that server,” Cotton stated.

Board officials explained that the files showed up as deleted because “the Elections Department shut down the server to be packed up and made ready for delivery to the Senate.”

“At no point was any data deleted when shutting down the server and packing up the equipment.”

— Advertisement —

“Maricopa County provided you the actual Dominion server as commanded by your subpoena and we did not transfer or delete from that server any data from the 2020 General Election that was subject to your subpoena.”

“You have now returned that server to us. Evidently, your ‘auditors’ made a copy of that server and are conducting their analysis on the copy.”

Board officials refused to hand over county routers upon request.

Auditors requested the routers to make sure that the voting tabulators were not connected to the internet during the election.

“You, Senate President Fann, are the only one with the power to immediately end it. We implore you to recognize the obvious truth: your ‘auditors’ are in way over their heads,” they wrote.

“We follow a very strict forensics acquisition process in which we don’t turn on a system if it’s delivered to us in a powered off state” before making a copy of the drive, he said.

Cotton said, “We produced a bit for bit forensics copy of that particular drive.”

From The Western Journal:

A cyber expert working on the Arizona election audit team testified Tuesday that he was able to recover an allegedly deleted directory from the Maricopa County election server.

Ben Cotton — the founder of CyFir, a digital forensics and cyber risk solutions company — told Arizona Senate President Karen Fann and Senate Judiciary Chairman Warren Petersen that he discovered the missing file directory while reviewing the Master File Table.

Additionally, the board refused to turn over county routers that auditors have requested to ensure voting tabulators were not connected to the internet during the election.

The letter cited security concerns about sensitive information contained in the routers getting into the wrong hands.

The board members closed their letter — also signed by Republican Maricopa County Recorder Stephen Richer and Democratic Maricopa County Sheriff Paul Penzone — calling for the audit to cease.

Cotton directly addressed the board’s explanation for the apparently deleted directory being due to the system being shut down before it was delivered to the Senate.


Please enter your comment!
Please enter your name here