Arizona Election Audit: Allegedly Deleted Files in Maricopa County Recovered


A cyber expert working on the Arizona election audit team testified Tuesday that he was able to recover an allegedly deleted directory from the Maricopa County election server.

Ben Cotton — the founder of CyFir, a digital forensics and cyber risk solutions company — told Arizona Senate President Karen Fann and Senate Judiciary Chairman Warren Petersen that he discovered the missing file directory while reviewing the Master File Table.

The MFT, he explained during a special meeting of the state Senate, is a “record of all of the directories and the files that are contained in that partition and a pointing — and a pointer to where that data resides on the hard drive.”

The database directory from the D drive of the machine “EMSPrimary” [Election Management System] had been deleted, he confirmed.

“In the course of performing that MFT discovery, I discovered a MFT that clearly indicated that the database directory was deleted from that server,” Cotton said.

Wealthy Man Allegedly Shoves Woman Off Her Bike, Flees the Scene Leaving Her a Bloody Mess

He then told Fann and Petersen he was able to successfully recover the files.

“All of this, however, may be a moot point because subsequently, I’ve been able to recover all of those deleted files. And I have access to that data,” Cotton said.

In a letter to the Maricopa Board of Supervisors last week, Fann raised the issue of the deleted files.

The board responded with its own letter to Fann on Monday.

The board offered up that the reason the files showed up as deleted is that “the Elections Department shut down the server to be packed up and made ready for delivery to the Senate.”

“At no point was any data deleted when shutting down the server and packing up the equipment.”

Legendary Fox Commentator Dead in Stunning Development - 'He Will Be Greatly Missed'

The officials reiterated, “Maricopa County provided you the actual Dominion server as commanded by your subpoena and we did not transfer or delete from that server any data from the 2020 General Election that was subject to your subpoena.”

“You have now returned that server to us. Evidently, your ‘auditors’ made a copy of that server and are conducting their analysis on the copy,” the letter continued.

Additionally, the board refused to turn over county routers that auditors have requested to ensure voting tabulators were not connected to the internet during the election.

Do you support the Arizona election audit?

The letter cited security concerns about sensitive information contained in the routers getting into the wrong hands.

The board members closed their letter — also signed by Republican Maricopa County Recorder Stephen Richer and Democratic Maricopa County Sheriff Paul Penzone — calling for the audit to cease.

“You, Senate President Fann, are the only one with the power to immediately end it. We implore you to recognize the obvious truth: your ‘auditors’ are in way over their heads,” they wrote.

Cotton directly addressed the board’s explanation for the apparently deleted directory being due to the system being shut down before it was delivered to the Senate.

“We follow a very strict forensics acquisition process in which we don’t turn on a system if it’s delivered to us in a powered off state” before making a copy of the drive, he said.

Cotton added, “We produced a bit for bit forensics copy of that particular drive.”

But on Tuesday, following Cotton’s remarks, the Maricopa County Twitter account appeared to fire back.

“Just want to underscore that AZ Senate’s @ArizonaAudit account accused Maricopa County of deleting files — which would be a crime — then a day after our technical letter explained they were just looking in the wrong place — all of a sudden ‘auditors’ have recovered the files,” the account tweeted.

UPDATE, May 19, 2021: This article has been updated to include a tweet from the Maricopa County Twitter account that appears to push back on Cotton’s remarks. 

Truth and Accuracy

Submit a Correction →

We are committed to truth and accuracy in all of our journalism. Read our editorial standards.

, , , , , , ,
Randy DeSoto has written more than 3,000 articles for The Western Journal since he joined the company in 2015. He is a graduate of West Point and Regent University School of Law. He is the author of the book "We Hold These Truths" and screenwriter of the political documentary "I Want Your Money."
Randy DeSoto is the senior staff writer for The Western Journal. He wrote and was the assistant producer of the documentary film "I Want Your Money" about the perils of Big Government, comparing the presidencies of Ronald Reagan and Barack Obama. Randy is the author of the book "We Hold These Truths," which addresses how leaders have appealed to beliefs found in the Declaration of Independence at defining moments in our nation's history. He has been published in several political sites and newspapers.

Randy graduated from the United States Military Academy at West Point with a BS in political science and Regent University School of Law with a juris doctorate.
Harrisburg, Pennsylvania
Graduated dean's list from West Point
United States Military Academy at West Point, Regent University School of Law
Books Written
We Hold These Truths
Professional Memberships
Virginia and Pennsylvania state bars
Phoenix, Arizona
Languages Spoken
Topics of Expertise
Politics, Entertainment, Faith