Did AZ Auditors Really 'Backtrack' on Claim Files Were Deleted, as AP Reported?
The Associated Press reported Tuesday that the Arizona auditors backtracked on their claim that election files were deleted, but that’s not what was said.
The AP’s headline reads, “Arizona auditors backtrack, say no election data destroyed.”
“The claim of deleted databases was amplified by former President Donald Trump and his supporters, who believe conspiracy theories about election irregularities,” the report said.
Let’s review the facts.
At a special meeting held Tuesday by Arizona state Senate President Karen Fann and Senate Judiciary Chairman Warren Petersen to get an update on the audit of Maricopa County votes in the November general election, Ben Cotton, founder of CyFIR LLC, testified that the files were in fact deleted, but he was able to recover them.
He did not “backtrack” on his assertion that the files were missing.
“In the course of your analysis of the EMS [election management system] server, did you determine that the database directory had been deleted?” Petersen asked.
“I did,” Cotton answered and then offered further background information.
He directly addressed the Maricopa Board of Supervisors’ explanation offered in Monday letter to Fann that the alleged missing directory was due to the system being shut down before it was delivered to the Senate auditors or that the auditors had set the wrong search parameters.
“We follow a very strict forensics acquisition process in which we don’t turn on a system if it’s delivered to us in a powered-off state” before making a copy of the drive, Cotton told Petersen.
He added, “We produce a bit-for-bit forensics copy of that particular drive.”
Firms hired for a partisan audit of the 2020 election results in Arizona’s biggest county say data was not destroyed – reversing earlier allegations. The claim of deleted databases had been amplified by former President Donald Trump and his supporters.https://t.co/9o3bnRFb9Z
— The Associated Press (@AP) May 19, 2021
Cotton recounted that he discovered the missing file directory while reviewing the master file table.
The MFT, he explained, is a “record of all of the directories and the files that are contained in that partition and a pointing — and a pointer to where that data resides on the hard drive.”
The database directory from the D drive of the machine “EMSPrimary” had been deleted, he confirmed.
“In the course of performing that MFT discovery, I discovered a MFT that clearly indicated that the database directory was deleted from that server,” Cotton said.
He then told Petersen he was able to successfully recover the files.
“All of this, however, may be a moot point because subsequently, I’ve been able to recover all of those deleted files, and I have access to that data,” Cotton said.
Petersen followed up by asking whether the cyberexpert had everything he needed.
“I have the information that I need from the recovery efforts of the data,” Cotton said.
That one sentence was the only portion of Cotton’s testimony the AP story contained.
When one watches the entire exchange, it is clear Cotton did not “backtrack.”
The AP might have relied on a tweet from the Arizona audit’s account last week that said the files were deleted, which amounted to a “spoliation of evidence.”
In other words, the news organization characterized that phrasing to mean the auditors were saying the files were completely destroyed.
Breaking Update: Maricopa County deleted a directory full of election databases from the 2020 election cycle days before the election equipment was delivered to the audit. This is spoliation of evidence! pic.twitter.com/mY0fmmFXAm
— Maricopa Arizona Audit (@ArizonaAudit) May 13, 2021
Whether the auditors were able to recover the files or not, it still would be tampering with or spoiling the evidence if the files were in fact deleted.
Maricopa County suggested in a tweet following Cotton’s testimony that the files were neither deleted nor recovered, but the auditors were “looking in the wrong place.”
Just want to underscore that AZ Senate’s @ArizonaAudit account accused Maricopa County of deleting files- which would be a crime- then a day after our technical letter explained they were just looking in the wrong place- all of a sudden “auditors” have recovered the files. ?
— Maricopa County (@maricopacounty) May 18, 2021
According to an Arizona Daily Independent report in March, Cotton and his firm have significant experience and skills in cyber investigations.
He “discovered the Office of Personnel Management breach in 2015. CyFIR was also instrumental in the largest individual bank fraud investigation in the history of the IMF [International Monetary Fund].”
So CyFIR is not a small-town player.
In a Wednesday statement, Cotton reiterated the databases directory “WAS deleted” and said his team was “performing data continuity checks to ensure that the recovered databases are usable.”
2/2) I was able to recover the deleted databases through forensic data recovery processes. We are performing data continuity checks to ensure that the recovered databases are usable.
— Maricopa Arizona Audit (@ArizonaAudit) May 19, 2021
Petersen tweeted in response to Cotton’s statement the “media got it way wrong” regarding their coverage of his testimony.
Auditor has released a statement today. The media got it way wrong. It’s too bad some media fall over themselves to falsely discredit the audit. There are so many important questions that need answers. #AzAudit
— Warren Petersen (@votewarren) May 19, 2021
The AP story — like much of the coverage of the Arizona audit from the establishment media — was negative.
It’s reminiscent of the coverage former President Donald Trump received during his entire four years in office.
The AP should report it straight. The auditors did not back down from the assertion that files were deleted, and it’s just playing word games to say they did.
Truth and Accuracy
We are committed to truth and accuracy in all of our journalism. Read our editorial standards.
