In the statewide bureaucracy that governs communications between NJ State government agencies, and the hundreds of local BOE’s (Board of Education) that must comply with state regulations, one thing is sure: a lot of emails get sent back and forth.
That’s why when one NJ BOE was sited for failure to take action by a deadline for a state mandated policy that was allegedly emailed to five of their employees, they contacted NSGi’s Cyber Team to help them.
The BOE said they never got the emails.
Where Do Emails Hide?
After a few days of research, these were NSGI’s findings:
- BOE subscribed to the enterprise version of Gmail, which has unlimited space available to retain data indefinitely.
- NSGI checked all incoming messages on the date the email was reportedly sent and did not locate any such message.
- The rules that governed BOE’s retention policy were set to “indefinitely” with no expiration.
- Based on this rules setting, if a user deletes an email, that message is still located within the eDiscovery and investigative security center of Google Vault.
- Messages can be deleted within Vault by the administrator, but a log is kept identifying these deletions.
- NSGI reviewed that log and determined that no email messages were deleted by the administrator on the date this email was supposedly sent.
- NSGI identified other emails sent by the same state government agency to BOE on various other dates, and all were received without issue.
Gmail keeps a log of all quarantined messages, and upon reviewing this log, the message in question was not identified as being received or quarantined. If BOE’s Gmail did quarantine the message in question, there is a setting within Gmail that sends a message to the sender indicating that their message had been quarantined. NSGI searched and found no outbound alert messages to the sender of the email in question.
NSGI also accessed the BOE’s online archiving solution that works with Gmail to archive all messages, and duplicates of all messages are backed up to this system. After reviewing the backup system, the message in question was still not found.
Conclusions
Based on all the findings of NSGI’s investigation, it was determined that BOE’s Gmail account did not receive the message in question and NSGi wholly supported BOE’s claims that their employees never received this email and had NOT been negligent.
The team at NSGi has deep experience in all matters related to computer, mobile and network investigations as well as general IT services. For more information please contact NSGI today.
