Skip to main content
The Globe and Mail
Support Quality Journalism
The Globe and Mail
First Access to Latest
Investment News
Collection of curated
e-books and guides
Inform your decisions via
Globe Investor Tools
per week
for first 24 weeks

Enjoy unlimited digital access
Enjoy Unlimited Digital Access
Get full access to
Just $1.99 per week for the first 24 weeks
Just $1.99 per week for the first 24 weeks
var select={root:".js-sub-pencil",control:".js-sub-pencil-control",open:"o-sub-pencil--open",closed:"o-sub-pencil--closed"},dom={},allowExpand=!0;function pencilInit(o){var e=arguments.length>1&&void 0!==arguments[1]&&arguments[1];select.root=o,dom.root=document.querySelector(select.root),dom.root&&(dom.control=document.querySelector(select.control),dom.control.addEventListener("click",onToggleClicked),setPanelState(e),window.addEventListener("scroll",onWindowScroll),dom.root.removeAttribute("hidden"))}function isPanelOpen(){return dom.root.classList.contains(}function setPanelState(o){dom.root.classList[o?"add":"remove"](,dom.root.classList[o?"remove":"add"](select.closed),dom.control.setAttribute("aria-expanded",o)}function onToggleClicked(){var l=!isPanelOpen();setPanelState(l)}function onWindowScroll(){window.requestAnimationFrame(function() {var l=isPanelOpen(),n=0===(document.body.scrollTop||document.documentElement.scrollTop);n||l||!allowExpand?n&&l&&(allowExpand=!0,setPanelState(!1)):(allowExpand=!1,setPanelState(!0))});}pencilInit(".js-sub-pencil",!1); // via darwin-bg var slideIndex = 0; carousel(); function carousel() { var i; var x = document.getElementsByClassName("subs_valueprop"); for (i = 0; i < x.length; i++) { x[i].style.display = "none"; } slideIndex++; if (slideIndex> x.length) { slideIndex = 1; } x[slideIndex - 1].style.display = "block"; setTimeout(carousel, 2500); }

Mayor Rob Ford speaks briefly to the media at the entrance to his office at City Hall in Toronto on Oct. 31, 2013.


Retrieving the most talked about video in Toronto likely took patience, skill and more than a little blind luck.

On Thursday, Toronto Police Chief Bill Blair revealed that Toronto Police retrieved a hard drive as part of "Project Traveller," a large-scale investigation related to drugs and gangs. On that drive, Chief Blair said, investigators found a video file, the contents of which were consistent with previous media reports that alleged the video showed Toronto Mayor Rob Ford smoking what appears to be a crack pipe.

Chief Blair added that the file had been deleted prior to the seizure of the hard drive, but that police had uncovered it anyway.

Story continues below advertisement

The revelation shines a light on an often overlooked aspect of modern computers – they do an extremely poor job of wiping out information, even when a user wants that information gone.

In almost all cases, a file deleted from an ordinary computer is never truly deleted. Instead, the computer's operating system effectively marks the hard drive space where the file used to reside as free for use, and transfers the data to a kind of low-level garbage dump that is largely inaccessible by regular users.

There, a deleted file might reside in whole or in parts for days, weeks or years – in many ways, the likelihood that a deleted file will still be retrievable at a future date is partially a function of luck. In some cases, the file will be fairly easy to retrieve because it has not been overwritten with new data.

Still, even if the deleted data still exists somewhere on the hard drive, retrieving it in one piece is sometimes exceedingly difficult. In many cases, the file can be split up into myriad parts, forcing an investigator to meticulously search for each piece. That process can take months.

"It's not easy," said Daniel Tobok, President of Digital Wyzdom, a computer forensics firm recently acquired by Telus. "It's like putting together a jigsaw puzzle, especially with audio and video files."

There are ways for security-conscious users to ensure their data is truly impossible (or at least, very difficult) to retrieve. For example, a user can install and run software that not only deletes a file, but overwrites the space where it used to exist with a series of random zeros and ones.

In this case, since the police were able to retrieve the file, it is unlikely the owner of the hard drive took such precautions, Mr. Tobok said.

Story continues below advertisement

But even if a file is not fully deleted, finding it is also made difficult because there are usually no clear pointers to the data. As such, the process of retrieving deleted information is normally almost impossible if the investigator doesn't have a good sense of exactly what that data is.

"It's not easy to find those types of files unless you know what you're looking for," Mr. Tobok said.

Related topics

Report an error Editorial code of conduct
Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to If you want to write a letter to the editor, please forward to
Comments are closed

We have closed comments on this story for legal reasons or for abuse. For more information on our commenting policies and how our community-based moderation works, please read our Community Guidelines and our Terms and Conditions.

To view this site properly, enable cookies in your browser. Read our privacy policy to learn more.
How to enable cookies