Arizona Election Audit: Allegedly Deleted Files in Maricopa County Recovered

A cyber expert working on the Arizona election audit team testified Tuesday that he was able to recover an allegedly deleted directory from the Maricopa County election server.

Ben Cotton — the founder of CyFir, a digital forensics and cyber risk solutions company — told Arizona Senate President Karen Fann and Senate Judiciary Chairman Warren Petersen that he discovered the missing file directory while reviewing the Master File Table.

The MFT, he explained during a special meeting of the state Senate, is a “record of all of the directories and the files that are contained in that partition and a pointing — and a pointer to where that data resides on the hard drive.”

The database directory from the D drive of the machine “EMSPrimary” had been deleted, he confirmed.

“In the course of performing that MFT discovery, I discovered a MFT that clearly indicated that the database directory was deleted from that server,” Cotton said.

He then told Fann and Petersen he was able to successfully recover the files.

“All of this, however, may be a moot point because subsequently, I’ve been able to recover all of those deleted files. And I have access to that data,” Cotton said.

In a letter