150,000 Police Records Accidentally Deleted

[tinfoilhat 11]

On 16/01/2021 at 15:20, RollingJ said:

I still find it VERY hard to believe there are no back-up files available .

If there had been backups, it wouldn't be an issue.

 

The cynic in me thinks they wanted maybe 50 files to disappear, and they've hidden that in a mass deletion.

[Baron99 772]

I remember reading ages ago, that even if something has been deleted, the data can still remain on the  hard drive.  You'd have to physically smash a hard drive, (or server), to erase the data.   I'd be very surprised if all the data has been lost? 

 

Plus many large organisations now save data to 'The Cloud' for additional security. 

Edited January 17, 2021 by Baron99

[RollingJ 1,974]

17 minutes ago, tinfoilhat said:

If there had been backups, it wouldn't be an issue.

 

The cynic in me thinks they wanted maybe 50 files to disappear, and they've hidden that in a mass deletion.

Your cynic may be correct, although I'm not convinced, but I still can't believe there wasn't at least one back-up. Even small organisations who use electronic data storage have a recovery option, and I don't think you could call the police a small organisation.

 

I think there is more (or less) to this story than we are being told.

1 minute ago, Baron99 said:

I remember reading ages ago, that even if something has been deleted, the data can still remain on the  hard drive.  You'd have to physically smash a hard drive to erase the data.   I'd be very surprised if all the data has been lost? 

Exactly, and they are going to do that, are they?

[andyofborg 11]

55 minutes ago, tinfoilhat said:

If there had been backups, it wouldn't be an issue.

not necessarily. It depends how things are backed up.  The lost files in the backups are likely mixed up with thousands of other files which aren't lost, separating and restoring these is not likely to be a trivial task.

 

Restoring the whole lot, even stuff not deleted, is not likely to be easy either since that would take everything back to say last wednesday, and you would then need to try and merge back in anything added since.  

 

it may also be possible that the backups just didn't work for some reason, it happens. anyone in the data storage business will have encountered the backup that didn't. 

 

 

55 minutes ago, tinfoilhat said:

The cynic in me thinks they wanted maybe 50 files to disappear, and they've hidden that in a mass deletion.

now you are just being paranoid 

[altus 533]

58 minutes ago, Baron99 said:

I remember reading ages ago, that even if something has been deleted, the data can still remain on the  hard drive.  You'd have to physically smash a hard drive, (or server), to erase the data.   I'd be very surprised if all the data has been lost? 

 

Plus many large organisations now save data to 'The Cloud' for additional security. 

They won't have been files on a disc, they'll have been records in a continually updated database. Even if the disc sectors holding the data haven't been reused, finding out which sectors are part of what record is likely impossible.

 

That said, they should have backups and, since it's a database, perhaps transaction logs too.

[tinfoilhat 11]

26 minutes ago, andyofborg said:

not necessarily. It depends how things are backed up.  The lost files in the backups are likely mixed up with thousands of other files which aren't lost, separating and restoring these is not likely to be a trivial task.

 

Restoring the whole lot, even stuff not deleted, is not likely to be easy either since that would take everything back to say last wednesday, and you would then need to try and merge back in anything added since.  

 

it may also be possible that the backups just didn't work for some reason, it happens. anyone in the data storage business will have encountered the backup that didn't. 

 

 

now you are just being paranoid 

It doesn't mean I'm wrong ;););)

[blackydog 40]

On 17/01/2021 at 18:37, andyofborg said:

not necessarily. It depends how things are backed up.  The lost files in the backups are likely mixed up with thousands of other files which aren't lost, separating and restoring these is not likely to be a trivial task.

 

Restoring the whole lot, even stuff not deleted, is not likely to be easy either since that would take everything back to say last wednesday, and you would then need to try and merge back in anything added since.  

 

it may also be possible that the backups just didn't work for some reason, it happens. anyone in the data storage business will have encountered the backup that didn't. 

 

 

now you are just being paranoid 

I think this is the problem. If the data was deliberately deleted ( I don't mean maliciously) then restoring the deleted records from backups whilst keeping the ones entered post delete will be tricky. A flashback to before delete will remove anything entered since the delete. That's if flashback records / undo still exist, less likely as time goes by. 

If the applications that populate the database keep records, it may then be possible to replay them from a timestamp following a flashback. Wouldn't want to be the DBA trying to fix this one. 

If any of the backups failed and they don't have alerts to warn them, then they are asking for trouble.

I remember a quote in a study guide I used.

User - I just deleted 300 records in the database.

DBA  - Did you commit?

User ...

🙂

[the_bloke 17]

1 hour ago, blackydog said:

I think this is the problem. If the data was deliberately deleted ( I don't mean maliciously) then restoring the deleted records from backups whilst keeping the ones entered post delete will be tricky. A flashback to before delete will remove anything entered since the delete. That's if flashback records / undo still exist, less likely as time goes by. 

If the applications that populate the database keep records, it may then be possible to replay them from a timestamp following a flashback. Wouldn't want to be the DBA trying to fix this one. 

If any of the backups failed and they don't have alerts to warn them, then they are asking for trouble.

I remember a quote in a study guide I used.

User - I just deleted 300 records in the database.

DBA  - Did you commit?

User ...

🙂

Not really, you just restore the backup to a different DB instance. Then run a diff against the two to identify the missing records.

[Agent Orange 11]

On 15/01/2021 at 22:19, Baron99 said:

The BBC are now reporting that 213,000 records have been deleted, according to The National Police Chiefs' Council. 

https://www.bbc.com/news/uk-55684320

 

I have a grandchild and who works here in Sheffield for the Home Office & an email went round last Tuesday claiming that 30,000 records were deleted.  So this seems to be an escalating situation. 

 

I don't think he/she should should have disclosed that information with you  😕

[Anna B 1,401]

On 17/01/2021 at 17:27, tinfoilhat said:

If there had been backups, it wouldn't be an issue.

 

The cynic in me thinks they wanted maybe 50 files to disappear, and they've hidden that in a mass deletion.

I think I agree. More to this than meets the eye. 

[andyofborg 11]

1 hour ago, the_bloke said:

Not really, you just restore the backup to a different DB instance. Then run a diff against the two to identify the missing records.

Depending how much data there is and I imagine the police database has quite a lot  and how its stored. I imagine a lot will be document files rather that database data that's not necessarily easy or quick and that then becomes a cost/benefit decision.

48 minutes ago, Anna B said:

I think I agree. More to this than meets the eye. 

No there isn't . It's wrapping a bit of normal human incompetence into some trash fiction conspiracy theory that eventually leads to things like the uc capitol being ransacked. 

[blackydog 40]

2 hours ago, the_bloke said:

Not really, you just restore the backup to a different DB instance. Then run a diff against the two to identify the missing records.

Sorry, are you suggesting running a diff Linux command against the existing datafiles and the restored ones at O/S level? Remembering the datafiles will be binary and they will likely contain data from more than one table.   

I'm interested in your restore / recovery method if it is indeed viable.