Just how much should this cost? A better plan for recovery
To quickly summarize, the equipment for the whole project should cost about $50,000, worst case, not $50,000 per email recovered. Adding labor (and this depends on how many machines they're checking), they're probably looking at $250,000 to $5M, not a minimum of $15M as Payton testified.

What's more, the plan I'm about to describe should meet all of Magistrate Judge Facciola's goals with regard to recovery. But there's an additional side benefit for the National Archives.

The result of this project, the way I've outlined it below, would include a second complete, archival-ready image, that can be stored for posterity -- not only would the Magistrate Judge get a forensic copy for his case, but he'd have a second set of solid hard drives, full of pristine Presidential records, that he could deliver to the National Archives intact.

Actual cost estimate breakdown
Hard drives vary in average and maximum capacity by year. For example, we can now buy a one terabyte drive (1,000 gigabytes) for around $300. Back in 2003, the drives probably in use at the White House were in the 120GB range or so.

It's unlikely that many current drives in use in the Executive Office of the President have drives all that much larger -- after all, most are used for basic office document work. And laptop drives are considerably smaller than typical desktop drives, also keeping the job to a manageable load.

Assuming they were making image copies of workstation drives from that era, they could probably image five PC drives onto one modern-day terabyte drive, for about $300. A copy of Ghost is about $70.

If I were doing this, I'd use two approaches, depending on whether I was imaging an old, out-of-service computer or one that's currently in use.

For out-of-service machines, I'd remove the source drives, containing the questionable data, from their original computers and label them carefully. Then I'd set up a forensic workstation or workstations with external 1TB hard drives, and use Ghost to image the source drives onto the destination drives.

For in-service machines, I'd plug in a USB backup drive (most PCs of the modern era come with USB ports) to the computer, so there's no need to open the box. Then, instead of booting to the user's copy of Windows, I'd boot straight into Ghost, start the image process, and move on to another five or ten computers and repeat. One person could probably image 10 to 20 machines in a night without breaking a sweat.

For every destination drive I made, I'd duplicate it, creating a backup of that drive. And then I'd do the forensic analysis on the image, from the first drive.

We don't know how many PCs the Magistrate Judge will eventually need to explore, nor how quickly he wants the results. Let's assume there are 100 PCs, each with a drive. And let's assume each drive is 120-160GB, which is about right for that time. I know there are a lot more than 100 people in the EOP, but there are probably no more than that with machines upon which there might be something judicially relevant.

Then again, if it's necessary to examine every single computer ever used by the Bush Administration, whether currently in-service or not, it might be worth it. After all, if we're spending $12 billion a month (according to the Congressional Research Service) to be in Iraq and Afghanistan, it might make sense to spend a few million to be able to preserve all the records about how we got there.