Shawn Truax, from the Ministry of Government Services' cyber security branch, told a legislative committee probing the Liberals' cancellation of two gas plants that five computer hard drives and one from a printer were taken last August.
Ontario Provincial Police have alleged that the password was obtained by David Livingston, chief of staff to former premier Dalton McGuinty, and may have been used to wipe up to 24 hard drives in the premier's office last year.
They believe Peter Faist, an outside IT expert who was the boyfriend of former deputy chief of staff Laura Miller, was given access to some of the computer hard drives using the password in February 2013.
Police have seized hard drives in the premier's office in the legislature as they investigate the deletion of documents related to killing the Oakville and Mississauga gas plants, which could cost up to $1.1 billion.
The downtown Ottawa office at 180 Elgin Street was used by the premier's office under McGuinty, said Paul Tye, adviser to government house leader John Milloy.
The lease was terminated Aug. 31, 2013, and IT staff were asked to collect the hard drives "in the event that any of the assets would be of interest to the OPP as part of their investigation," Tye said in an email.
The government still occupies another office in the building.
Around Aug. 14, Truax said he was asked by IT services for advice on decommissioning hard drives.
"I don't recall the exact conversation, but as soon as I heard the words 'gas plants,' that's when I said, 'You know, we might want to provide you some assistance here before — in just picking up and retrieving the assets in the event that they do need to be searched for any reason,' because we were, at that point, working on records production," he said.
Just a few weeks earlier, Ontario's privacy commissioner had delivered a scathing report concluding that records laws were broken when staff in McGuinty's office and the former energy minister's office deleted emails related to the gas plants.
Truax, who trained with the OPP e-crime branch, said the Ottawa hard drives were retrieved in mid-August 2013. Those from the premier's office — which were in storage — were collected Aug. 30.
A hard drive assigned to Livingston and obtained by police was provided to his branch on Sept. 26. The last hard drives were collected Oct. 8. A total of 52 hard drives were collected, including the ones from Ottawa, Truax said.
Tye said no one assigned to that office is named in the court documents that identify hard drives police say were accessed with the password, which was valid between Feb. 6 and March 20 last year.
Premier Kathleen Wynne, who won the leadership race Jan. 26 that year, has maintained that she knew nothing about the alleged computer tampering. She said her predecessor's staff had no access to her office after she was sworn in Feb. 11.
"I cannot comment on what the forensic expert has said," Wynne said Thursday. "I haven't heard the testimony, but I know that there is an ongoing investigation and I'm not going to interfere with that."
But the revelation that hard drives were retrieved beyond the halls of Queen's Park is a new piece of the puzzle, said Progressive Conservative Lisa MacLeod.
"This is a $1.1-billion scandal," she said. "The public is angry about it, their hydro rates just went up, they now want answers."
The Tories and NDP claim the emails were wiped out to cover up the true costs of pulling the plug on the gas plants ahead of the 2011 election, which reduced the Liberals to minority status.
None of the allegations have been tested in court and a lawyer for Livingston — who is being investigated for possible breach of trust — said his client didn't break any laws.
Miller, who now works for the B.C. Liberals, and Faist are expected to testify before the committee next month.
Faist had an IT contract with the government caucus office and the Liberal party at the time police allege he had access to the computers.