Recovery of "Deleted" Email

[Peter Sommer]

On 15/08/2011 09:57, Ian Batten wrote:
> I was asked this question yesterday:
>
> If two people, communicating via ordinary commercial webmail services, exchange unencrypted email, and they both then delete the messages using the normal deletion facilities the providers' usual interfaces offer, how recoverable are the messages by a discovery motion?


In the UK we use the word "disclosure" rather than the US "discovery".

Rather than looking at pure technical feasibility you need to start with 
the legal obligations, which for civil purposes appear at CPR 31: 
http://www.justice.gov.uk/guidance/courts-and-tribunals/courts/procedure-rules/civil/contents/parts/part31.htm#IDAALGT

There is only an obligation to list something as available for 
disclosure if the document is in the control of the party. There is also 
a proportionality test: to the issues in the case and to cost.

Standard disclosure – what documents are to be disclosed
31.6

Standard disclosure requires a party to disclose only –

(a) the documents on which he relies; and

(b) the documents which –

(i) adversely affect his own case;

(ii) adversely affect another party’s case; or

(iii) support another party’s case; and

(c) the documents which he is required to disclose by a relevant 
practice direction.

Duty of search
31.7

(1) When giving standard disclosure, a party is required to make a 
reasonable search for documents falling within rule 31.6(b) or (c).

(2) The factors relevant in deciding the reasonableness of a search 
include the following –

(a) the number of documents involved;

(b) the nature and complexity of the proceedings;

(c) the ease and expense of retrieval of any particular document; and

(d) the significance of any document which is likely to be located 
during the search.

(3) Where a party has not searched for a category or class of document 
on the grounds that to do so would be unreasonable, he must state this 
in his disclosure statement and identify the category or class of document


But there may be arguments, depending on the precise circumstances, 
about why certain emails likely to have existed, have been deleted.

There may also be an opportunity to obtain the emails, or see if they 
exist, via a Norwich Pharmacal Order. However enforcement might be 
tricky of the email provider does not have a presence in UK 
jurisdiction. And in any event you would also need to show that the 
email provider was somehow a participant, albeit innocent, in the 
circumstances surrounding the litigation. (Can be done in piracy cases 
where IP addresses are sought from an ISP as the ISP is facilitating the 
publication/distribution; rather more difficult with pure email)


Peter Sommer

On 15/08/2011 09:57, Ian Batten wrote:
> I was asked this question yesterday:
>
> If two people, communicating via ordinary commercial webmail services, exchange unencrypted email, and they both then delete the messages using the normal deletion facilities the providers' usual interfaces offer, how recoverable are the messages by a discovery motion?
>
> His contention was that, for practical purposes, a sufficiently resourced adversary all email is discoverable indefinitely, or, alternatively, you cannot know that it is not discoverable at any specific point in time.
>
> My suspicion is that commercial providers don't take their whole email float to tape, and therefore "at some point" (where that point is ill-defined) the email will not be recoverable even with forensic tools, so the position is "you cannot know when, but it will become non-discoverable within a year or so of notional deletion".  I'm assuming that service providers buy disk on demand, so over time "older" storage will fill and overwrite deleted items.    But I may well be being naive.
>
> ian
>
>
> -----
> No virus found in this message.
> Checked by AVG - www.avg.com
> Version: 10.0.1392 / Virus Database: 1520/3834 - Release Date: 08/14/11
>
>
>


-- 
THE INFORMATION CONTAINED IN THIS E-MAIL IS CONFIDENTIAL AND LEGALLY PRIVILEGED.  IT IS INTENDED ONLY FOR THE ADDRESSEE NAMED ABOVE. IF YOU ARE NOT THE ADDRESSEE ANY DISTRIBUTION, COPYING OR DISCLOSURE OF THIS E-MAIL IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED IT IN ERROR PLEASE NOTIFY THE SENDER BY E-MAIL IMMEDIATELY AND DESTROY THE ORIGINAL