Recovery of "Deleted" Email

[Jon Ribbens]

On Mon, Aug 15, 2011 at 09:57:59AM +0100, Ian Batten wrote:
> I was asked this question yesterday:
> 
> If two people, communicating via ordinary commercial webmail
> services, exchange unencrypted email, and they both then delete the
> messages using the normal deletion facilities the providers' usual
> interfaces offer, how recoverable are the messages by a discovery
> motion?

A discovery motion against who? If it's against one of the
correspondents then it seems to me that the messages are immediately
unrecoverable. There is nothing either of them can do to retrieve
the messages.

> His contention was that, for practical purposes, a sufficiently
> resourced adversary all email is discoverable indefinitely, or,
> alternatively, you cannot know that it is not discoverable at any
> specific point in time.  

If the discovery motion is against the webmail provider then,
unless the webmail provider has a specific system in place to
archive deleted messages for a period of time, then to all intents
and purposes I would think that the messages are immediately gone.

Unless we're talking about some kind of implausible Jack Bauer "the
nuclear bomb in a major city is about to explode and the location's
in the email" situation, nobody is going to take the entire webmail
system off-line and trawl through thousands of gibabytes of data
looking for some specific message.