Recovery of "Deleted" Email

Jon Ribbens jon+ukcrypto at unequivocal.co.uk
Tue Aug 16 11:45:22 BST 2011


On Mon, Aug 15, 2011 at 09:27:48PM +0200, Florian Weimer wrote:
> * Jon Ribbens:
> > If the discovery motion is against the webmail provider then,
> > unless the webmail provider has a specific system in place to
> > archive deleted messages for a period of time, then to all intents
> > and purposes I would think that the messages are immediately gone.
> 
> "Immediately" is rather unlikely.  In many systems, deleted data is
> just marked as deleted and not yet physically overwritten.

Obviously. However my point was that the location of where that email
data was on which disk may well be [near-]instantaneously lost, and
that in a situation where you have thousands of gigabytes of
constantly-changing data to search through to find it, recovering it
may be, to all intents and purposes, unachievable.



More information about the ukcrypto mailing list