Recovery of "Deleted" Email
jon+ukcrypto at unequivocal.co.uk
Tue Aug 16 11:45:22 BST 2011
On Mon, Aug 15, 2011 at 09:27:48PM +0200, Florian Weimer wrote:
> * Jon Ribbens:
> > If the discovery motion is against the webmail provider then,
> > unless the webmail provider has a specific system in place to
> > archive deleted messages for a period of time, then to all intents
> > and purposes I would think that the messages are immediately gone.
> "Immediately" is rather unlikely. In many systems, deleted data is
> just marked as deleted and not yet physically overwritten.
Obviously. However my point was that the location of where that email
data was on which disk may well be [near-]instantaneously lost, and
that in a situation where you have thousands of gigabytes of
constantly-changing data to search through to find it, recovering it
may be, to all intents and purposes, unachievable.
More information about the ukcrypto