How hard is it to retrieve deleted and trashed email?

What does "trashed" mean in this context?

Trashed.... like delete and then empty trash.

They have a delete option which would transfer the email to the trash and then they would empty the trash.

They also have a delete and trash option which automatically by-passes the email sitting in the trash, so the email gets automatically emptied from the trash. I hope that makes sense.

I don't know very much about this specific problem, but this has never stopped me before.

There are three places where the deleted email could be found.

1) The email server (the system administrators would have to find out about this).

2) Outlook database files on the local machine

3) The disk drive of the local machine.


Let's start with the last... files that are deleted are simply removed from a "table of contents" that is kept on the contents of the disk drive. To save time, the contents aren't erased until another file wants to use the disk space. Because of this, you can often resurrect files by simply looking at what is on "empty" parts of the disk.

This is a standard forensic technique. By the way, if you really want to erase data so no one can ever read it, you need to write new data on top of the old data. There are programs specifically to do this (and usually it overwrites the data several times to be sure).

I don't know much about the Outlook data files... But I remember hearing that deleted files are sometimes kept. Your system administrators would know more.

On the server side, a company can keep backups of email, but this would be a matter of policy. I wonder if the "shutting email down" has to do with restoring a backup...

This "company" your friend works for wouldn't be the White House, would it....

No

I forgot to mention this is a laptop computer (Sorry). I do know that these emails cannot be permanently erased or written over. The IT supervisor was told about it yesterday, so I was just curious how long it will take to recover them. I will post it as soon as they are recovered just to let anyone wondering know.

Thanks

This is what I found out about retrieving these ever so important emails. The email system the company uses has over 6,000 employees that use the program.

There will be 2 computer techs and a supervisor involved in this retrieval. They will have to shut the entire email system down in order to retrieve these emails. They also said it will take a couple of hours and has nothing to do with a backup of the system.

Just an update on where they are with this retrieval. The system was shut down and then the emails were retrieved. That was 2 days ago. Of course it didn't go smooth.

The emails are in the backup restore file on this email program. They can be read and deleted, but nothing else. So, the IT people worked on the problem with the employee for over an hour on the phone trying to fix this, with the error messages that kept coming up when the employee tried to respond or move the email.

The IT people think they have the problem figured out, so they need to shut the entire system down again (for about 5 minutes). Then it will take them approx. 2 hours to work out the problem.