I recently read that police computer experts were able to retrieve deleted
e-mails from a dead woman’s computer. These e-mails were deleted and yet
someone was able to retrieve them. How long after they were deleted were they
retrieved, I do not know.
I received a very important e-mail, a number of years ago. However, after I
read it I soon deleted the e-mail. I am wondering if there are people, if it is
actually technically possible, for someone who is very, very good with
computers, to be able to go on my computer and retrieve this e-mail. Even
though it was deleted maybe 3 years ago.
I have asked the few friends of mine who are good at computers and they tell
me that technically this is not possible. However, I wonder if there are people
who are better at computers who would be able to do such a thing.
I appreciate any help you may be able to offer me. Even knowing that this
would be technically possible, would give me hope to set out and seek someone
who would have the know-how. I just need to know if it is possible.
The practical answer is of course, no. If you delete something and then
continue to use the computer for three years, in all probability it’s gone,
gone, gone with no hope of retrieval.
“In all probability”?
Yes, yes, there’s an extremely small chance it could be
retrieved. Extremely small as in you’d have better odds of winning the lottery.
But if you have the money to spend, and know that you’ll probably still
come up empty handed … there’s a chance.
Become a Patron of Ask Leo! and go ad-free!
The question that determines whether data that’s been erased from your hard
disk can be recovered is simply this: has it been overwritten and if so, how
When you delete a file its contents are not actually overwritten. Instead,
some information is changed on the disk that says “this space available”, but
the data is otherwise left intact. That means that as long as the actual data
in that available space isn’t overwritten by new data, then data recovery software
can often locate it and get it back.
This is the premise of tools like getdataback which scans the unused space of a hard disk looking
for data that “looks like” files and attempts to reconstruct them. Other
direct access tools allow you to look at the data contained in sectors that are
marked free, and from that you can recover what’s in them.
It’s difficult and geeky, but sometimes possible.
And this is what most people think of when it comes to file recovery.
Recovering a file before it’s overwritten by something else.
And, in all honesty, that’s what I expect happened in the case of the
deleted email you mentioned. The files were probably deleted recently enough
that the disk space hadn’t been overwritten by other information.
The next level of complication arises when data has been
The nature of hard disks is such that writing new data onto a hard disk
doesn’t completely erase or replace the data that was there before.
Various things including the magnetics of the hard drive, the physical
properties of the disk’s read/write head, and the accuracy of the mechanisms
that move that head around the hard disk all contribute to this.
attempt, but be prepared to pay a lot for it, and be prepared to get nothing in
As you might expect this all implies that there are indeed services that use
advanced technologies to attempt to read this incompletely erased prior data.
By “advanced” I mean that you remove your hard drive and send it to them. They
then open the hard drive in a clean-room and use special equipment to attempt
to perform the task.
Oh, and it’s expensive. Really expensive.
The success rate of this type of recovery really depends on how many times
the data in a particular spot on disk has been overwritten with new data. If
it’s been overwritten once then the chances are much better than if the data had
been overwritten, say, 20 times. That’s the premise of tools like sdelete or “Secure Delete”. Using sdelete you
can delete a file and specify the number of times it should be overwritten,
specifically to avoid this type of data recovery.
The last level of complication I’ll discuss is your mail program’s file
You didn’t specify what mail program you’re using, but mail programs all
tend to store email on your hard disk in different ways. Many, like Outlook,
even implement a type of file system not unlike that of a disk, where deleting
an email doesn’t actually delete it until you compact the file. Outlook’s
storage, the PST file, can get even more complicated as it supports encryption
which would render your email unreadable even if you were able to recover
portions of it.
Programs like Outlook Express or Thunderbird keep email in text files that
are constantly being rewritten and compacted as you receive and delete emails,
further increasing the likelihood that the disk sectors you might want to
recover have already been overwritten several times.
And finally web-based emails don’t actually formally store your email on
your hard disk – they’re kept up on the services’ servers. About all you have on
your machine is your browser’s cache, whose disk sectors has almost certainly
been overwritten multiple times over the course of three years.
So, in summary, the chances are extremely slim. Extremely slim. You
can certainly have a data recovery service make the attempt, but be prepared to
pay a lot for it, and be prepared to get nothing in return.
That’s why the real answer, the practical answer is no.