I recently read that police computer experts were able to retrieve deleted
e-mails from a dead woman’s computer. These e-mails were deleted and yet
someone was able to retrieve them. How long after they were deleted were they
retrieved, I do not know.
I received a very important e-mail, a number of years ago. However, after I
read it I soon deleted the e-mail. I am wondering if there are people, if it is
actually technically possible, for someone who is very, very good with
computers, to be able to go on my computer and retrieve this e-mail. Even
though it was deleted maybe 3 years ago.
I have asked the few friends of mine who are good at computers and they tell
me that technically this is not possible. However, I wonder if there are people
who are better at computers who would be able to do such a thing.
I appreciate any help you may be able to offer me. Even knowing that this
would be technically possible, would give me hope to set out and seek someone
who would have the know-how. I just need to know if it is possible.
The practical answer is of course, no. If you delete something and then
continue to use the computer for three years, in all probability it’s gone,
gone, gone with no hope of retrieval.
“In all probability”?
Yes, yes, there’s an extremely small chance it could be
retrieved. Extremely small as in you’d have better odds of winning the lottery.
But if you have the money to spend, and know that you’ll probably still
come up empty handed … there’s a chance.
Become a Patron of Ask Leo! and go ad-free!
The question that determines whether data that’s been erased from your hard
disk can be recovered is simply this: has it been overwritten and if so, how
many times?
When you delete a file its contents are not actually overwritten. Instead,
some information is changed on the disk that says “this space available”, but
the data is otherwise left intact. That means that as long as the actual data
in that available space isn’t overwritten by new data, then data recovery software
can often locate it and get it back.
This is the premise of tools like getdataback which scans the unused space of a hard disk looking
for data that “looks like” files and attempts to reconstruct them. Other
direct access tools allow you to look at the data contained in sectors that are
marked free, and from that you can recover what’s in them.
It’s difficult and geeky, but sometimes possible.
And this is what most people think of when it comes to file recovery.
Recovering a file before it’s overwritten by something else.
And, in all honesty, that’s what I expect happened in the case of the
deleted email you mentioned. The files were probably deleted recently enough
that the disk space hadn’t been overwritten by other information.
The next level of complication arises when data has been
overwritten.
The nature of hard disks is such that writing new data onto a hard disk
doesn’t completely erase or replace the data that was there before.
Various things including the magnetics of the hard drive, the physical
properties of the disk’s read/write head, and the accuracy of the mechanisms
that move that head around the hard disk all contribute to this.
attempt, but be prepared to pay a lot for it, and be prepared to get nothing in
return.”
As you might expect this all implies that there are indeed services that use
advanced technologies to attempt to read this incompletely erased prior data.
By “advanced” I mean that you remove your hard drive and send it to them. They
then open the hard drive in a clean-room and use special equipment to attempt
to perform the task.
Oh, and it’s expensive. Really expensive.
The success rate of this type of recovery really depends on how many times
the data in a particular spot on disk has been overwritten with new data. If
it’s been overwritten once then the chances are much better than if the data had
been overwritten, say, 20 times. That’s the premise of tools like sdelete or “Secure Delete”. Using sdelete you
can delete a file and specify the number of times it should be overwritten,
specifically to avoid this type of data recovery.
The last level of complication I’ll discuss is your mail program’s file
format.
You didn’t specify what mail program you’re using, but mail programs all
tend to store email on your hard disk in different ways. Many, like Outlook,
even implement a type of file system not unlike that of a disk, where deleting
an email doesn’t actually delete it until you compact the file. Outlook’s
storage, the PST file, can get even more complicated as it supports encryption
which would render your email unreadable even if you were able to recover
portions of it.
Programs like Outlook Express or Thunderbird keep email in text files that
are constantly being rewritten and compacted as you receive and delete emails,
further increasing the likelihood that the disk sectors you might want to
recover have already been overwritten several times.
And finally web-based emails don’t actually formally store your email on
your hard disk – they’re kept up on the services’ servers. About all you have on
your machine is your browser’s cache, whose disk sectors has almost certainly
been overwritten multiple times over the course of three years.
So, in summary, the chances are extremely slim. Extremely slim. You
can certainly have a data recovery service make the attempt, but be prepared to
pay a lot for it, and be prepared to get nothing in return.
That’s why the real answer, the practical answer is no.
My e-mail program keeps all of the messages for each folder I create in a single text file. When I delete a message, it simply flags the message’s header that it’s deleted. Until/unless I compact the folder, the entire e-mail is still there. And, even if I compact that folder, there’s still a copy of all deleted e-mails in the “Trash” folder, unless I empty the trash.
I routinely compact the folders and empty the trash, not for “security reasons”, but because it recovers the disk space used by them. However, if I didn’t do that, then every e-mail I’ve every received would still be there.
But, as you said, a lot depends on the program you use.
You will find some information re:Computer data recovery principles at:
http://www.wikicrimeline.co.uk/index.php?title=Computer_data_recovery_principles
Most people use Outlook Express. When they delete a message, it goes into the “deleted items” folder, where it stays until they buy a new computer. Only geeks go into Deleted Items and clean it up. And only geeks use shift-delete, which truly deletes the message.
So a different answer would be, “if you use Outlook Express, and if you did a simple delete of the message, try going into the Deleted Items folder and looking for the old email.”
I back up my computer to CD’s and I keep those backups for a long time. What Leo did not mention was that if you also back up your computer and keep the backups, you might can recover the email from the backup.
Search for “Avira UnErase Personal”, it used to be called CIA Unerase (from Datapol). The website says “The private, non-commercial use of Avira UnErase Personal is free.” Hope this helps.
Although there is a possible solution for email recovery, but the recovery surely depends on your situation. When we delete an email from the folder, it doesn’t actually gets deleted, it lies somewhere in the database. the database simply deletes the email from its list of index. Therefore, there lies a blank space that can be filled by the email communication later. If the space of the deleted emails (in your case) has not been filled then the recovery is possible.
Yes, you can try recovering the emails using this software for free. the free version of the software is available so you can try and check whether it works for you or not.
http://www.deletedemails.net
is a email from hotmail deleated permantly after we delete it and it states in a message that they are in fact deleated since we believe we got a virus from one that my child clicked on and reading this I wonder if it is returned since we had toi replce the hard drive according to the tech
How do you find a company that you can trust with your personal information?
If the information comes to a work computer and also a laptop(which is a work computer also) does it matter which hard drive you use?
Finally can the hard drive be copied and sent in? Or do you replace the hard drive so that you can continue to use the computer?
I accidentally imported all my old emails from years earlier, that I had deleted. I have Outlook Express and under “File” at the top and then “Import” and then “Messages” and then select (I think) Outlook Express 6. It somehow added back in, all my old messages.