Challenges in Recovering Deleted Email

Both computer forensics experts and data recovery technicians seek to recover deleted data GoDaddy email login . Data recovery is primarily interested in bringing back files, while computer forensics tends to dig deeper, looking not just for deleted documents, but also for metadata (data about data – such as file attributes, descriptions, dates, and other information) and meaningful snippets of unrecoverable files. One area of particular interest is email.

When most documents are written to a computer’s hard disk, each newly created document has its own directory entry (what the user sees as a listing in a folder). If a file has been deleted, but has not been overwritten by another document, the recovery process is a relatively trivial part of e-discovery or of data recovery. But when the data of interest is from deleted email, the discovery process is likely to differ significantly from that of data recovery. Individual emails are stored differently than individual files.

Different types of email programs store data differently on the user’s hard disk and require different schemes for finding useful information. As a result, the deletion of emails and recovering of deleted emails differs not only from that for other types of documents, but also between different types of email programs.

There are three main types of email in common usage – Microsoft Outlook (often paired with a Microsoft Exchange Server), text-based email client programs, and web-based email, or webmail.

In Microsoft Outlook, all emails are kept in one large, encrypted, non-text file – the PST, or Personal Folders file. Outlook has additional functions and additional content as well. There is an integrated address book, multiple mailboxes, a calendar, and a scheduler, all of which are contained in the PST file. When one looks into a PST file with a file editor or word processing application, there is little or nothing intelligible to the human eye. The file content looks like nearly random characters.

In general, the PST file must be loaded into Outlook to be read. When an email is deleted, or even when it is purged, it may be kept within the body of the single large file, but become inaccessible to the program. Some deleted emails may be recovered by manipulating the file though a manual process, repairing the resultant file, and then loading back into Outlook.

Leave a comment

Your email address will not be published. Required fields are marked *