Helping people with computers... one answer at a time.
Several factors conspire to make recovering a file or message deleted three years ago extremely improbable. Still, there's an extremely slim chance.
I recently read that police computer experts were able to retrieve deleted e-mails from a dead woman's computer. These e-mails were deleted and yet someone was able to retrieve them. How long after they were deleted were they retrieved, I do not know.
I received a very important e-mail, a number of years ago. However, after I read it I soon deleted the e-mail. I am wondering if there are people, if it is actually technically possible, for someone who is very, very good with computers, to be able to go on my computer and retrieve this e-mail. Even though it was deleted maybe 3 years ago.
I have asked the few friends of mine who are good at computers and they tell me that technically this is not possible. However, I wonder if there are people who are better at computers who would be able to do such a thing.
I appreciate any help you may be able to offer me. Even knowing that this would be technically possible, would give me hope to set out and seek someone who would have the know-how. I just need to know if it is possible.
The practical answer is of course, no. If you delete something and then continue to use the computer for three years, in all probability it's gone, gone, gone with no hope of retrieval.
"In all probability"?
Yes, yes, there's an extremely small chance it could be retrieved. Extremely small as in you'd have better odds of winning the lottery. But if you have the money to spend, and know that you'll probably still come up empty handed ... there's a chance.
The question that determines whether data that's been erased from your hard disk can be recovered is simply this: has it been overwritten and if so, how many times?
When you delete a file its contents are not actually overwritten. Instead, some information is changed on the disk that says "this space available", but the data is otherwise left intact. That means that as long as the actual data in that available space isn't overwritten by new data, then data recovery software can often locate it and get it back.
This is the premise of tools like getdataback which scans the unused space of a hard disk looking for data that "looks like" files and attempts to reconstruct them. Other direct access tools allow you to look at the data contained in sectors that are marked free, and from that you can recover what's in them.
It's difficult and geeky, but sometimes possible.
And this is what most people think of when it comes to file recovery. Recovering a file before it's overwritten by something else.
And, in all honesty, that's what I expect happened in the case of the deleted email you mentioned. The files were probably deleted recently enough that the disk space hadn't been overwritten by other information.
The next level of complication arises when data has been overwritten.
The nature of hard disks is such that writing new data onto a hard disk doesn't completely erase or replace the data that was there before. Various things including the magnetics of the hard drive, the physical properties of the disk's read/write head, and the accuracy of the mechanisms that move that head around the hard disk all contribute to this.
As you might expect this all implies that there are indeed services that use advanced technologies to attempt to read this incompletely erased prior data. By "advanced" I mean that you remove your hard drive and send it to them. They then open the hard drive in a clean-room and use special equipment to attempt to perform the task.
Oh, and it's expensive. Really expensive.
The success rate of this type of recovery really depends on how many times the data in a particular spot on disk has been overwritten with new data. If it's been overwritten once then the chances are much better than if the data had been overwritten, say, 20 times. That's the premise of tools like sdelete or "Secure Delete". Using sdelete you can delete a file and specify the number of times it should be overwritten, specifically to avoid this type of data recovery.
The last level of complication I'll discuss is your mail program's file format.
You didn't specify what mail program you're using, but mail programs all tend to store email on your hard disk in different ways. Many, like Outlook, even implement a type of file system not unlike that of a disk, where deleting an email doesn't actually delete it until you compact the file. Outlook's storage, the PST file, can get even more complicated as it supports encryption which would render your email unreadable even if you were able to recover portions of it.
Programs like Outlook Express or Thunderbird keep email in text files that are constantly being rewritten and compacted as you receive and delete emails, further increasing the likelihood that the disk sectors you might want to recover have already been overwritten several times.
And finally web-based emails don't actually formally store your email on your hard disk - they're kept up on the services' servers. About all you have on your machine is your browser's cache, whose disk sectors has almost certainly been overwritten multiple times over the course of three years.
So, in summary, the chances are extremely slim. Extremely slim. You can certainly have a data recovery service make the attempt, but be prepared to pay a lot for it, and be prepared to get nothing in return.
That's why the real answer, the practical answer is no.
Comments on this entry are closed.
If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.
If you don't find your answer, head out to http://askleo.com/ask to ask your question.