Helping people with computers... one answer at a time.

Several factors conspire to make recovering a file or message deleted three years ago extremely improbable. Still, there's an extremely slim chance.

I recently read that police computer experts were able to retrieve deleted e-mails from a dead woman's computer. These e-mails were deleted and yet someone was able to retrieve them. How long after they were deleted were they retrieved, I do not know.

I received a very important e-mail, a number of years ago. However, after I read it I soon deleted the e-mail. I am wondering if there are people, if it is actually technically possible, for someone who is very, very good with computers, to be able to go on my computer and retrieve this e-mail. Even though it was deleted maybe 3 years ago.

I have asked the few friends of mine who are good at computers and they tell me that technically this is not possible. However, I wonder if there are people who are better at computers who would be able to do such a thing.

I appreciate any help you may be able to offer me. Even knowing that this would be technically possible, would give me hope to set out and seek someone who would have the know-how. I just need to know if it is possible.

The practical answer is of course, no. If you delete something and then continue to use the computer for three years, in all probability it's gone, gone, gone with no hope of retrieval.

"In all probability"?

Yes, yes, there's an extremely small chance it could be retrieved. Extremely small as in you'd have better odds of winning the lottery. But if you have the money to spend, and know that you'll probably still come up empty handed ... there's a chance.

The question that determines whether data that's been erased from your hard disk can be recovered is simply this: has it been overwritten and if so, how many times?

When you delete a file its contents are not actually overwritten. Instead, some information is changed on the disk that says "this space available", but the data is otherwise left intact. That means that as long as the actual data in that available space isn't overwritten by new data, then data recovery software can often locate it and get it back.

This is the premise of tools like getdataback which scans the unused space of a hard disk looking for data that "looks like" files and attempts to reconstruct them. Other direct access tools allow you to look at the data contained in sectors that are marked free, and from that you can recover what's in them.

It's difficult and geeky, but sometimes possible.

And this is what most people think of when it comes to file recovery. Recovering a file before it's overwritten by something else.

And, in all honesty, that's what I expect happened in the case of the deleted email you mentioned. The files were probably deleted recently enough that the disk space hadn't been overwritten by other information.

The next level of complication arises when data has been overwritten.

The nature of hard disks is such that writing new data onto a hard disk doesn't completely erase or replace the data that was there before. Various things including the magnetics of the hard drive, the physical properties of the disk's read/write head, and the accuracy of the mechanisms that move that head around the hard disk all contribute to this.

"You can certainly have a data recovery service make the attempt, but be prepared to pay a lot for it, and be prepared to get nothing in return."

As you might expect this all implies that there are indeed services that use advanced technologies to attempt to read this incompletely erased prior data. By "advanced" I mean that you remove your hard drive and send it to them. They then open the hard drive in a clean-room and use special equipment to attempt to perform the task.

Oh, and it's expensive. Really expensive.

The success rate of this type of recovery really depends on how many times the data in a particular spot on disk has been overwritten with new data. If it's been overwritten once then the chances are much better than if the data had been overwritten, say, 20 times. That's the premise of tools like sdelete or "Secure Delete". Using sdelete you can delete a file and specify the number of times it should be overwritten, specifically to avoid this type of data recovery.

The last level of complication I'll discuss is your mail program's file format.

You didn't specify what mail program you're using, but mail programs all tend to store email on your hard disk in different ways. Many, like Outlook, even implement a type of file system not unlike that of a disk, where deleting an email doesn't actually delete it until you compact the file. Outlook's storage, the PST file, can get even more complicated as it supports encryption which would render your email unreadable even if you were able to recover portions of it.

Programs like Outlook Express or Thunderbird keep email in text files that are constantly being rewritten and compacted as you receive and delete emails, further increasing the likelihood that the disk sectors you might want to recover have already been overwritten several times.

And finally web-based emails don't actually formally store your email on your hard disk - they're kept up on the services' servers. About all you have on your machine is your browser's cache, whose disk sectors has almost certainly been overwritten multiple times over the course of three years.

So, in summary, the chances are extremely slim. Extremely slim. You can certainly have a data recovery service make the attempt, but be prepared to pay a lot for it, and be prepared to get nothing in return.

That's why the real answer, the practical answer is no.

Article C3185 - October 18, 2007 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

9 Comments
Ken B
October 19, 2007 6:13 AM

My e-mail program keeps all of the messages for each folder I create in a single text file. When I delete a message, it simply flags the message's header that it's deleted. Until/unless I compact the folder, the entire e-mail is still there. And, even if I compact that folder, there's still a copy of all deleted e-mails in the "Trash" folder, unless I empty the trash.

I routinely compact the folders and empty the trash, not for "security reasons", but because it recovers the disk space used by them. However, if I didn't do that, then every e-mail I've every received would still be there.

But, as you said, a lot depends on the program you use.

Ron Barker
October 20, 2007 6:17 AM

You will find some information re:Computer data recovery principles at:

http://www.wikicrimeline.co.uk/index.php?title=Computer_data_recovery_principles

Gord Campbell
October 20, 2007 8:39 AM

Most people use Outlook Express. When they delete a message, it goes into the "deleted items" folder, where it stays until they buy a new computer. Only geeks go into Deleted Items and clean it up. And only geeks use shift-delete, which truly deletes the message.

So a different answer would be, "if you use Outlook Express, and if you did a simple delete of the message, try going into the Deleted Items folder and looking for the old email."

Ronny
October 20, 2007 12:35 PM

I back up my computer to CD's and I keep those backups for a long time. What Leo did not mention was that if you also back up your computer and keep the backups, you might can recover the email from the backup.

Richard
October 23, 2007 12:36 AM

Search for "Avira UnErase Personal", it used to be called CIA Unerase (from Datapol). The website says "The private, non-commercial use of Avira UnErase Personal is free." Hope this helps.

Bob Maria
September 3, 2010 4:11 AM

Although there is a possible solution for email recovery, but the recovery surely depends on your situation. When we delete an email from the folder, it doesn't actually gets deleted, it lies somewhere in the database. the database simply deletes the email from its list of index. Therefore, there lies a blank space that can be filled by the email communication later. If the space of the deleted emails (in your case) has not been filled then the recovery is possible.

Yes, you can try recovering the emails using this software for free. the free version of the software is available so you can try and check whether it works for you or not.

http://www.deletedemails.net

steve
September 28, 2010 12:30 PM

is a email from hotmail deleated permantly after we delete it and it states in a message that they are in fact deleated since we believe we got a virus from one that my child clicked on and reading this I wonder if it is returned since we had toi replce the hard drive according to the tech

tammy
April 26, 2011 4:59 AM

How do you find a company that you can trust with your personal information?

If the information comes to a work computer and also a laptop(which is a work computer also) does it matter which hard drive you use?

Finally can the hard drive be copied and sent in? Or do you replace the hard drive so that you can continue to use the computer?

Kevin
June 17, 2011 12:09 PM

I accidentally imported all my old emails from years earlier, that I had deleted. I have Outlook Express and under "File" at the top and then "Import" and then "Messages" and then select (I think) Outlook Express 6. It somehow added back in, all my old messages.

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.