Computer Forensics - Recovering deleted email - E-discovery

Computer Forensics Expert, Steve Burgess explains what can and cannot be recovered from different kinds of email programs, such as Outlook, Eudora, and Webmail. http://www.burgessforensics.com

Category:

Science & Technology

Tags:

• computer
• forensics
• data
• recovery
• legal
• technical
• computers
• expert
• witness
• e-discovery
• computer-forensics

[toobin151]

If you're using webmail have a look at this - email.about.com/od/yahoomailti­p1/qt/Recover_Lost_or_Deleted_­Yahoo_Mail.htm

If none of that works there may still be things to try, especially if you were using a program like Outlook Express or Thunderbird to collect & read your email.

[isa17jerry]

Dear Steve,

Someone hacked my hotmail. Do you know how to recover it? Thank you

[toobin151]

7jerry, I'd recommend first contacting hotmail and changing your password. If you collect email using a browse there will be little on your own computer to be recovered.

You may find some in a deleted mail folder when you access your account online. Hotmail may be able to restore some of your more recently deleted emails.

If you're using a Mail program to collect email on your local computer, or otherwise save your emails to your computer, then there is a good chance of recovery from there.

[toobin151]

Sahim,

If you are using an email program, like Outlook Express or Thunderbird, there's a very good chance that many of the selected emails are recoverable from your computer.

On the other hand, if you are accessing your email exclusively from a browser, the emails deleted months ago are almost certainly gone. But you might check with Yahoo as another commented seems to have gotten back many very old emails.

[toobin151]

Jagular, continued.

Can I ask if you did step 2 (always emptied your deleted emails folder)?

Also, how was step 3 performed.

Have I got steps 1 & 4 correct?

This could make difference in the conventional wisdom.

Thanks

[toobin151]

Jagular, That's extraordinary. Typically, if you are not storing the emails on your computer but rather accessing through the web with the provider, they're fully gone rather quickly.

Could you clarify for me, please? Let me know if I have this correct:

1. You deleted thousands of emails over a period of years.

2. You emptied the deleted mailbox (this being the most important step)

3. You reinstalled your email account somehow.

4. Yahoo sent you thousands of your emails that were 5 years old.

[Rayblade45]

Hello Steve I have a question my dad was checking through his email and accidently deleted an email that he needed from the Deleted Items is there any way to get it back? He uses Windows Mail.

[sfgdotnet]

I declare Steve the elite status of a "Super Forensics Expert"! ...a basic title of expert just does not do for you. Nice job Steve! BTW - The compressible encryption in a .pst is a byte substitution cipher with a fixed substitution table. Not really "security" in my humble opinion ;-)

[terry91able]

hello steve . i accidently deleted my email in my inbox and then deleted in the trash  on mail.yahoo.com.. would you plz show me how to recover the email which i deleted . i reallllyyy need it right now for my school.. Thank you so much ... you have a good day .. ( can you show me step by step )

[isa17jerry]

Dear Steve,

Thanks for the reply.

I already contacted hotmail but negative response. The hacker took over my hotmail totally. How this kind of hacker can easily hack like this? Is there any tools or software to hack like this?

Thank you