robrado974 1 Posted April 24, 2019 Sorry people I didn’t know how else to put it . I’m looking to see if anyone on here knows their stuff when it comes to deleted emails ,is it possible to find out when they were deleted ?. I wouldn’t normally ask but it’s extremely important. Kind regards Rob Share this post Link to post Share on other sites
_Matt_ 32 Posted April 24, 2019 Hey - is it Hotmail/Yahoo or something like Microsoft Outlook (as installed on many work computers to manage emails "offline" within an application) Share this post Link to post Share on other sites
_Matt_ 32 Posted April 24, 2019 If it's MS Outlook (the application) and you've got the deleted email to hand, click properties (or hit ALT and ENTER as a short cut). Look at the modified date and this will equal when it was deleted, assuming it wasn't modified after it was deleted. Share this post Link to post Share on other sites
robrado974 1 Posted April 24, 2019 Thank you so much for getting back to me . Yes it’s outlook . We have been told everything that is 180 days old is non retrievable. Share this post Link to post Share on other sites
_Matt_ 32 Posted April 24, 2019 It depends how the system has been set up. We have a process where old emails are no longer available in outlook but we have an archiving piece of software (mimecast) where we can login and get emails all the way back to years and years ago. Maybe you guys have something similar - so yes it goes from outlook after 180 days but emails are available in archiving software. I’d be surprised if your company deleted them as the information can be called up in the future for many things - HR stuff, legal stuff - hence why only write business relevant stuff on work emails (note for anyone reading - not you Rob) Share this post Link to post Share on other sites
robrado974 1 Posted April 24, 2019 Thank you so much mate . The server is used by the NHS . Share this post Link to post Share on other sites
robrado974 1 Posted April 24, 2019 (edited) These are deleted emails .as in deleted, then deleted from deleted box . Edited April 24, 2019 by robrado974 Share this post Link to post Share on other sites
culshaw 1 Posted April 24, 2019 Try this, and scroll to "Recover an item that's no longer in your Deleted Items folder": https://kb.nmsu.edu/page.php?id=81426 Share this post Link to post Share on other sites
robrado974 1 Posted April 24, 2019 Thank you culshaw . As I said this information is so important, anything we can get is so helpful. Share this post Link to post Share on other sites
Jim 2 Posted April 24, 2019 Is this an on-premise instance of Microsoft Exchange, or is it hosted in Office 365? Share this post Link to post Share on other sites
fendervg 32 Posted April 24, 2019 If mail is being archived it will have been copied to the archive as it traversed the server (i.e. being sent), so it will still be there even if the recipient and the sender have deleted it from their inbox and sent item folders. How long it is then kept in the archive will be a matter of IT/HR policy. The archive may just keep a copy of the message text and the names and details of any attachments, but not neccesarily the attachments themselves, for reasons of space. If Exchange and Office 365 have auditing enabled, you may be able to see when a message was deleted there. If a mail has been deleted it will stay in the trash folder until that is emptied, even after that there are forensic ways to recover these from the server or a local Outlook .pst file. This is the point at which you would involve a specialist and your IT department and it may get expensive. If there is any whiff of things getting legal, don't mess around trying recovery yourself but get IT. HR and some experts involved. I've been down this road a few times professionally and you would be surprised at what can be recovered and reconstructed from any media such as a disk or USB drive unless it has been overwritten with random data several times - but as I said, if it is going legal, chain of evidence and tamper prevention of the original data is vital when it goes to court. My two cents - hope it helps. Share this post Link to post Share on other sites
robrado974 1 Posted April 25, 2019 Thanks again for the replies chaps . I.T are going to recover the emails . As you have obviously guessed I’m no computer expert, I have no idea what server/ system it runs on . I do know 180 days is not going to go back far enough. But that’s what I.T are saying. Ok so it’s extreme but there are people that hack into computers and find sensitive data , but you can’t recover and email ?! . Also can you tell when it was deleted?. Kind regards Rob Share this post Link to post Share on other sites
fendervg 32 Posted April 25, 2019 The problem is that the data can only be recovered if it is actually still there - deleted data will still be there unless actually overwritten, but the methods used to retrieve it are intrusive and can require systems to be shut down and will take a long time. Hacking into systems and retrieving sensitive stuff is a slightly different proposition as the target data is definitely there as it is needed - it's just a question of how well it is protected. Do you know if the mail was just from one sender to one recipient, or were there multiple recipients? If so, each should have a copy, so that might be worth trying. Hopefully this gets resolved for you soon. Share this post Link to post Share on other sites
robrado974 1 Posted April 25, 2019 Thank you fend . I believe it will only have one recipient. It’s needed for evidence. Oh for hindsight eh, if only you could predict the future!. I always believed that information on a computer would always be there somewhere it never really goes away, not unless you destroyed the hard drive. Share this post Link to post Share on other sites
fendervg 32 Posted April 25, 2019 Yeah, not always the case as storage space is limited and expensive. Share this post Link to post Share on other sites
1200 bandit 10 Posted April 25, 2019 Unless it eBay have not got a clue ( Very good friend of mine has a computer shop)so go to him and say broke Share this post Link to post Share on other sites
