Comments on: When Should You Search for Deleted Files?

By: Sherlock Holmes in the Twenty-First Century: Definitions and Limits of Computer Forensics, Forensic Copies and Forensic Examinations « e-Discovery Team

Sun, 14 Oct 2007 16:23:28 +0000

[...] where computer disks are imaged, and forensic exams are performed to restore and search deleted files, fragments, Internet cache, slack space, memory, and the like. A diagram providing a simple [...]

By: ralphlosey

ralphlosey — Mon, 04 Jun 2007 18:51:34 +0000

You make a point that even a double deleted email may still be easily restored in some circumstances where it is still within an administrator set time recovery period. I assumed for purposes of simplification in this blog that it was not. But I admit the example you provide could be an exception, depending on time frames, to the proposed general rule of when an email is not “reasonable accessible.” Note I say, in accord with the rules, not “reasonably” accessible. I do not say not accessible. Yes it can be accessed, most every thing can be restored and accessed, but at what costs and time or effort. that is where the reasonability component comes in.

The term “deleted” itself infers a message or file is truly gone. That is or should be your true gripe, and blame Microsoft, not me. The modifier “double” is easy to understand, and does not imply true erasure; just that retreival may, I would say usually is (depending only on the time quirk you mentioned), more difficult to restore.

By: Maurene Caplan Grey

Maurene Caplan Grey — Mon, 04 Jun 2007 17:36:02 +0000

“But if an email in the Deleted Folder is deleted again, in other words “double-deleted,” then it is no longer indexed in Outlook, and no longer readily accessible.” — Just because the message is “double deleted” in Outlook does not mean that it is not accessible. I’m assuming that you are using Outlook against the Exchange server. The majority of Exchange admins will set a “Deleted Items Recovery” retention period. This means that even if the email message is “doubled delted,” it can be recovered from the Exchange server. If the user is using Outlook 2003, the email message may be recovered from its cache. (see http://www.computerperformance.co.uk/exchange2003/exchange2003_recovery_deleted_item.htm).

Other email systems have similiar functionality. The GroupWise client, for example, has had a desktop cache feature for years.

I’ve never heard the term “double deleted,” and I suggest that it is a poor term because it infers that the message is truly gone (outside of the message fragments hanging out on the hard drive).

By: E-mail discovery, open records, and the FRCP « State Sunshine and Open Records

Mon, 04 Jun 2007 12:22:46 +0000

[...] E-record expert Ralph Losey notes that there’s a difference between deleted and double-deleted. [...]

By: Death By Email

Death By Email — Mon, 04 Jun 2007 11:29:34 +0000

Must You Retrieve Deleted Files?

How far do you need to go to recover deleted emails? As the Federal Rules of Civil Procedure are further defined by the courts, we are beginning to see some definition. Magistrate Judge Elizabeth Jenkins of the U.S. District Court