Deleted Item Retention: Expert Email Evidence in Court
Expert witness work for digital email forensics is often concerned with the recovery of deleted emails. A person may send an email, and then delete the email from their Sent Items, and also from their Deleted Items. And then claim they never sent the email. Being able to prove email delivery can be key evidence in a court case – see court case examples here.
Undelete a Sent Email | Digital Evidence
It is possible to investigate this further to prove that the email was sent by that person. Many email systems store an email that has been deleted, allowing for the recovery of deleted emails. In Google GSuite, for example, deleted emails are kept in the Archive for a long time, or until the Archive is full. A typical user may not be aware of this.
Microsoft Office Exchange Online also has a “soft delete” and “hard delete” option for emails – similar to Google GSuite. Depending on the M365 license being used, there may be access to additional logging information within the Compliance Audit logs.
Recover a Deleted Email from a Journal
Larger email systems may have a Journal feature whereby copies of every email sent or received are placed into a separate Journal storage area. Examples of a Journal system might be in the Barracuda or MIMECast boundary email systems. Recovery of deleted emails from a Journal is often crucial.
A user may claim that someone else sent the email from their account. This can be investigated further in conjunction with user sign-in logs, and audit logs. It is often possible to demonstrate the device name and IP address used when the user was sending the email – which could be matched to the commonly used device name and IP address.
Gather Expert Email Evidence Artefacts
By gathering evidence, there comes a point where the weight of that evidence passes the “beyond reasonable doubt” test.
Summary | Importance of Recovering Deleted Email Sent Items
A person may try and prevent a sent email from being seen by deleting it. However, there are various ways that allow for recovery of deleted emails. This can be used as evidence in a court case where an email expert witness is demonstrating that an email was sent by a person.
Contact us today if you want to discuss how we can help with your email forensics required to recover deleted emails.
If you help to migrate your email system to Microsoft Office 365 then we recommend using the team at office365migrate.com