Recovery techniques for deleted email items in digital forensic context

Abstract

Corporations use email as their primary method for internal communication and business processes. By their nature, the email messages are in general used for major business processes that contain large amounts of business information. Technological improvements also enable an email system to handle large amount of data. When there is a criminal activity like Technology leakage, an email message can be highly likely to become critical evidence; however, there is a high chance that a suspect will intentionally delete the message. Thus, the ability to recover deleted email will be very critical to prove the wrongdoing in this case. This paper analyzes how various email client applications adopt their deletion systems and any possible recovery methods are introduced accordingly. © 2011 Springer-Verlag.