A finance manager approves a payment on a Thursday afternoon. The email asking for it looked routine: the right name, the usual signature, a vendor she had paid a dozen times before. Only the bank account was different. Two weeks later, the real vendor calls, asking where their money is, and the original email has vanished from her inbox. This is exactly the situation email forensics is built for. The message may be gone from view, but the trail around it (headers, server logs, mailbox rules, leftover data on the machine) usually tells the story to someone who knows how to read it.
Email remains the paper trail of Indian business: contracts, approvals, negotiations, resignations, and, increasingly, the entry point for fraud. When something goes wrong, the question is rarely “was there an email?” It is “can we prove what it said, who sent it, and whether it was tampered with?”
“Deleted” Rarely Means Gone
Most people picture deletion as a shredder. In reality, it is more like removing a book’s entry from a library catalogue while the book stays on the shelf. Where the “book” still sits depends on how the email was stored.
On the user’s computer
Desktop clients keep mail in local files such as PST and OST (Outlook) or MBOX (Thunderbird and others). Deleting a message often just flags it, and the content can remain inside the file until it is compacted. Even after compaction, remnants can linger in unallocated disk space, which a forensic examiner can carve out.
On the mail server
Exchange, Microsoft 365 and Google Workspace usually retain deleted items for a limited window, and administrators can often extend it. Items pass through stages: the deleted folder, then a recoverable area, then permanent removal. What you can retrieve depends heavily on retention settings and on how quickly someone acts.
In logs and backups
Sign-in records, audit trails, message-tracking logs, and backups can confirm that a message existed even when its content is gone. In our experience, this layer is what often settles arguments. CERT-In’s 2022 directions also expect organisations to keep ICT logs for 180 days, which is one more reason not to let them roll over during a dispute.
How to Recover Deleted Emails in Practice
Deleted email recovery is a sequence, not a single click. Investigators first preserve the source (a mailbox export, a disk image, or a server snapshot) and record a hash so they can prove its integrity later. Then they work outward from the easiest sources to the hardest: server-side recoverable items first, then local data files, then carving from unallocated space.
There’s a catch worth stating plainly. Email data recovery has a shelf life. Server retention windows close, local files get compacted, and normal use overwrites disk space. Recovering a week after deletion and recovering six months later are very different exercises. Anyone promising a full restoration regardless of timing is selling comfort, not forensics.
The Header Tells the Truth
Recovering an email is only half the work; the other half is deciding whether it is genuine. Every email carries a header, a technical passport that most people never see. It records the servers the message passed through, timestamps, the originating IP address, and the results of authentication checks such as SPF, DKIM and DMARC.
Here’s where things get interesting. A spoofed email may look perfect in the inbox, yet its header shows it never came from the claimed domain. A lookalike domain, one letter off from the real one, will pass casually but fail under inspection. And a message that genuinely came from a real account may still be fraudulent if the account itself was hijacked. Telling these two apart, spoofing versus account takeover, changes the entire direction of a case.
Following the Trail in an Email Fraud Investigation
Business email compromise usually leaves a pattern. Attackers who take over a mailbox rarely announce themselves. They quietly create forwarding rules, or rules that send certain messages straight to the deleted folder so the real owner never sees the replies. They may grant a malicious app access to the account, or log in from unfamiliar locations at odd hours.
A thorough email forensic investigation therefore looks beyond the visible messages. It checks mailbox rules, sign-in history, connected applications, and the exact timeline of when the vendor’s bank details changed. Piece by piece, it reconstructs how the intruder got in, what they saw, and where the money went. For organisations evaluating email fraud services in India, this is the standard question: does the provider trace the entire attack, or only retrieve the one message?
Turning Recovered Emails into Admissible Evidence
Finding the email does not end the job. It has to survive scrutiny. Under the Bharatiya Sakshya Adhiniyam, Section 63 (which replaced the old Section 65B of the Evidence Act), electronic records need a certificate describing how the record was produced, with hash values, signed by the person in charge and an expert. Fraud by impersonation may also engage provisions of the IT Act, such as Sections 66C and 66D.
This is why documentation matters as much as recovery. A clear chain of custody, a reproducible method, and a report a non-technical judge can follow turn a recovered email into usable evidence. A perfectly retrieved message with a broken custody trail can be challenged and discounted.
Before Anyone Touches the Mailbox
Early decisions can make or break a case. Do not delete, archive or “tidy up” anything, even the suspicious messages. Do not forward the suspect email around the office, because forwarding strips the original header. Change credentials only after preserving the mailbox, since a password reset can wipe useful session data. And ask IT to pause automated clean-up and retention purges for the affected accounts.
Choosing the Right Partner
When shortlisting a Digital Forensic Services Company in India, look past the brochure. Ask how they preserve mailboxes, whether they handle both endpoint and cloud email, how they document custody, and whether their reports have stood up in legal proceedings. If you are facing a live incident, ask for an Email Fraud Investigation in India that covers the whole intrusion, from entry point to financial trail, not just message retrieval.
The Short Version
Email forensics works because digital communication is stubborn. Deleted messages leave shadows in files, servers and logs, and headers record where a message really came from. But those shadows fade quickly, and careless handling can erase them for good.
If you suspect a fraudulent email, an insider leak, or a mailbox that has been quietly tampered with, speak to the forensic team at Everence before anything is deleted or reset. The sooner you preserve the evidence, the more of the story you can tell.