Email Forensics & Email Recovery

Email is everywhere.  Critical to almost every business -- and often a key component of legal cases -- email and email forensics can completely change the tide of a case if that one game-changing email is recovered.

Atlantic Data Forensics has extensive expertise in every area of email analysis, from recovery of deleted emails to handling hundreds of gigabytes of Microsoft Outlook/Exchange, Lotus Notes, GroupWise and Bloomberg mail.  Our computer forensics and e-discovery experts will identify and extract the necessary email from any of these servers, services, and tape backups. 

ADF can also recover email messages, calendar entries, contacts, tasks and more from user hard drives.  Using advanced culling techniques we can de-duplicate email across custodians or groups, establish timelines of events, and create visual maps of how email transactions between custodians played out.  If you need to follow email threads or perform near-duplicate reduction on sets of email, Atlantic Data Forensics is ready to help with the latest email processing and e-discovery technologies.

At the corporate level, we can recover emails from a specific employee, a back-and-forth exchange between two individuals, a group, or even an entire department by investigating the contents of your mail server(s). If your organization uses an email backup system, such as tape, we can use it to restore earlier versions of emails, even if the email in question is no longer on your server.

If you need to access content of emails that are sent via a website (webmail) -- meaning, email that is generated and sent via an internet-based service like Yahoo, Gmail, Hotmail, or AOL mail -- we can help.  Depending on circumstance, court orders or consent can be obtained that will enable full access, or targeted / limited access for those instances where personal and professional may have overlapped.

It should also be noted that many webmail users store web-based emails and contents such as attachments, calendar items, and to-do tasks on their own computer hard drives or smartphones, making it possible to recover email and perform analysis at the hard drive or smartphone level. 


  • Further your computer forensic investigation by reviewing emails in their entirety, including the rarely-reviewed technical header information to show how an email got from point A to point B.
  • Handle a variety of different email platforms and file formats to find digital evidence located within emails and attachments for your legal matter.
  • Provide accurate digital evidence recovery by using the most up-to-date scanning and recovery algorithms, as well as fast searches to quickly analyze specific emails from within a single user's mailbox to a million+ email items.
  • Get legal proof of email content in its entirety, prove or disprove authenticity, and preserve all available evidence.
  • Save all recovered emails, store them in a properly formatted evidence list, and export it to any format (MSG, EML, PST, MBOX, etc.) or review platform (kCura Relativity, LexisNexis Concordance, FTI Ringtail, IPRO, etc.) required.

Call us today to discuss your email e-discovery or forensics matter.