Hello: I am new to the forum and to using Autopsy for forensic investigation. I am just learning to use Autopsy. My question is about recovery of old email. I made an image of my new ssd drive that a relatively fresh install of windows 10. When I ran autopsy I was surprised to find it had found my emails from as far back as 2013. I don’t understand how autopsy can find email deleted many years ago. All my hard drives and ssd in my pc have be changed over the past 2 years. How is this possible to recover such old emails.
I had the same experience (several hundred thousand) with a .dd of my C:\ boot drive. I do not use this drive for storage, but it is my default Downloads drive before I off load to separate drive. It has been awhile, but I belie many were culled out of documents and saved web pages.
Repeated formatting and OS installs did not negate this. Had I wiped the drive (e.g. DBAN) it likely would have obliterated them.