1. Introduction

Recovery of deleted files refers to the process of retrieving electronic information that has been deleted, erased, overwritten, or made inaccessible from computers, laptops, mobile phones, servers, cloud storage, email accounts, and other digital systems. Deleted files may include employment records, emails, business documents, financial statements, investigation reports, employee communications, and confidential corporate information.

The legality of recovering deleted files depends on who is recovering the files, who owns or controls the device, whether proper authority exists, how the recovery is performed, and how the recovered information is subsequently used.

Recovering deleted files is not automatically illegal. Employers may legitimately recover business records for compliance, litigation, cybersecurity investigations, audits, or internal disciplinary proceedings. However, unauthorised access to personal accounts, circumvention of security controls, unlawful surveillance, privacy violations, or interference with evidence may create civil, criminal, employment, or data-protection liability.

In employment law, this issue is particularly important when an employee deletes company records before resignation, dismissal, an internal investigation, or pending litigation.

2. Legal Framework Governing Recovery of Deleted Files

A. Ownership and authority

An employer may generally recover deleted files from company-owned systems when the recovery is authorised, reasonably necessary, and consistent with applicable law and workplace policies. Ownership of a device, however, does not automatically eliminate an employee's privacy rights.

Where a device is personally owned, or files are stored in a personal email account or private cloud account, the employer may need additional consent, contractual authority, a lawful investigative basis, or judicial authorisation.

B. Privacy and data protection

Recovery may expose personal information, confidential communications, financial data, health information, or legally privileged material. Organisations should therefore restrict recovery to the legitimate purpose, minimise unnecessary access, and protect the recovered data from unauthorised disclosure.

In India, relevant legal provisions may include the Digital Personal Data Protection Act, 2023, to the extent its provisions are in force and applicable, the Information Technology Act, 2000, and applicable rules. Constitutional privacy principles and other sector-specific confidentiality requirements may also be relevant.

C. Criminal investigation and electronic evidence

Law enforcement agencies must comply with applicable statutory powers and procedural safeguards when searching devices, obtaining electronic records, or examining digital evidence. A private employer's authority to investigate company systems is not equivalent to the investigative powers of the police.

In India, the Bharatiya Sakshya Adhiniyam, 2023, contains provisions governing electronic and digital records as evidence. The Bharatiya Nagarik Suraksha Sanhita, 2023, and the Information Technology Act, 2000, may also be relevant, depending on the circumstances.

D. Evidence preservation and chain of custody

Recovered files should be preserved in a manner that supports their authenticity and reliability. Appropriate practices include:

Creating a forensic image where justified and authorised.

Recording the device, storage medium, date, time, and person conducting the recovery.

Calculating cryptographic hashes, such as SHA-256, where appropriate.

Maintaining an access log and chain-of-custody documentation.

Preserving metadata and avoiding unnecessary alteration of original evidence.

Separating privileged or unrelated personal material from relevant business records.

A recovered file is not automatically admissible or conclusive evidence merely because forensic software retrieved it.

3. Important Case Laws on Recovery of Deleted Files

The following decisions establish principles relevant to digital searches, employee monitoring, privacy, and the reliability of electronic evidence. Some concern digital searches or electronic evidence generally rather than deleted-file recovery specifically; their relevance is explained accordingly.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Court: Supreme Court of India Citation: (2017) 10 SCC 1

Facts and legal issue: The case concerned whether privacy is a fundamental right under the Indian Constitution. The Supreme Court considered privacy in the context of personal liberty, dignity, and informational autonomy.

Judgment and legal principle: The Court recognised privacy as a fundamental right under Article 21 and other applicable constitutional freedoms. Informational privacy forms an important part of this protection.

Relevance to deleted-file recovery: Recovery of deleted personal emails, photographs, messages, or documents can interfere with informational privacy. An organisation should identify a legitimate purpose, limit access to what is necessary, and adopt safeguards against misuse.

Legal significance: The decision supports the principle that digital investigations must respect privacy and cannot be justified merely because technical access to data is possible.

Case 2: District Registrar and Collector, Hyderabad v. Canara Bank (2005)

Court: Supreme Court of India Citation: (2005) 1 SCC 496

Facts and legal issue: The case examined the legality of statutory provisions permitting inspection and seizure of private documents maintained by financial institutions.

Judgment and legal principle: The Supreme Court emphasised the protection of privacy and confidentiality in private documents and examined the constitutional limits on governmental access to such records.

Relevance to deleted-file recovery: Recovering deleted records from a business system may be legitimate, but accessing confidential customer files, personal correspondence, or documents held by a third party raises separate legal questions. Appropriate legal authority and safeguards may be required.

Legal significance: The case reinforces that the ability to obtain documents does not eliminate the need to consider privacy, confidentiality, and lawful authority.

Case 3: Anvar P.V. v. P.K. Basheer (2014)

Court: Supreme Court of India Citation: (2014) 10 SCC 473

Facts and legal issue: The dispute involved the admissibility of electronic records and the statutory requirements for proving them in court.

Judgment and legal principle: The Supreme Court established the importance of complying with the electronic-evidence requirements under Section 65B of the Indian Evidence Act, 1872, as it then applied.

Relevance to deleted-file recovery: A recovered email, document, or computer file may be relevant to a legal dispute, but its source, authenticity, and compliance with applicable evidentiary requirements must be established. Merely presenting a recovered file does not automatically prove its contents.

Legal significance: The decision highlights the need to preserve electronic evidence properly and establish its authenticity. The applicable evidence statute has since changed in India, so current proceedings must be assessed under the Bharatiya Sakshya Adhiniyam, 2023, including its applicable electronic-record provisions.

Case 4: Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

Court: Supreme Court of India Citation: (2020) 7 SCC 1

Facts and legal issue: The Court considered the certification requirements for electronic records under Section 65B of the Indian Evidence Act.

Judgment and legal principle: The Supreme Court reaffirmed the mandatory nature of the applicable Section 65B certificate for secondary electronic evidence, subject to the legal qualifications explained in the judgment.

Relevance to deleted-file recovery: When recovered digital material is submitted in court, the party relying on it must comply with the evidence law applicable to the proceeding. A forensic recovery report, technical logs, and preserved copies may help establish provenance, but they do not automatically replace statutory requirements.

Legal significance: The case demonstrates why recovery procedures should be documented and electronic records should be preserved in a form suitable for later verification.

Case 5: Riley v. California (2014)

Court: Supreme Court of the United States Citation: 573 U.S. 373 (2014)

Facts and legal issue: Police searched digital information on mobile phones seized during arrests without obtaining search warrants.

Judgment and legal principle: The Court held that police generally must obtain a warrant before searching digital information on a mobile phone seized from an arrested person, unless an applicable exception exists.

LII / Legal Information Institute

+1

Relevance to deleted-file recovery: The decision illustrates the heightened privacy concerns associated with digital devices. A search for deleted files on a personal phone may expose extensive private information unrelated to the investigation.

Legal significance: Although this is a United States constitutional decision, not a rule governing every private employer or Indian investigation, it provides an important comparative principle: access to a device does not automatically authorise unrestricted access to all its digital contents.

Case 6: Bărbulescu v. Romania (2017)

Court: European Court of Human Rights, Grand Chamber Application No.: 61496/08

Facts and legal issue: An employer monitored an employee's electronic communications, and the employee challenged the interference with his privacy.

Judgment and legal principle: The Court examined whether the national courts had adequately balanced the employee's privacy rights against the employer's legitimate interests. Relevant considerations include prior notice, the extent of monitoring, the reasons for it, and the availability of less intrusive measures.

hudoc.echr.coe.int

+1

Relevance to deleted-file recovery: An employer investigating deleted workplace records should consider whether the employee was informed of monitoring policies, whether the recovery is necessary, and whether a narrower investigation could achieve the same objective.

Legal significance: The case provides a useful framework for evaluating proportionate workplace investigations involving electronic records. It does not establish an unrestricted right for employers to recover or inspect private files.

Case 7: López Ribalda and Others v. Spain (2019)

Court: European Court of Human Rights, Grand Chamber Applications Nos.: 1874/13 and 8567/13

Facts and legal issue: Employees challenged covert video surveillance introduced by an employer investigating suspected theft.

Judgment and legal principle: The Grand Chamber found no violation of Article 8 in the circumstances before it, taking account of factors including the serious suspicion of theft, the limited scope and duration of surveillance, and the safeguards considered by the Court.

hudoc.echr.coe.int

+1

Relevance to deleted-file recovery: The decision illustrates that investigative measures may sometimes be justified without ordinary advance notification, but their legality depends on the circumstances and applicable safeguards. It should not be interpreted as blanket permission for covert access to deleted files.

Legal significance: Employers should document the reasons for an investigation, limit its scope, and assess proportionality rather than assuming that suspicion alone authorises every investigative method.

4. When Is Recovery of Deleted Files Legal?

The legality of recovery depends on the circumstances in which the files are obtained and used.

5. Recovery of Deleted Files in Employment Investigations

Employers frequently need to recover deleted files when investigating suspected misconduct, data theft, unauthorised disclosure, or destruction of business records.

A lawful investigation should ordinarily follow these steps:

Establish authority: Confirm ownership or lawful control of the system and identify the policy, consent, contractual basis, or legal power authorising access.

Define the purpose: Identify the specific records required, such as missing employment documents, financial records, or communications concerning a suspected incident.

Preserve the evidence: Prevent automatic deletion or overwriting where lawful and technically feasible.

Use qualified personnel: Employ authorised IT or forensic specialists and avoid unnecessary access to unrelated personal material.

Document the process: Record the recovery method, dates, personnel, tools used, and any relevant integrity checks.

Protect recovered data: Restrict access, maintain confidentiality, and retain records only as permitted or required by law.

Assess the evidence fairly: Give affected employees any procedural protections required by applicable employment law, contracts, or workplace policies.

For example, if an employee deletes client records from an employer-owned laptop before resigning, the employer may have a legitimate reason to recover those records. However, this does not automatically authorise unrestricted access to the employee's personal email, private cloud account, or unrelated personal files.

6. Legal Consequences of Unlawful Recovery

Unlawful recovery or misuse of deleted files may result in:

Criminal liability: Where the conduct satisfies the elements of an applicable offence, such as unauthorised computer access, unlawful interception, or destruction of evidence.

Civil liability: Claims for breach of privacy, confidentiality, contract, or other legally protected interests.

Employment consequences: Disciplinary proceedings or challenges to an investigation or dismissal.

Evidentiary consequences: Disputes over authenticity, reliability, admissibility, or the legality of obtaining the material.

Regulatory consequences: Penalties or corrective measures where applicable data-protection or sector-specific requirements have been violated.

The precise consequences depend on the jurisdiction and facts. Unlawful acquisition does not automatically make evidence inadmissible in every legal system, just as lawful recovery does not automatically guarantee admissibility.

7. Best Practices for Organisations

Organisations should maintain a documented electronic-record recovery policy covering:

Authorised personnel and permitted recovery tools.

Employee notice and monitoring policies.

Procedures for personal devices and mixed-use systems.

Litigation holds and records-retention schedules.

Forensic integrity, audit trails, and chain of custody.

Access restrictions for sensitive and privileged information.

Cross-border transfers and access to cloud-hosted data.

Secure deletion and disposal once retention is no longer required.

These controls reduce the risk of privacy violations, unreliable evidence, and disputes concerning the legitimacy of an investigation.

8. Conclusion

The recovery of deleted files is a legitimate and often necessary activity in business operations, cybersecurity, regulatory compliance, and litigation. Nevertheless, technical recoverability is not the same as legal permission.

The decisions in Puttaswamy, Anvar P.V., Arjun Panditrao Khotkar, Riley v. California, and Bărbulescu v. Romania, among others, illustrate the importance of privacy, lawful access, proportionate investigations, and reliable electronic evidence.

The central legal principle is that deleted files should be recovered only under appropriate authority, for a legitimate purpose, through proportionate methods, and with safeguards that preserve privacy and evidentiary integrity.

Jurisdictional note: This discussion uses Indian law as its primary reference point, with comparative decisions from other jurisdictions. The foreign judgments are persuasive illustrations rather than automatically binding Indian precedents. Specific advice requires consideration of the applicable statute, current law, and circumstances of the recovery.