Corporations use e-mail as their primary method for internal communication and business processes. By their nature, the e-mails are in general used for major business processes that contain large amounts of business information. When there is a critical event, such as Technology leakage, an e-mail message can become important evidence. However, as there is a high likelihood that a suspect will intentionally erase an e-mail message, the ability to recover deleted e-mail is very important. This pater analyzes the deleted e-mail item structure in files of various e-mail clients, and explains the possibility and methods of recovery.