I suspect that it really might have been 'buried deep'. If you are capturing the data short term, to allow a small scroll back, then you wrote the data to some storage system. At three hours or whatever the short term storage limit is, you delete the file. Usually deleting a file leaves the data intact on the storage device. Only the file entry and a list of what low level storage blocks actually contained data. It could take awhile before the data is actually overwritten. Up until the point it is, you could scan the contents of unallocated blocks looking for the data. It could theoretically take awhile to find a customer id or something else that helps you identify the deleted data.