Exactly right. First, there will be a log of the transactions that can be replayed backwards to reinstate the data. Second, there will be regular backups with off-site storage so that, usually after a short delay, a previous situation can be installed then the logs used again to move forwards to the correct time.

I am always amazed that people can get away with saying they deleted emails. First, there are the people those emails were sent to. They will have copies and then there will be the usual back-up systems in place. Often, a user will not even know where the data is stored but no-one ever seems to look.