This is probably legit.
I am a recovery shop... While I am a full service shop, hard drives and storage devices are my specialty. The thing folks may not understand is that the various methods used require some sort of examination of the data to see how well the data is being recovered (I can give you data back with ease - whether that data is legible is the trick).
One of the ways that I commonly survey that data is with a folder full of pics. I will pull that folder up with a tool I have (Irfanview) to survey all the pics in that folder in a sort of thumbnail view. I am not generally interested in the pics themselves, but rather, whether those picks exhibit substantial 'grayed areas' where the pic is being translated poorly, showing a problematic data pull. if there is a pattern of grayed pics or portions of pics grayed the same way, then I know I have to work on my technique and try again...
So by the time I know I CAN recover data to call the folks with a price, I already have a pretty good idea of HOW to recover, and may already have a partial or full recovery sitting in my server.
Often folks are not willing to pay that price and if that is the case (which is often), they just won't give me the go-ahead, and I will sit on that machine for the 120 days it takes to claim a mechanic's lien, at which point I own the machine and the data on it.. Normally that means I rub it off and reinstall the system, or replace the hard drive and reinstall the system so that I can recoup some of the time value I have in the recovery attempt by selling the used machine.
But the point is, it is almost impossible for me to survey vid or photo thumbnails without getting a general idea of what those pics portray.
I consider my clients privacy to be paramount, but I often find out their predilections and perversions as part of the normal processes necessary to recovery or even in normal machine maintenance.
The underlying question: YES, I have recovered machines and turned them over to law enforcement. There is a line I will not cross wrt privacy, and for me that is often pedophilia. I can't say it happens often. but it has happened more than a few times.
So how this whole thing sounds to me is that the cost of recovery was more than the client cared to pay, so he let the machine languish rather than pay the (likely very expensive) bill. Where upon the machine ownership passed to the shop.
Still, detailed knowledge of the email - while not exactly abnormal - suggests a voyeurism or political activism where the shop owner knew he had dirt to send up the pipe. Not exactly true - I have perused emails when the client was particular about their importance - but kinda unusual.
Still legit, mind you... but I wonder whether it was law enforcement or the tech shop that found all that detail.
