When a checkpoint occurs, the data from the WAL
moves into the database.
Now, this is where some of the tools will do strange things.
And this is also something you have to consider on,
is that actually true?
If you have a tool that tells you
it has recovered deleted data from the WAL,
before you report that as deleted data,
search the database and make sure it's still not active
because what will happen is, technically,
Old Page 2 is no longer in use.
So it's untouched.
It's marked as deleted.
But it's not deleted.
It's simply moved its way over to the database.
So the tools aren't wrong.
I've tried to work with the vendors
to correct them on calling data removed from the WAL deleted
because it's just not there.
What happened was a checkpoint occurred,
and it went into the database.
Now, what happens if the user deletes something
from the database?
It would go to the free pages in that database.
It doesn't go back to the WAL.
The WAL is temporary transactions.
Once data moves from the WAL into the database,
it never goes back.
So then, you would have to look at the database in a hex viewer
or carve it somehow to get deleted data from there.
If vacuuming occurs, you're not going to uncover it.
But the WAL may not be vacuumed.
Go check there, and you may see fragments of information that
used to exist in that database.