The “hard drive” issue is a major “squirrel”.
The emails weren’t on any workstation “hard drive”.
Yes and no. Digging for any data that can be recovered is priority. Finding if there is intentional destruction of records that are by statute to be preserved is also important.
I will be worried if next round does not go to servers and archiving.