You can issue the GETDELETED query to retrieve all records deleted from the live data for the time range specified. This query accepts a datetime value as a filter, as shown in the following example:

GETDELETED FROM <table_name> WHERE <search_condition>

<search_condition> ::= 
  {
    <expression> { = | < | <= | > | >= } [ <expression> ] 
  } [ { AND | OR } ... ]

<expression> ::=
  | @ <parameter> 
  | ?
  | <literal>
  

C#

String connectionString = "User=MyUser;Password=MyPassword;URL=https://MyInstance12345.service-now.com/;";
using (ServiceNowConnection connection = new ServiceNowConnection(connectionString)) {
  ServiceNowCommand cmd = new ServiceNowCommand("GETDELETED FROM incident WHERE sys_updated_on >= '2013-01-01'", connection); 
  ServiceNowDataReader rdr = cmd.ExecuteReader();
  while (rdr.Read()) {
    Console.WriteLine(rdr["sys_id"].ToString());
  }
}

VB.NET

Dim connectionString As [String] = "User=MyUser;Password=MyPassword;URL=https://MyInstance12345.service-now.com/;"
Using connection As New ServiceNowConnection(connectionString)
  Dim cmd As New ServiceNowCommand("GETDELETED FROM incident WHERE sys_updated_on >= '2013-01-01'", connection)
  Dim rdr As ServiceNowDataReader = cmd.ExecuteReader()
  While rdr.Read()
    Console.WriteLine(rdr("sys_id").ToString())
  End While
End Using

Note: By putting a CACHE command in front of the query, you can update the cache to remove all values that have been deleted from the data source, as shown in the following example:

CACHE GETDELETED FROM [TableName] WHERE sys_updated_on >= '2013-01-01' AND sys_updated_on <= '2013-02-01'