It isn’t a fixed amount of time, it depends on many factors which include how many copies of the deleted record are still on the disk in live blocks or free blocks that haven’t been overwritten.
The “Tomb Raider” is a periodic device scan that does a mark and sweep style GC of tombstones. Only when the disk scan finds that a digest no longer exists on any device does Aerospike know that the record is truly removed from the local machine. At which time the tombstone may be removed if eligible based on tomb-raider-eligible-age.
If a node was taken offline prior to a record being deleted and that node returns to the cluster after tomb-raider-eligible-age seconds then that returning node could resurrect the record. To prevent this, you should zeroize a node when it has been down for more then tomb-raider-eligible-age seconds.
No, you cannot recover a record that has been durably deleted. BTW, the tomb-raider doesn’t remove data, it is just checking if the record has been overwritten by other processes - such as defrag writes, client writes, replica writes, etc.