Bookmark / Share this snowchick7669
06-29-2009, 08:13 PM
Have had previous experience with trying to recover emails that client's have deleted out of their 'Deleted Items' folder sometimes even dating back a few months. Thought I would share a simple trick that can be used.
I actually managed to find an article about this on a forensic site but then adjusted it after attempting the procedure and found out things that can be tweaked. This can be used for 2003 and 2007 (the pst scanner is just in a different folder).
Cannot 100% guarantee that it will bring back every deleted email, as they may have been overwritten. But however I have had rather good results with this guide.
This guide is on Outlook 2007
So we’ll first need to “corrupt” our PST file to have ScanPST reclaim our “deleted” emails.
0. Take a backup of the PST file! (seriously)
1. Open the PST in the Hex editor of your choice (I used HxD by Maël Hörz)
2. Delete positions 7 through 13 with the spacebar (or if that fails to work then just replace each number with 20).
You actually delete 13 characters that make up:
00007, 00008, 00009, 0000a, 0000b, 0000c, 0000d
0000e, 0000f, 00010, 00011, 00012, 00013
I actually found that I just deleted the characters through to 0009 and it worked fine.
Tried deleting all the way to 00013 and it corrupted the file beyond repair (oops)
3. Save the PST, it is now corrupted.
4. Run the Inbox Repair Tool, SCANPST.exe, to recover the file. Found in C:\Program Files\Microsoft Office\Office11/12 for Outlook 2007. Found in C:\Program Files\Common Files\System\MSMapi\1033 for Outlook 2003
5. The Inbox Repair Tool creates a backup and repairs the damage and recreates the PST.
6. Then import the new PST into outlook and you should see all the emails in 'Deleted Items'
NOTE: This does not work if the PST file has been compacted (removes the space occupied by the flagged emails). Outlook with automatically compact the outlook folder if it reaches 2GBs
I actually managed to find an article about this on a forensic site but then adjusted it after attempting the procedure and found out things that can be tweaked. This can be used for 2003 and 2007 (the pst scanner is just in a different folder).
Cannot 100% guarantee that it will bring back every deleted email, as they may have been overwritten. But however I have had rather good results with this guide.
This guide is on Outlook 2007
So we’ll first need to “corrupt” our PST file to have ScanPST reclaim our “deleted” emails.
0. Take a backup of the PST file! (seriously)
1. Open the PST in the Hex editor of your choice (I used HxD by Maël Hörz)
2. Delete positions 7 through 13 with the spacebar (or if that fails to work then just replace each number with 20).
You actually delete 13 characters that make up:
00007, 00008, 00009, 0000a, 0000b, 0000c, 0000d
0000e, 0000f, 00010, 00011, 00012, 00013
I actually found that I just deleted the characters through to 0009 and it worked fine.
Tried deleting all the way to 00013 and it corrupted the file beyond repair (oops)
3. Save the PST, it is now corrupted.
4. Run the Inbox Repair Tool, SCANPST.exe, to recover the file. Found in C:\Program Files\Microsoft Office\Office11/12 for Outlook 2007. Found in C:\Program Files\Common Files\System\MSMapi\1033 for Outlook 2003
5. The Inbox Repair Tool creates a backup and repairs the damage and recreates the PST.
6. Then import the new PST into outlook and you should see all the emails in 'Deleted Items'
NOTE: This does not work if the PST file has been compacted (removes the space occupied by the flagged emails). Outlook with automatically compact the outlook folder if it reaches 2GBs
Post a reply, see related topics & more