If you accidentally delete an email/emails (PST-file) by emptying your “deleted items” folder and don’t have a back up you can use the following steps to recover them.  This can easily happen and is very annoying!

First of all, you will get the best results if you realised immediately and haven’t closed MS Outlook yet or even closed your system down completely!  This will usually mean that Outlook hasn’t already “auto compacted” the email or overwritten the space where the message was being kept.

This method of recovery is basically done by “corruption” of the TOC – Table of Contents, but you are doing it purposely and you will later “rebuild it” with scanpst.ext. Outlook uses the TOC to determine in which folder a message should belong. When a message is deleted, its reference is removed from the TOC but the message leaves a ‘white space’ behind. When the scanpst.exe repairs the TOC, it will come across the deleted message, but isn’t aware that it has been deleted and will put it back into where it was originally deleted from.

How to do it…

  • The recovery needs “Hex Editor” and this comes in various languages and is downloadable for free.
    (Little disclaimer: we have no affiliation with Hex Editor and can’t be responsible for any issues arising from download and installation of third party software. Please always exercise the usual caution and check that you are downloading from a reliable source)

RestoreEmail (1)

  • Identify the location of the *.pst file you have deleted and make a copy of it to work with (Very important note:you don’t want to work with the original one just in case something goes wrong!). The default location for your .pst files is usually within the ‘User Data’ folder and likely to be “C:\Users\[Specific User]\AppData\Local\Microsoft\Outlook
  • Open the *.pst file in the Hex editor.
  • Within the column on the right-hand side, over-write the character position 7 through to 13, including spaces (in the hex system of numbers this equals 13 positions not 6)

RestoreEmail (2)

  • When completed, the hex column (on the left) will then display 20 (hex value for a space). When done correctly, the hexadecimal column (left column) block 7 through 13 will then display 2q (this is the value for “space” in hexadecimal values/language).
  • In versions of HxD, you can alternatively highlight the whole block from 7-13 from the left column and select Edit, then Fill Selection and then select OK. This will automatically fill all the blocks with 00 which works just the same.
  • Then “save” the *.pst file and shut down the Hex Editor.
  • Now as you have corrupted your *.pst file, you will now need to run a scanpst.exe to fix/repair it. This tutorial shows you how to do it.
  • When you have run the scanpst.exe and it has repaired your *.pst file, you now open it in Microsoft Outlook and look for it in the Deleted Items folder or in the original folder in order to locate your originally deleted but now recovered documents!

RestoreEmail (3)

 

 

LEAVE A REPLY


*