Recovering Deleted Items in Outlook

I had questions recently inquiring about recovering deleted email. The questions weren’t from users who wanted to recover accidentally deleted email, but from users who receive sensitive information by email, including personal information and credit card numbers, and need to comply with laws addressing the security of personal information in the event of a data breach. They are aware that forensic methods exist that can recover deleted files from a hard drive but wanted to know if an average (or above average) user or a hacker could recover messages after the Deleted items folder is emptied.

To recover deleted items in the Deleted Items folder, close the reading pane, add the Modified date field to the view and sort by it. Find the approximate date you deleted the items. To find deleted appointments or contacts, sort by the icon field.

If you use a POP3 account, no, a hacker can’t easily recover your deleted items – and neither can you. If you use IMAP or MSN, deleted items can’t easily be recovered from the local store, but you’ll need to verify they were deleted from your mailbox online. If you use Exchange mailbox, its possible the messages are stored on the server for a period of time before they are presently deleted. If so, they will be easily recovered by anyone with access to your mailbox.

When Outlook is configured to use a PST and you use Shift+Delete (recommended for messages you don’t want recovered) or Delete then empty the Deleted items folder, someone would need to use a third party application to have any chance of recovering the messages. As time passes and new mail arrives or after the PST is compacted, the ability to recover deleted messages go down dramatically. Compacting the data file after emptying the Deleted items folder will eliminate the ability to recover deleted items.

Recovering Deleted items in Exchange Server accounts

Using Outlook with Exchange complicates matters. If the network is secure, the data will be secure but there are more places where the messages may be stored. If the user deleted the items using Shift+Delete, they may look deleted but will be accessible in Recover Deleted Items when the DumpsterAlwaysOn key is enabled. Deleted items may be covered by a Deleted Item Retention policy in Exchange, preventing the user from deleting the messages from Recover Deleted Items. If the organization archives messages as they arrive they could be somewhere in the network. So many places to look, but with proper network security, the data will be secure and users will be compliant with existing laws.

DumpsterAlwaysOn

This key is valid in all versions of Outlook when used with Exchange server mailboxes. In Outlook 2007 and 2010, you do not need to add the key to the registry in order to be able to recover data from any folder in the default mailbox. Setting this value in Outlook 2007 enables deleted items recovery for secondary mailboxes.

With this value set to 1, you can use the recover deleted items while viewing any folder. Set the value to 0 to disable it for folders other than the Deleted items folder.

To set the DumpsterAlwaysOn key, open the registry editor and browse to

HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\Client\Options
DWORD: DumpsterAlwaysOn
Value: 1

If you don’t want to edit the registry, you can use this file to set it: DumpsterAlwaysOn registry file.

Because this registry key is in the Local Machine hive, you’ll need to save the file then run it from your hard drive. Right click on it and choose Save target as… then use Open folder and double click on the downloaded file.

Restart Outlook and you’ll be able to recover newly deleted items from any folder in Outlook.

DumpsterControl

Use DumpsterControl to remove the Recover Deleted Items command on the Tools menu by adding the DWORD value “DumpsterControl” to the registry and setting its value to 0.

Browse to the following registry key using regedit:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options
DWORD: DumpsterControl
Value: valid numbers are 0, 1, 2, or 3

Valid Value data are:

0 – Off for Exchange mailbox folders, for PST folders, and for public folders.
1 – On for Exchange mailbox folders, for PST folders, and for public folders.
2 – On for Exchange mailbox folders and for public folders. Off for PST folders.
3 – On for the “Deleted Items” folder in a Microsoft Exchange mailbox and for public folders. Off for all other folders in an Exchange mailbox and for PST folders.

If you don’t want to edit the registry, you can use this file to set the value to 0: DumpsterControl. Note: Because this registry key is in the Local Machine hive, you’ll need to save the file then run it from your hard drive. Right click on it and choose Save target as… then use Open folder and double click on the downloaded file. You can edit the file using notepad before running if you want to use a different data value.

Note: I’m not sure why PST files are included in the menu settings as you cannot recover deleted items from a .pst file because the “Dumpster” is an Exchange feature.

If you use Outlook 2007 SP2 or later, you just need to set the registry value; if you use a pre-SP2 build, you will need the hotfix described in The “Recover Deleted Items” option in Outlook 2007 is still available after you set the DumpsterAlwaysOn registry entry to 0.

OWA

In Exchange 2010, you can items deleted using Shift+Delete by right clicking on the Deleted Items folder and choosing Recover Deleted items.

In Exchange 2007, go to Options, Deleted items to view your deleted items that are available for recovery.

In Exchange 2003, add cmd=showdeleted to your OWA url to access deleted items recovery.

Related Posts:

1. 

   Recover Deleted Items in OWA 2010
2. Under certain conditions, Exchange server users testing Outlook 2013 d

   Outlook 2013 bug: Emptying Deleted Items deletes everything (Fixed)
3. How to store deleted items in the deleted folder in the owner's mailbo

   Shared Mailboxes and the Deleted Items Folder
4. 

   Using Outlook's AutoArchive Feature