Last reviewed on October 9, 2014   —  23 Comments

I had questions recently inquiring about recovering deleted email. The questions weren’t from users who wanted to recover accidentally deleted email, but from users who receive sensitive information by email, including personal information and credit card numbers, and need to comply with laws addressing the security of personal information in the event of a data breach. They are aware that forensic methods exist that can recover deleted files from a hard drive but wanted to know if an average (or above average) user or a hacker could recover messages after the Deleted items folder is emptied.

To find specific items in the Deleted Items folder of an Exchange mailbox when you know approximately when you deleted them, close the reading pane, add the Modified date field to the view and sort by it. Find the approximate date you deleted the items. To find deleted appointments or contacts, sort by the icon field. Note that this will not work with .pst files, you’ll need to find the deleted items yourself.

If you use a POP3 account, no, a hacker can’t easily recover your deleted items – and neither can you. If you use IMAP or MSN, deleted items can’t easily be recovered from the local store, but you’ll need to verify they were deleted from your mailbox online. If you use Exchange mailbox, its possible the messages are stored on the server for a period of time before they are permanently deleted. If so, they will be easily recovered by anyone with access to your mailbox.

When Outlook is configured to use a PST and you use Shift+Delete (recommended for messages you don’t want recovered) or Delete then empty the Deleted items folder, someone would need to use a third party application to have any chance of recovering the messages. As time passes and new mail arrives or after the PST is compacted, the ability to recover deleted messages go down dramatically. Compacting the data file after emptying the Deleted items folder will eliminate the ability to recover deleted items.

Recovering Deleted items in Exchange accounts

Items deleted from Outlook and Exchange server mailboxes complicates matters and it’s more likely you’ll be able to recover the deleted items. If the network is secure, the data will be secure but there are more places where the messages may be stored. If the user deleted the items using Shift+Delete, they may look deleted but will be accessible in Recover Deleted Items when the DumpsterAlwaysOn key is enabled.

recovered deleted items

Deleted items may be covered by a Deleted Item Retention policy in Exchange, preventing the user from deleting the messages from Recover Deleted Items. If the organization archives messages as they arrive they could be somewhere in the network. So many places to look, but with proper network security, the data will be secure and users will be compliant with existing laws.

DumpsterAlwaysOn

This key is valid in all versions of Outlook when used with Exchange server mailboxes. In Outlook 2007 and 2010, you do not need to add the key to the registry in order to be able to recover data from any folder in the default mailbox. Setting this value in Outlook 2007 enables deleted items recovery for secondary mailboxes.

With this value set to 1, you can use the recover deleted items while viewing any folder. Set the value to 0 to disable it for folders other than the Deleted items folder.

To set the DumpsterAlwaysOn key, open the registry editor and browse to

HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\Client\Options
DWORD: DumpsterAlwaysOn
Value: 1

If you don’t want to edit the registry, you can use this file to set it: DumpsterAlwaysOn registry file.

Because this registry key is in the Local Machine hive, you’ll need to save the file then run it from your hard drive. Right click on it and choose Save target as… then use Open folder and double click on the downloaded file.

Restart Outlook and you’ll be able to recover newly deleted items from any folder in Outlook.

DumpsterControl

Use DumpsterControl to remove the Recover Deleted Items command on the Tools menu by adding the DWORD value “DumpsterControl” to the registry and setting its value to 0.

Browse to the following registry key using regedit:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options
DWORD: DumpsterControl
Value: valid numbers are 0, 1, 2, or 3

Valid Value data are:

0 – Off for Exchange mailbox folders, for PST folders, and for public folders.
1 – On for Exchange mailbox folders, for PST folders, and for public folders.
2 – On for Exchange mailbox folders and for public folders. Off for PST folders.
3 – On for the “Deleted Items” folder in a Microsoft Exchange mailbox and for public folders. Off for all other folders in an Exchange mailbox and for PST folders.

If you don’t want to edit the registry, you can use this file to set the value to 0: DumpsterControl. Note: Because this registry key is in the Local Machine hive, you’ll need to save the file then run it from your hard drive. Right click on it and choose Save target as… then use Open folder and double click on the downloaded file. You can edit the file using notepad before running if you want to use a different data value.

Note: I’m not sure why PST files are included in the menu settings as you cannot recover deleted items from a .pst file because the “Dumpster” is an Exchange feature.

If you use Outlook 2007 SP2 or later, you just need to set the registry value; if you use a pre-SP2 build, you will need the hotfix described in The “Recover Deleted Items” option in Outlook 2007 is still available after you set the DumpsterAlwaysOn registry entry to 0.

OWA

In Exchange 2010, you can items deleted using Shift+Delete by right clicking on the Deleted Items folder and choosing Recover Deleted items.

In Exchange 2007, go to Options, Deleted items to view your deleted items that are available for recovery.

In Exchange 2003, add cmd=showdeleted to your OWA url to access deleted items recovery.

Comments

  1. regular surf says

    For Diane,

    I emptied several folders in Outlook to other folders and then immediately deleted the folder name. Despite the warning that mail in deleted folders would go to the "Deleted" folder, nothing went there, and my moved mail did not show up in the chosen destination folder.

    Help?

    • Diane Poremsky says

      Check from the Folder list - the folders may be hidden when you are in the mail navigation pane. Ctrl+6 will open the folder list and you can see if they are in the deleted items folder. If you have more than one data file in your profile, check each one.

      If the missing folders are not there, what type of email account are you using?

    • Paul says

      I just synced outlook 2010 with my Nexus 7 using Local Sync and it copied across contacts that I deleted years ago, I don't mean last year, I mean 6 or 7 years ago - they don't show in my Outlook contact on my desktop so where is it dragging them from? There has to be some back door that has been left open.

    • Diane Poremsky says

      Did you have an archive pst in your profile? Can you find them in outlook if you search for them? (They are somewhere in outlook or on the phone.)

    • Paul TW says

      I have searched for pst files as well as ost and pab files, even nk2 files and found nothing - unless archive pst have a different extension? The thing is during the last 6 years I have changed my computer 3 times and gone through 3 operating systems, all with a clean install, so I can't see how any stuff that is 6/7 years old is being brought forward - but of course it is.

    • Diane Poremsky says

      What type of email account? Was the data on the phone? If Apple, it could be stored in iCloud, if android, stored in gmail. in either, stored in a backup file system offered by your phone service.

    • Paul TW says

      Currently it is Gmail, but years ago it was Bigfoot - my phone is WM6 and contacts have never been stored anywhere else apart from the synching with Outlook - I have not even stored them on my SIM card. I have never used a backup system for my phone or Outlook. All I do is save a copy of the PST to a separate thumb drive, which I update every 3/4 weeks, this overwrites it each time

    • Diane Poremsky says

      There are only a few places the contacts can come from: outlook, the phone, or one of the accounts (like outlook.com/Hotmail) that syncs with the phone and/or outlook.

  2. David Robert Lee says

    This post (and answer to my query, which was "how to retrieve deleted appointments") was not spoken to at ALL. MS is so intent on driving us onto their email handling function that apparently you forget that Outlook is, first and foremost, a calendar and contacts list. That is ALL I use if for. I have lots of other email modalities, thank you very much.

    Someone (who - must - no. really. be certifiable - is he/she TRYING to drive us to apple?) decided to eliminate the "recently deleted" set of functions, when they brought out OL 2010. My assistant has managed to eliminate all the court dates for a given day, and I am seeking to retrieve them if at all possible. Otherwise I am faced with looking at each of several hundred files to determine if they were the lucky winners. Or missing the court date myself AND failing to remind my clients that they needed to be there = VALID greivance (and if it ain't, it oughta be valid), having to make bond for them, soothe ruffled feathers etc.

    • Diane Poremsky says

      IF (and only if) you use Exchange server mailboxes, and the deleted items folder was emptied, there is a Recover Deleted Items command which has recently deleted items. It is an Exchange server feature. It's on the Folder tab when you view the Mail module.

      Outlook has never had an option to recover items deleted from other mailboxes, at least not after the deleted items folder was emptied. If the items are in the deleted items folder, you can sort by the last modified date or icon to find them.

    • Diane Poremsky says

      The default value in Outlook 2013 (as well as in 2010/2007) should be dumpsteralwayson = enabled but if its not working, or you want to disable it, the key will work in 2013.

  3. Eliizabeth Tisseverasinghe says

    Hello - I want to know how to recover a saved deleted message from the main menu in the computer.

    • Diane Poremsky says

      If the deleted messages are not in the deleted items folder, you can only recover the messages if you use Exchange and deleted items recovery is enabled. Then you'd use the recover deleted items command.

  4. Jay Mal says

    Hello I use exchange and there is a recover deleted items section for items deleted out of the deleted items folder, but is there a way to recover "purged" mail items? (items deleted from that recover deleted list" if not, is there a log to see when and who mail was sent to

    • Diane Poremsky says

      generally speaking, items deleted from that list are deleted, but the exchange admin does have some control over, so its possible they could be recoverable. Unfortunately, there is not a log for the deleted items.

  5. Natalie says

    If I deleted all the messages and then emptied the deleted messages and continued into recover and also deleted them from there would anyone then be able to recover them at that point.

    • Diane Poremsky says

      They would be in the Exchange backup files, so depending on how often the backups are recycled, the administrator could possibly restore an old database and recover the deleted items. It's not something they would do without reason though.

  6. norma khoury says

    Hello,
    I have a hotmail account and I'm worried that my deleted emails could be recovered from my hardware. Is there a reliable way to remove them permanently with no possible way to retrieve them?

    • Diane PoremskyDiane Poremsky says

      If you are using the outlook connector or eas account, and as long as you are not copying them to a pst file, once they are deleted from Hotmail and the deleted folder (at outlook.com) is emptied, they are gone from the server. delete the ost file from your computer and they are gone from the computer. if you are copying to a pst, you need to delete the pst.

  7. Duncan says

    When restoring deleted items in Outlook 2013 using Exchange, is there a log entry created by default ? If so where does this log file reside ? Unfortunately I believe the troubleshooting logging was turned off when this even occurred.

Leave a Reply

Please post long or more complicated questions at OutlookForums by Slipstick.com.

If the Post Comment button disappears, press your Tab key.