Recover messages deleted from .pst files

Exchange server users may be able to recover deleted items using Deleted Items recovery, if the administrator has it enabled. If it's not enabled, they cannot recover items deleted from Exchange mailboxes. See Recovering Deleted Items in Outlook for details.

The following method is a last ditch effort to recover Outlook items permanently deleted from a pst file. It works only on PSTs but there is no guarantee it will work.

The best way to avoid accidentally deleting items is to turn off the option to empty the deleted items folder on exit and set up AutoArchive to delete older items from the deleted folder every few days.

Things to remember:

1. This works under very limited circumstances
2. If the PST has begun compacting, it will likely fail
3. You're better off NOT emptying the deleted folder until you are sure you won't need the messages
4. Don't store messages in the folder unless you are sure the messages are trash

If, for some reason, you move items to the deleted folder and change your mind after emptying the Deleted Items folder, you may be able to recover the messages under very specific conditions.

When the method below fails, you may be able to recover the deleted message using a commercial product, such as Stellar Phoenix Deleted Email Recovery, Advanced Outlook Repair or Kernel Outlook PST

How Outlook's Deleted Items folder works

A PST is a database. Items are records within the database and there is an index that points to each item. When you empty the Deleted Items folder, Outlook doesn't actually delete the items, it just deletes the items' listings from the index. The item is still in the PST, but unrecoverable because Outlook has no idea where it is without the pointer in the index. The space the item takes up is called "whitespace".

When you Compact a PST, the item is finally removed permanently and the whitespace is recovered, often shrinking the PST by many megabytes. Once the PST has 20% "whitespace", Outlook begins compacting the PST. If the Deleted Items folder contained a lot of messages, Outlook may begin compacting the PST immediately and the items will be deleted forever within a few minutes.

To recover the items which are no longer in the index you need to force Outlook to rebuild the index by causing corruption. You can cause corruption by using a Hex editor to delete some characters from the beginning of the PST file. If you delete the wrong ones you'll cause corruption but not in the index and Outlook won't rebuild the index.

Recover the Deleted Items

If you don't know what a Hex editor is, you probably shouldn't be hex editing anything, but if you want to try, Google for "hex editor" - UltraEdit is probably the best and easiest one to use. Before doing anything to the PST with a Hex Editor, make a copy of the PST, or you may end up losing all of your e-mail.

1. Open the PST in the Hex editor.
2. Delete positions 7 through 13 with the spacebar. Since you're using hexadecimal numbering, this actually clears 13 characters in the following positions:
   00007, 00008, 00009, 0000a, 0000b, 0000c, 0000d
   0000e, 0000f, 00010, 00011, 00012, 00013
   As you clear the characters, the editor displays the code “20” in their position.



3. Save the PST, it is now corrupted.
4. Run the Inbox Repair Tool, SCANPST.exe, to recover the file. Use Windows Search utility to find it. For additional information on the Inbox Repair Tool, see How to use Scanpst.exe to repair Outlook data files or KB 287497
5. The Inbox Repair Tool creates a backup and repairs the damage and recreates the PST.

Open the new PST in Outlook. The Deleted Items folder should now contain the deleted messages, unless Outlook has already deleted them for good by compacting the PST.