I had questions recently inquiring about recovering deleted email. The questions weren't from users who wanted to recover accidentally deleted email, but from users who receive sensitive information by email, including personal information and credit card numbers, and need to comply with laws addressing the security of personal information in the event of a data breach. They are aware that forensic methods exist that can recover deleted files from a hard drive but wanted to know if an average (or above average) user or a hacker could recover messages after the Deleted items folder is emptied.
To find specific items in the Deleted Items folder of an Exchange mailbox when you know approximately when you deleted them, close the reading pane, add the Modified date field to the view and sort by it. Find the approximate date you deleted the items. To find deleted appointments or contacts, sort by the icon field. Note that this will not work with .pst files, you'll need to find the deleted items yourself.
If you use a POP3 account, no, a hacker can't easily recover your deleted items - and neither can you. If you use IMAP or MSN, deleted items can't easily be recovered from the local store, but you'll need to verify they were deleted from your mailbox online. If you use Exchange mailbox, its possible the messages are stored on the server for a period of time before they are permanently deleted. If so, they will be easily recovered by anyone with access to your mailbox.
When Outlook is configured to use a PST and you use Shift+Delete (recommended for messages you don't want recovered) or Delete then empty the Deleted items folder, someone would need to use a third party application to have any chance of recovering the messages. As time passes and new mail arrives or after the PST is compacted, the ability to recover deleted messages go down dramatically. Compacting the data file after emptying the Deleted items folder will eliminate the ability to recover deleted items.
Recovering Deleted items in Exchange accounts
Items deleted from Outlook and Exchange server mailboxes complicates matters and it's more likely you'll be able to recover the deleted items. If the network is secure, the data will be secure but there are more places where the messages may be stored. If the user deleted the items using Shift+Delete, they may look deleted but will be accessible in Recover Deleted Items when the DumpsterAlwaysOn key is enabled.
Deleted items may be covered by a Deleted Item Retention policy in Exchange, preventing the user from deleting the messages from Recover Deleted Items. If the organization archives messages as they arrive they could be somewhere in the network. So many places to look, but with proper network security, the data will be secure and users will be compliant with existing laws.
DumpsterAlwaysOn
This key is valid in all versions of Outlook when used with Exchange server mailboxes. In Outlook 2007 and newer, you do not need to add the key to the registry in order to be able to recover data from any folder in the default mailbox.
Setting this value in Outlook 2007 and up enables deleted items recovery for shared mailboxes.
With this value set to 1, you can use the recover deleted items while viewing any folder. Set the value to 0 to disable it for folders other than the Deleted items folder.
To set the DumpsterAlwaysOn key, open the registry editor and browse to
HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\Client\Options DWORD: DumpsterAlwaysOn Value: 1
If you don't want to edit the registry, you can use this file to set it: DumpsterAlwaysOn registry file.
Because this registry key is in the Local Machine hive, you'll need to save the file then run it from your hard drive. Right click on it and choose Save target as... then use Open folder and double click on the downloaded file.
Restart Outlook and you'll be able to recover newly deleted items from any folder in Outlook.
DumpsterControl
Use DumpsterControl to remove the Recover Deleted Items command on the Tools menu by adding the DWORD value "DumpsterControl" to the registry and setting its value to 0.
Browse to the following registry key using regedit:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options DWORD: DumpsterControl Value: valid numbers are 0, 1, 2, or 3
Valid Value data are:
0 - Off for Exchange mailbox folders, for PST folders, and for public folders.
1 - On for Exchange mailbox folders, for PST folders, and for public folders.
2 - On for Exchange mailbox folders and for public folders. Off for PST folders.
3 - On for the "Deleted Items" folder in a Microsoft Exchange mailbox and for public folders. Off for all other folders in an Exchange mailbox and for PST folders.
If you don't want to edit the registry, you can use this file to set the value to 0: DumpsterControl. Note: Because this registry key is in the Local Machine hive, you'll need to save the file then run it from your hard drive. Right click on it and choose Save target as... then use Open folder and double click on the downloaded file. You can edit the file using notepad before running if you want to use a different data value.
Note: I'm not sure why PST files are included in the menu settings as you cannot recover deleted items from a .pst file because the "Dumpster" is an Exchange feature.
If you use Outlook 2007 SP2 or later, you just need to set the registry value; if you use a pre-SP2 build, you will need the hotfix described in The "Recover Deleted Items" option in Outlook 2007 is still available after you set the DumpsterAlwaysOn registry entry to 0.
OWA
In Exchange 2010, you can items deleted using Shift+Delete by right clicking on the Deleted Items folder and choosing Recover Deleted items.
In Exchange 2007, go to Options, Deleted items to view your deleted items that are available for recovery.
In Exchange 2003, add cmd=showdeleted to your OWA url to access deleted items recovery.
More Information
How to Recover a Deleted Item- Exchange 2007 Help (TechNet)
Understanding Recoverable Items Exchange 2010 (TechNet)
The "Recover Deleted Items" option in Outlook 2007 is still available after you set the DumpsterAlwaysOn registry entry to 0 (MSKB)
Recover Deleted Messages from .pst files (For POP3; Outlook-tips.net)
Chris says
Is there any way to recover the original version of a modified contact record?
wayne says
I wish you could just get rid of the deleted items folder altogether. Once I delete something I never have any reason to want it back again.
Diane Poremsky says
That will never happen - but get in the habit of using Shift+Delete to get rid of everything for good.
MikeG says
I had a problem with my PC and had to Reinstall the operating system. When I opened Outlook 2010 about 250 of the oldest e-mails in my Inbox had gone. Some of these dated back two or three years. All I had were e-mails that had arrived since 4 October 2017. Can I get these old e-mails that were in my Inbox back?
Diane Poremsky says
What type of email account is it? Are you using the same account type as before? If you had pop3 and deleted from the server and now use imap, the behavior is expected. If this is what happened, did you just reinstall/repair or reformat? If reformat, do you have data backed up?
MikeG says
I'm afraid that I am very much a novice when it comes to technology. I believe I am using the same account type as before which I think is pop3. I just did a reinstall as far as I know.
Diane Poremsky says
if you were deleting mail from the server, the behavior would be the same... but you need the old data file you used before you reset the computer. Did you reinstall and choose the option to save the data?
Mike Greenwood says
I can't remember seeing that option being available. Does this mean the data wasn't saved and so is lost for ever?
Diane Poremsky says
if you can't find a pst or ost file and the mail wasn't left on the server, it's lost. Sorry.
Cssy R says
THANK YOU! all of my emails recovered
Bill says
With the new Outlook.com...recovery of deleted items is a security issue more than anything. It gets old manually purging items that were already deleted.
Diane Poremsky says
They should be auto-purged - i thought it was 14 days but it might be 30 days (from the date the deleted folder was emptied). (The old outlook.com has the same feature.)
Meeee says
On outlook.com deleted email and when wanted to recover it hit "Purge" by mistake. Any chance of ever recovering it? It could save me a few weeks of work. Outlook privacy mentions up to 30 days before deletion but does purging means gone, gone gone?
Diane Poremsky says
If you emptied the deleted items recovery, it's gone. Are you on the old server or the new server?
VanguardLH says
Using EAS to a Hotmail account in Outlook 2016 (part of Office 365). Create and then delete a test contact. Deleted contact is NOT in the Deleted Items folder. There is no "Recover Deleted Items" menu selection (I'm using EAS, not Exchange). The deleted contact is not in the Recycle Bin. This makes the Del key extremely dangerous. There is no safety prompt to ensure the user wanted to delete a contact (they may have accidentally hit the Del key or they thought the preview pane on the right was editable and hit delete to erase a selected field (and then write new data in there). There is no undelete: the deleted item does not go into the Deleted Items folder and Recover Deleted Items is only available when connected to a full Exchange server (not when using EAS - and my Hotmail account has not yet migrated from EAS to Exchange).
Diane Poremsky says
On the old server, contacts are recoverable in the outlook.com web interface... hopefully, your account is moved or will be soon, and then contacts will be in the deleted items folder for sure. (They should be on the old server too, but you need to sort by icon or use search. I'm not sure if i have any accounts still on the old server to double check.)
Stacey Dalman says
When I delete a message in outlook then go to the recover deleted item & delete again there is there still a way that someone could read the message even though it has been deleted from the recover deleted items folder?
Diane Poremsky says
If it was deleted from deleted items recovery aka "dumpster", people with access to your mailbox would not be able to recover the mail. It would require heroic action by the admin to recover it but it's a lot of work to restore the backup to a temp server.
When you have a consumer account on Outlook.com or a business account with Office 365 Exchange Online, it is not recoverable at all, even by the admin.
Mark says
My company policy clearly states all email can be monitored at any time. I have couple employees sending confidential information and/or attachments outside the domain & then constantly purging their emails via right-click 'Deleted Items' folder which shows "Recover Deleted Emails" option in Outlook on their workstation. I need to DISABLE their ability to permanently delete emails via "purging" them & gone forever. How do I configure Outlook (2010 & 2013) or registry or... on their workstation? All user mailboxes are on hosted exchange server 2010 off site. Appreciate any help.
Diane Poremsky says
sorry I missed this earlier. Did you find a solution? I don't know if this would work - https://www.slipstick.com/how-to-outlook/group-policy-disable-commands/ - but they could use OWA to empty it instead. I think it would be better to journal all email they send (or add a BCC to all mail they send) - you can do this on the server side and they can't get around it (expect by using a different account).
kim says
I am using a Verizon email address. I sync my email, contacts, and calendar using exchange active sync with an outlook.com account (not a corporate account). Everything is in one ost file. When I delete an email it goes to the delete folder, but when I delete a calendar or contact, it does not go to the delete folder. I have tried "CTRL 6" but only see "unwanted" as an empty folder under "delete". Undo is not even available. I sync with my android and am so afraid to delete something by mistake. Help!
Vishaal Tailor says
Thanks for confirming. If you could still find me a link with it stating that, it would much appreciated. I need to prove to a team that this is the case, as they keep pushing tickets back to us stating to turn dumpster on, when we know that it is already on by default and that the messages need to be recovered from exchange side.
Diane Poremsky says
Try this: https://technet.microsoft.com/en-us/library/aa997155%28EXCHG.80%29.aspx - it's for 2007 but applies to all newer versions. Also, the dumpster needs to be enabled on Exchange. Also, see the section about outlook 2007 - https://support.microsoft.com/en-us/kb/246153
Vishaal Tailor says
The Recover Deleted Items button is not grayed out. The key in registry does not exist. So I take it that the dumpster is set to alwayson as default :S
Diane Poremsky says
Yes. :)
Vishaal Tailor says
I have a user who has deleted some of their emails and would like them to be restored, However the registry key does not exist for this user:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options
The Options subkey does not exist. Any ideas? I heard dumpster is always on, on Outlook 2013. Any one able to shed any light on this?
Diane Poremsky says
If the key doesn't exist, you need to add it, but yes, the dumpster should be on by default. What version of Exchange do you use?
Vishaal Tailor says
I believe we are using Exchange 2010, I am not too sure as another team are responsible for this.
Every machine I have been to, there is no Option key, even on mine, So do we have to create the Option key and within that create the dumpsteralways on DWord?
Do you have a link to a site that states dumpster is always on by default on Outlook 2013?
Diane Poremsky says
I'll see if i can find a link. Is the Recover Deleted Items button grayed out (Folder tab)? if yes, you need to create the key on each computer (can do it using a logon script or GPO). It is enabled by default here on both outlook 2013 and 2016 (no key set but the button works and i can recover data).
Diane Poremsky says
Is the Recover Deleted items button on the Folder tab enabled? Outlook 2007 and up set it by default for the main mailbox and the Recover deleted button enabled. I verified this behavior in 2013 and 2016 a few minutes ago. I'll see if i can find a link.
You need to set the key to enable it for shared mailboxes in the profile. If the key doesn't exist (it won't by default) you need to create it, but that would only be if you want it for shared mailboxes.
Daryl says
Hello! I would like to ask how to recover my emails which I have permanently deleted. The scenario is our IT migrated to new Windows years ago. Recently, since my laptop is getting slower, I decided to conduct a clean up disk whereby I deleted the "Previously installed Windows Files". This was occupying 15G of my laptop according to the clean up menu. After deleting, upon checking my outlook, my archive files were gone and the pat could not be found. According to the IT guy I consulted, at that time the migration was done from old windows to new the person in charge should have migrated the archive link in the outlook as well. However, the archive link was not in the new windows outlook but with the old. Hence, when I deleted, my email archive included. My question is, how do I recover?
Diane Poremsky says
You'll need to try a hard drive recovery program if the folder was permanently deleted from windows. The longer you want, the more likely the files will be overwritten.
There are a number of recovery programs but either of these should work.
https://www.datanumen.com/data-recovery/
https://www.stellarinfo.com/windows-data-recovery.php
Duncan says
When restoring deleted items in Outlook 2013 using Exchange, is there a log entry created by default ? If so where does this log file reside ? Unfortunately I believe the troubleshooting logging was turned off when this even occurred.
Diane Poremsky says
No, there is no log created. Sorry.
norma khoury says
Hello,
I have a hotmail account and I'm worried that my deleted emails could be recovered from my hardware. Is there a reliable way to remove them permanently with no possible way to retrieve them?
Diane Poremsky says
If you are using the outlook connector or eas account, and as long as you are not copying them to a pst file, once they are deleted from Hotmail and the deleted folder (at outlook.com) is emptied, they are gone from the server. delete the ost file from your computer and they are gone from the computer. if you are copying to a pst, you need to delete the pst.
Natalie says
If I deleted all the messages and then emptied the deleted messages and continued into recover and also deleted them from there would anyone then be able to recover them at that point.
Diane Poremsky says
They would be in the Exchange backup files, so depending on how often the backups are recycled, the administrator could possibly restore an old database and recover the deleted items. It's not something they would do without reason though.
Jay Mal says
Hello I use exchange and there is a recover deleted items section for items deleted out of the deleted items folder, but is there a way to recover "purged" mail items? (items deleted from that recover deleted list" if not, is there a log to see when and who mail was sent to
Diane Poremsky says
generally speaking, items deleted from that list are deleted, but the exchange admin does have some control over, so its possible they could be recoverable. Unfortunately, there is not a log for the deleted items.
Eliizabeth Tisseverasinghe says
Hello - I want to know how to recover a saved deleted message from the main menu in the computer.
Diane Poremsky says
If the deleted messages are not in the deleted items folder, you can only recover the messages if you use Exchange and deleted items recovery is enabled. Then you'd use the recover deleted items command.
rpr says
What about Outlook 2013? Do these registry values have the same effect in Outlook 2013?
Diane Poremsky says
The default value in Outlook 2013 (as well as in 2010/2007) should be dumpsteralwayson = enabled but if its not working, or you want to disable it, the key will work in 2013.
David Robert Lee says
This post (and answer to my query, which was "how to retrieve deleted appointments") was not spoken to at ALL. MS is so intent on driving us onto their email handling function that apparently you forget that Outlook is, first and foremost, a calendar and contacts list. That is ALL I use if for. I have lots of other email modalities, thank you very much.
Someone (who - must - no. really. be certifiable - is he/she TRYING to drive us to apple?) decided to eliminate the "recently deleted" set of functions, when they brought out OL 2010. My assistant has managed to eliminate all the court dates for a given day, and I am seeking to retrieve them if at all possible. Otherwise I am faced with looking at each of several hundred files to determine if they were the lucky winners. Or missing the court date myself AND failing to remind my clients that they needed to be there = VALID greivance (and if it ain't, it oughta be valid), having to make bond for them, soothe ruffled feathers etc.
Diane Poremsky says
IF (and only if) you use Exchange server mailboxes, and the deleted items folder was emptied, there is a Recover Deleted Items command which has recently deleted items. It is an Exchange server feature. It's on the Folder tab when you view the Mail module.
Outlook has never had an option to recover items deleted from other mailboxes, at least not after the deleted items folder was emptied. If the items are in the deleted items folder, you can sort by the last modified date or icon to find them.
regular surf says
For Diane,
I emptied several folders in Outlook to other folders and then immediately deleted the folder name. Despite the warning that mail in deleted folders would go to the "Deleted" folder, nothing went there, and my moved mail did not show up in the chosen destination folder.
Help?
Diane Poremsky says
Check from the Folder list - the folders may be hidden when you are in the mail navigation pane. Ctrl+6 will open the folder list and you can see if they are in the deleted items folder. If you have more than one data file in your profile, check each one.
If the missing folders are not there, what type of email account are you using?
Paul says
I just synced outlook 2010 with my Nexus 7 using Local Sync and it copied across contacts that I deleted years ago, I don't mean last year, I mean 6 or 7 years ago - they don't show in my Outlook contact on my desktop so where is it dragging them from? There has to be some back door that has been left open.
Diane Poremsky says
Did you have an archive pst in your profile? Can you find them in outlook if you search for them? (They are somewhere in outlook or on the phone.)
Paul TW says
I have searched for pst files as well as ost and pab files, even nk2 files and found nothing - unless archive pst have a different extension? The thing is during the last 6 years I have changed my computer 3 times and gone through 3 operating systems, all with a clean install, so I can't see how any stuff that is 6/7 years old is being brought forward - but of course it is.
Diane Poremsky says
What type of email account? Was the data on the phone? If Apple, it could be stored in iCloud, if android, stored in gmail. in either, stored in a backup file system offered by your phone service.
Paul TW says
Currently it is Gmail, but years ago it was Bigfoot - my phone is WM6 and contacts have never been stored anywhere else apart from the synching with Outlook - I have not even stored them on my SIM card. I have never used a backup system for my phone or Outlook. All I do is save a copy of the PST to a separate thumb drive, which I update every 3/4 weeks, this overwrites it each time
Diane Poremsky says
There are only a few places the contacts can come from: outlook, the phone, or one of the accounts (like outlook.com/Hotmail) that syncs with the phone and/or outlook.
Paul TW says
Looks like it will remain a mystery - but thanks for your guidance, it is appreciated