I had questions recently inquiring about recovering deleted email. The questions weren't from users who wanted to recover accidentally deleted email, but from users who receive sensitive information by email, including personal information and credit card numbers, and need to comply with laws addressing the security of personal information in the event of a data breach. They are aware that forensic methods exist that can recover deleted files from a hard drive but wanted to know if an average (or above average) user or a hacker could recover messages after the Deleted items folder is emptied.

To find specific items in the Deleted Items folder of an Exchange mailbox when you know approximately when you deleted them, close the reading pane, add the Modified date field to the view and sort by it. Find the approximate date you deleted the items. To find deleted appointments or contacts, sort by the icon field. Note that this will not work with .pst files, you'll need to find the deleted items yourself.

If you use a POP3 account, no, a hacker can't easily recover your deleted items - and neither can you. If you use IMAP or MSN, deleted items can't easily be recovered from the local store, but you'll need to verify they were deleted from your mailbox online. If you use Exchange mailbox, its possible the messages are stored on the server for a period of time before they are permanently deleted. If so, they will be easily recovered by anyone with access to your mailbox.

When Outlook is configured to use a PST and you use Shift+Delete (recommended for messages you don't want recovered) or Delete then empty the Deleted items folder, someone would need to use a third party application to have any chance of recovering the messages. As time passes and new mail arrives or after the PST is compacted, the ability to recover deleted messages go down dramatically. Compacting the data file after emptying the Deleted items folder will eliminate the ability to recover deleted items.

Recovering Deleted items in Exchange accounts

Items deleted from Outlook and Exchange server mailboxes complicates matters and it's more likely you'll be able to recover the deleted items. If the network is secure, the data will be secure but there are more places where the messages may be stored. If the user deleted the items using Shift+Delete, they may look deleted but will be accessible in Recover Deleted Items when the DumpsterAlwaysOn key is enabled.

Deleted items may be covered by a Deleted Item Retention policy in Exchange, preventing the user from deleting the messages from Recover Deleted Items. If the organization archives messages as they arrive they could be somewhere in the network. So many places to look, but with proper network security, the data will be secure and users will be compliant with existing laws.

DumpsterAlwaysOn

This key is valid in all versions of Outlook when used with Exchange server mailboxes. In Outlook 2007 and newer, you do not need to add the key to the registry in order to be able to recover data from any folder in the default mailbox.

Setting this value in Outlook 2007 and up enables deleted items recovery for shared mailboxes.

With this value set to 1, you can use the recover deleted items while viewing any folder. Set the value to 0 to disable it for folders other than the Deleted items folder.

To set the DumpsterAlwaysOn key, open the registry editor and browse to

HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\Client\Options
DWORD: DumpsterAlwaysOn
Value: 1

Because this registry key is in the Local Machine hive, you'll need to save the file then run it from your hard drive. Right click on it and choose Save target as... then use Open folder and double click on the downloaded file.

Restart Outlook and you'll be able to recover newly deleted items from any folder in Outlook.

DumpsterControl

Use DumpsterControl to remove the Recover Deleted Items command on the Tools menu by adding the DWORD value "DumpsterControl" to the registry and setting its value to 0.

Browse to the following registry key using regedit:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options
DWORD: DumpsterControl
Value: valid numbers are 0, 1, 2, or 3

0 - Off for Exchange mailbox folders, for PST folders, and for public folders.
1 - On for Exchange mailbox folders, for PST folders, and for public folders.
2 - On for Exchange mailbox folders and for public folders. Off for PST folders.
3 - On for the "Deleted Items" folder in a Microsoft Exchange mailbox and for public folders. Off for all other folders in an Exchange mailbox and for PST folders.

If you don't want to edit the registry, you can use this file to set the value to 0: DumpsterControl. Note: Because this registry key is in the Local Machine hive, you'll need to save the file then run it from your hard drive. Right click on it and choose Save target as... then use Open folder and double click on the downloaded file. You can edit the file using notepad before running if you want to use a different data value.

Note: I'm not sure why PST files are included in the menu settings as you cannot recover deleted items from a .pst file because the "Dumpster" is an Exchange feature.

If you use Outlook 2007 SP2 or later, you just need to set the registry value; if you use a pre-SP2 build, you will need the hotfix described in The "Recover Deleted Items" option in Outlook 2007 is still available after you set the DumpsterAlwaysOn registry entry to 0.

OWA

In Exchange 2010, you can items deleted using Shift+Delete by right clicking on the Deleted Items folder and choosing Recover Deleted items.

In Exchange 2007, go to Options, Deleted items to view your deleted items that are available for recovery.

In Exchange 2003, add cmd=showdeleted to your OWA url to access deleted items recovery.