Recover Deleted items from .PST

Status
Not open for further replies.
C

Coza

Well-Known Member
Joined
Mar 9, 2005
Messages
271
Reaction score
2
Hey Guys,

I have been asked if it is possible to recover deleted files from a pst.

Forensic audit type situation....

Correct me if im wrong :

If a mail gets deleted form a .pst the mail gets marked as unsused space in the pst file. And gets re-written once new mails come in or get moved around ( Like a normal hard drive treats deleted files.)

In outlook there is a "compact now" option in the pst properties in outlook. Sureley this option will make it impossible to recover any deleted items within the pst ??
 
you can try this

1. Open the PST in the Hex editor.
2. Delete positions 7 through 13 with the spacebar. Since you're using hexadecimal numbering, this actually clears 13 characters in the following positions:
00007, 00008, 00009, 0000a, 0000b, 0000c, 0000d
0000e, 0000f, 00010, 00011, 00012, 00013
As you clear the characters, the editor displays the code “20” in their position.

3. Save the PST, it is now corrupted.
4. Run the Inbox Repair Tool, SCANPST.exe, to recover the file. Use Windows Search utility to find it. For additional information on the Inbox Repair Tool, see KB article 287497
5. The Inbox Repair Tool creates a backup and repairs the damage and recreates the PST.
Open the new PST in Outlook. The Deleted Items folder should now contain the deleted messages, unless Outlook has already deleted them for good by compacting the PST.
Click to expand...
 
OK so figuratively speaking if i was paranoid, and didn't want anyone to be able to recover a few mails that i have already deleted out of the deleted items folder in outlook, i could click on the "compact now" button. and technically there is no way to recover those mails ?

A client of mine told me a story of how one of his "acquaintances" was bust when they confiscated his pc and recovered some dodgy correspondence.

He asked me to then make sure it couldnt happen to him ...... :O
 
Forensic audit?
Reminds of Ollie North and Iran-Contra, who deleted all his PROFS mails thinking they're gone forever. Little did he know...
 
Maybe you can try this

:)I heard about not bad application Advanced Outlook Repair can help to undelete the emails you delete by mistake. Refer to http://www.datanumen.com/aor/problems/outlook-deleted.htm for more detailed information.it may recover Outlook files and data from corrupted pst files of all Microsoft Outlook mail clients.
 
Would it not depend on the setup of the mail server as well? They could keep copies of all mail there too...(just a thought.) Where I work we don't even have .pst files storing our mail. All mail is kept stricktly on the mail server.
 
Status
Not open for further replies.
Back
Top
Sign up to the MyBroadband newsletter
X