How to recover permanently deleted emails from an Outlook PST

 

  • Make a copy of the PST. Do all of the following from this backup.
  • Open a hexeditor. HexEdit is a free hex editor if you need one.
  • Delete positions 7 through 13 with the spacebar. Since you're using hexadecimal numbering, this actually clears 13 characters in the following positions:

    00007, 00008, 00009, 0000a, 0000b, 0000c, 0000d, 0000e, 0000f, 00010, 00011, 00012, 00013
    (The editor displays the code "20" each time you clear a position with the spacebar.)
  • After clearing those positions in the file, save it. Your PST is now corrupted.
  • Run the Inbox Repair Tool, SCANPST.exe, to recover the file.

    On Win2K and WinNT systems, the executable is located in
    C:\Program Files\Common Files\System\Mapi\1033\NT
    .

    You can also find it on the Office 2000 CD-ROM in
    \Program Files\Common\System\Mapi\1033\NT.

    On Windows XP, the file is located in
    C:\Program Files\Common Files\System\Mapi\1033
    .

    And Windows XP Office XP/2002 SP2
    C:\Program Files\Common Files\System\MSMAPI\1033


    For additional information on the Inbox Repair Tool, see Microsoft Knowledge Base article 287497.

  • After creating a backup (which can be skipped because naturally you folllowed these instructions and made a backup and are now working from it), the Inbox Repair Tool repairs the damage and recreates the PST. Open the new PST in Outlook. The Deleted Items folder should contain all removed messages, so anything you've emptied will be restored.
    You may have problems with very large PST's. Either the hexeditor will take an inordinately long amount of time because it's scanning the file or will simply hang - you will need patience to find out.

 

Lastly, this is not a guaranteed fix, just one potential method of retrieving permanently deleted emails from an Outlook PST.

Subjects: 

Comments

Dan,

I don't know if you will ever see this message, but I wanted to let you know that your instructions for hexediting and repairing a pst file with SCANPST.exe saved my butt. I will never uncheck the "ask before permanantly deleting items" option in Outlook again!! I had accidentally selected ALL emails and hit shift-delete. Luckily, I found you on Google. Thanks so much for the instructions, you are a lifesaver!!!!!

If you have a chance, please email me, I want to thank you personally.

Thanks,
F. C.

Correct, that is where the information is from. And my apologies to Ray Geroski , the author of the orginal article on this one. This article simply started as one viewable by RunPCRun staff only and it was a direct copy+paste, as we use this website within the company for our everyday work. Later on I just removed access rules (which made it publicly viewable) as it's easier for us to find and tidied it up a bit. I didn't think much further than that.

Hi, how about the whole pst file? My friend accidentally deleted the whole pst file; not only the individual emails. We are told that once we shutdown/restart Windows, the deleted pst file will be gone forever, no way to recovers it, is this true? Thanks a great lot... thanks Eugene

Whole file- different scenario. When a file is deleted normally using FAT or NTFS file systems, the file is simply marked as deleted in the "index" and the space used by the file marked as free.

It can be recovered as long as another file hasn't been written to the same space. To do that, stop using the PC for anything else asap and then use an "undelete" application (if you need to install remember to install on another drive)

A freeware application I use in this circumstance is Restoration
A good commercial application I have used in the past is Active@ Undelete

That restoration program is a god send! Can't tell you how much it just saved my bacon!

When I open my pst file with the Hex editor I don't see anything resembling the 0007 through 0013 mentioned. What am I missing here? Thanks Rafisch {at} gmail {dot} com

excellent information

thank you for giving information about the freeware for restoring deleted files, it indeed is a life saver... thanks again, tk

In Hex Editor I am unable to find 00007 to 00013, what wrong,

You can find step by step solution to recover permanently deleted mails in the following post: http://www.etechplanet.com/post/2009/08/26/How-to-retrieve-permanently-deleted-(shift-2b-delete)-mails-in-Microsoft-Outlook.aspx

Yes. However that link is about how to retrieve emails from Outlook in an Exchange environment. In that situation the email datastore is in Exchange, and controlled by the system administrator. The post above details when you have a local mail datastore (on your PC) because you are using POP3 or as archives.

Thanks so much!! I deleted all the content of the inbox folder using the SHIFT and with your instructions I recovered them all. Thanks!! Marco

In Hex Editor I am unable to find 00007 to 00013. I saved the Hex Editor to my Desktop but I do not see 00007 or anything like it. Everything is in 2 digits: 4d, 5a, 00 (etc). Also, I don't see how the Hex Editor is connected to the PST file that I saved on an external hard drive. Please help me out if you can. Thanks!! Allison grecopros at comcast dot net.

The positions 00007 to 00013 are "map references" to which digits to change. 00000 | 01 40 32 00 0d 00 53 00007 | 10 00 5b ad 12 1b 32 The numbers on the left before the | indicate the position at the start of that line. In this example position 00007 is the digit "10" and position 00009 is "5b"

Thanks! Saved me as well. Nice clear instructions, straight to the point. I always hold down the shift key when I delete an email to delete it permanently. It's become such a habit that I did it tonight without looking at the screen. I'd somehow managed to select the entire contents of my inbox (dodgy mouse?) and I realised what was happening (as you do) milliseconds after I'd replied OK to the "Are you sure?" prompt!

Thank you Dan SUCCESS with Outlook 2010 PST! Just a quick note to say as much; great and easy recovery, however, the key would be to perform the recovery ASAP to avoid possible lost of permanently deleted items. Thanks again!

Hi Dan, It worked for me also. I must say its life savior for the people working in IT companies. Regards, Ankush Sharma

Good one dan. How did you find out about it and what is teh hex value related in the executable. Thanks Alan

Nice one Dan. How did you find out about it and what is teh hex value related in the executable. Thanks Alan