Recover deleted Outlook e-mail by corrupting the PST file

Deleted doesn't really mean gone Scott Heath responded to Brown's dilemma with the tip that helped her find the one item she needed to recover. The key is that deleted e-mails aren't really completely removed when they've left the Deleted Items folder.

A PST has its own FAT, so to speak, wrote Heath, and when an e-mail is deleted, it is simply marked to be replaced.

The trick is getting back that one message that's been removed. Heath discovered a way to do this in an article posted on the High Technology Crime Investigation Association (HTCIA) Web site. In the article, fraud examiner Randall Shane explains how you can deliberately corrupt the PST and then recover it, retrieving all of the contents, including permanently deleted items. You can follow these steps to pull this off:

--------------------------------------------------------------------------------
Make a backup first! As the following steps involve corrupting Outlook's PST file, I strongly recommend you make a backup before attempting the process outlined in this article. I realize PST files can be rather large, but it's better to be safe than sorry
--------------------------------------------------------------------------------

To corrupt the PST file, Shane suggests opening it with the hex editor of your choice. If you don't have one, Shane recommended searching for one on CNET's Download.com. Delete positions 7 through 13 with the spacebar. Since you're using hexadecimal numbering, this actually clears 13 characters in the following positions:

00007
00008
00009
0000a
0000b
0000c
0000d
0000e
0000f
00010
00011
00012
00013

(The editor displays the code 20 each time you clear a position with the spacebar.)

After clearing those positions in the file, save it. Your PST is now corrupted. Run the Inbox Repair Tool, SCANPST.exe, to recover the file. On Win2K and WinNT systems, the executable is located in C:\Program Files\Common Files\System\Mapi\1033\NT. You can also find it on the Office 2000 CD-ROM in Drive:\Pfiles\Common\System\Mapi\1033\NT. In WinXP, the file is located in C:\Program Files\Common Files\System\Mapi\1033. For additional information on the Inbox Repair Tool, see Microsoft Knowledge Base article 287497.

After creating a backup, the Inbox Repair Tool repairs the damage and recreates the PST. Open the new PST in Outlook. The Deleted Items folder should contain all removed messages, so anything you've emptied will be restored. Though this technique falls outside the lines of the usual measures available for repairing or recovering data, it may be the best available option for retrieving specific messages that have been permanently deleted from Outlook. It's a fairly simple operation to perform, and you don't have to spend any money on recovery tools. Brown reported that the method worked well for her, so the next time a user inadvertently removes a deleted message, you might consider this an option for getting it back.