How to undelete a permanently deleted message in an Outlook PST file
June 21, 2013 1 Comment
Ok. If you have used Microsoft Outlook, this has probably come up at least once in your usage. You use Outlook at home or maybe at work [i.e. not using Exchange Server] and of course you delete your mail like everyone else. Maybe you have set your Outlook settings to delete anything in Deleted items when you exit Outlook. Or maybe somehow [fluke of nature, a glitch, someone playing games on you – but in general “I didn’t do that!”] something was deleted and you then flushed Deleted Items manually or automatically.
Then you later find out that you needed to keep something that you just flushed. Major ooops.
So what do you do?
Outlook stores all your mail, contacts, tasks, scheduled items and other fun stuff on one file. It uses a PST as an extension. Don’t ask me but the PST extension doesn’t match the actual name – Personal File Storage.
So a PST file is like a database [if you are familiar with them]. You delete a record [in this case an Email, contact, etc.] it is still there. It is just marked off as to be deleted and is now invisible to the typical user.
In Outlook, any item is deleted once they are removed/deleted from Deleted Items. Once gone from Deleted Items you can’t see it anymore. The deleted items are marked in a table of contents [TOC] within the PST file. The interesting thing is that if you wipe [or corrupt] the TOC, the PST file is useless.
But since the dawn of mankind [OK, at least since Outlook 2000], Microsoft included a useful tool called SCANPST.EXE. SCANPST is used to check and repair PST files – even with a corrupt TOC.
In another little twist, since SCANPST can’t figure out what was deleted or not, in marks [when repairing the TOC] all the items as undeleted records. So whatever you deleted is now visible.
Warning: This is not intended for the novice users!
The first thing you need to do is make sure Outlook is closed. The following applications can’t open a PST file if in use.
Then make a backup of the PST file. If you don’t know where it is, Outlook gives you the path where it can be found in the Account Settings. [You may wish to rename the PST file after to something like TOFIX.PST – so you know which one you are working on.]
Next is to wipe [or corrupt] the TOC of your PST file. To do so, you need a Hex editor. There are plenty out there. Choose your Hex editor and open up the PST file in it.
You need to wipe out positions 07 through 13 [note: Hex editors start off at 00 – not 01]. The value should now be 00 [that’s two zeros].
Save the PST file. Some will create a backup before saving, others don’t. Not a major issue since we did that already – right?
Now you need to find SCANPST.EXE. Generally you can find it in the same folder where the rest of Office’s executables are stored. Under Windows 7 [for example] it could be either C:\Program Files \Microsoft Office\Office14 or C:\Program Files (x86)\Microsoft Office\Office14 if using Office 2010 and depending on your OS bit as well as Office bit. Change Office 14 in the path to your version [Office 12 for Office 2007, Office 11 for Office 2003, etc.
Open SCANPST.EXE. Click on the Browse button to find the PST file that you want to fix.
Generally the Options part isn’t needed to adjust [defaults to create or append a log file in the same folder as the PST file].
Click on the Start button. It will go through eight phases. Some will be fast. Some won’t. The progress bar is generally useless. This just the scan or analyze part. The time depends on the size of the PST file and speed of the system. It is recommended that you don’t use the computer for anything else until finished.
When the scan or analyze part is done, it will give you some results. Most of it is gibberish if you go to the details. Click on the Repair button to start the repair. Oddly there is no progress bar. Once again, it is recommended that you don’t use the computer for anything else until finished.
When done, depending on your situation you may or may not want to open Outlook. You can open Outlook but you risk mail coming into the old PST file that was not repaired. But you do want to see what it recovered. The alternative is to rename the original PST file to something [say ORIGINAL.PST] and then rename the fixed PST file [i.e. TOFIX.PST] to what ORIGINAL.PST was originally named as.
In either case, once you are in, your deleted items are all visible. You can now find what you deleted in the first place and then redelete what you still don’t want.
Note: If you see a Lost And Found Folder inside Outlook then SCANPST found error(s) in the PST file it fixed and tried to recover the items. If you don’t see what you deleted, it may have been corrupt and is lost forever.
Warning: If you have “compacted” [i.e. compressed] your PST before trying to recover, it is gone. History.
Side Tip: If you use Outlook 2003 or prior, if your PST file exceeds 2GB in size, you risk severely corrupting the PST file. This isn’t much of an issue after Outlook 2003 – although don’t make it too big!