Notifications
Clear all

Email Recovery

15 Posts
6 Users
0 Reactions
1,265 Views
(@dannybarrait)
Active Member
Joined: 17 years ago
Posts: 10
Topic starter  

Hi Folks,

I am trying to recover a large number of emails which were "accidentally deleted".

I have parsed the INFO2 file but cannot see anything, I also done a search for *.pst files but all that is coming up is the current outlook.pst and archive.pst which do not contain the emails.

Any idea's would be very helpful.

Thanks


   
Quote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

If NTFS many data recovery programs stand a good chance of recovery

If FAT32 may be much harder as the file will probably be fragmented, and deletion removes all fragment details

With Mac, you will probably need to do data carving

Make sure you make a copy of drive first, and never write ANYTHING to the problem drive.


   
ReplyQuote
(@dannybarrait)
Active Member
Joined: 17 years ago
Posts: 10
Topic starter  

Thanks Michael,

It is NTFS, it comes from a Windows XP machine, can you recommend any good Open Source data recovery s/w?

Cheers
Danny


   
ReplyQuote
(@kovar)
Prominent Member
Joined: 18 years ago
Posts: 805
 

Greetings,

PhotoRec is the easiest to use. Scalpel is another option.

-David


   
ReplyQuote
 Earn
(@earn)
Estimable Member
Joined: 20 years ago
Posts: 146
 

You dont say what kind of email was used but if it was deleted from a pst you can recover deleted messages by corrupting the first few bytes and running scanpst. This can also be done with a recovery tool. Ive had success converting o********t and then running a recovery tool. The corruption method is easily findable by searching with google.

You also wont find messages deleted in a pst or ost in unallocated space. A pst/ost is basically a database so its self contained.


   
ReplyQuote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

Greetings,

PhotoRec is the easiest to use. Scalpel is another option.

-David

Do those two programs allow for fragmented files? It is very common for .pst to be fragmented due to the fact they are long, and are created in many sessions. Fortunately NTFS does retain the fragment information within the MFT entry, when the file has been deleted, so recovery should be possible.


   
ReplyQuote
(@dannybarrait)
Active Member
Joined: 17 years ago
Posts: 10
Topic starter  

Thanks again, the email client is MS Outlook 2007. What puzzles me is that they didnt go to the deleted items folder.

I have used TestDisk to no avail but I am running PhotoRec now so I will let you know how that goes.

Thanks


   
ReplyQuote
(@kovar)
Prominent Member
Joined: 18 years ago
Posts: 805
 

Greetings,

To be clear, please pick one of the following

1) The messages were deleted within Outlook.
2) The PST file containing the messages was deleted.

If the former, carving for PST files isn't likely to recover the missing messages.

-David


   
ReplyQuote
(@dannybarrait)
Active Member
Joined: 17 years ago
Posts: 10
Topic starter  

The guy I am doing the recovery for said that "the files were accidentally deleted from Outlook". I tried the method of corrupting the .pst file and running scanpst. It recovered a number of emails but not the ones he is looking for.

PhotoRec is still running but I dont think I will have any joy there either as the .pst was not deleted.

I am at a bit of a loss as to how he deleted so many without sending them to the Deleted Items folder or realising what he was doing-)

Regards
Danny


   
ReplyQuote
(@pragmatopian)
Estimable Member
Joined: 16 years ago
Posts: 154
 

I am at a bit of a loss as to how he deleted so many without sending them to the Deleted Items folder or realising what he was doing-)

Bypassing Deleted Items is easily done Shift+Del. It does ask for a confirmation but if he did it for an entire subfolder of messages that would only involve a single additional click.


   
ReplyQuote
Page 1 / 2
Share: