How to recover permanently deleted emails from an Outlook PST
Submitted by Dan White on June 12, 2006 – 11:17am
- Make a copy of the PST. Do all of the following from this backup.
- Open a hexeditor. HexEdit is a free hex editor if you need one.
- Delete positions 7 through 13 with the spacebar. Since you re using hexadecimal numbering, this actually clears 13 characters in the following positions:
00007, 00008, 00009, 0000a, 0000b, 0000c, 0000d, 0000e, 0000f, 00010, 00011, 00012, 00013
(The editor displays the code 20 each time you clear a position with the spacebar.)
On Win2K and WinNT systems, the executable is located in
C:\Program Files\Common Files\System\Mapi\1033\NT.
You can also find it on the Office 2000 CD-ROM in
On Windows XP, the file is located in
C:\Program Files\Common Files\System\Mapi\1033.
And Windows XP Office XP/2002 SP2
C:\Program Files\Common Files\System\MSMAPI\1033
For additional information on the Inbox Repair Tool, see Microsoft Knowledge Base article 287497 .
You may have problems with very large PST s. Either the hexeditor will take an inordinately long amount of time because it s scanning the file or will simply hang – you will need patience to find out.
Lastly, this is not a guaranteed fix, just one potential method of retrieving permanently deleted emails from an Outlook PST.
I don’t know if you will ever see this message, but I wanted to let you know that your instructions for hexediting and repairing a pst file with SCANPST.exe saved my butt. I will never uncheck the “ask before permanantly deleting items” option in Outlook again. I had accidentally selected ALL emails and hit shift-delete. Luckily, I found you on Google. Thanks so much for the instructions, you are a lifesaver.
If you have a chance, please email me, I want to thank you personally.
comment – December 20, 2006 – 7:24pm
Dan White – December 21, 2006 – 9:32am
Correct, that is where the information is from. And my apologies to Ray Geroski. the author of the orginal article on this one. This article simply started as one viewable by RunPCRun staff only and it was a direct copy+paste, as we use this website within the company for our everyday work. Later on I just removed access rules (which made it publicly viewable) as it’s easier for us to find and tidied it up a bit. I didn’t think much further than that.
comment – December 21, 2006 – 12:00pm
Hi, how about the whole pst file? My friend accidentally deleted the whole pst file; not only the individual emails. We are told that once we shutdown/restart Windows, the deleted pst file will be gone forever, no way to recovers it, is this true? Thanks a great lot. thanks Eugene
Dan White – December 21, 2006 – 5:00pm
Whole file- different scenario. When a file is deleted normally using FAT or NTFS file systems, the file is simply marked as deleted in the index and the space used by the file marked as free.
It can be recovered as long as another file hasn t been written to the same space. To do that, stop using the PC for anything else asap and then use an undelete application (if you need to install remember to install on another drive)