Hi, I have a PST folder that has been deleted using the Del Key. Numerous tools such as ( Steller, Recover my Email, Get back Data, Paraben, Repair Outlook , Reclaime, UFS and other lesser known tools have had little to no success. Anyone know of any tools that that might help to recover the folder
Assuming that the folder was also deleted from the Deleted Items folder, my first choice to attempt recovery would be X-Ways or FTK.
I know you are only asking about tools, but I will include the following info in case it helps others:
If the PST file originated from Outlook 2013 or earlier, it could have been used in connection with an IMAP server. If the service provider was Microsoft, there may be an opportunity to recover the messages within the retention period through the Recoverable Items Folder via Graph API. The same applies to OST files associated with an Exchange server, in which case data recovery through the Exchange server’s data store could also be an option (for on-prem) in addition to the Recoverable Items Folder (both on-prem & M365).
Finallly, if available, any backups of the email server as well as backups of any endpoints where the deleted emails could have been downloaded would be a potential recovery option.
Hi, Bill. Do you mean you´ve delete a .pst file or a subfolder inside Outlook?
In the former case you may try carving by hand.
Firstly, it would be recomended to create a image from the disk. Otherwise Windows may overwrite the data you´re looking for.
Then open this image with your preferred hexadecimal editor and search for the pst header signature !BDN (0x2142444E).
More details here https://www.file-recovery.com/pst-signature-format.htm.
Then select the sectors from this header to the next, or limit the size of the recovery to a reasonable size (maybe 50-100 Mb). Write to a nex file.
Repeat the carving for every occurrence of header.
If you´re luck, some of this file will be file you´ve deleted.
1 Like
Sergio, thank you for the reply, What happened is the individual in question deleted numerous files in their PST folder, We have found a few of the deleted files but there are hundreds still missing. We have been using a hex-editor like you suggested and it might be the only way to recover the data. The MS site that you led us to has been quite helpfull. Thank You again for the help.
Arman, Thanks, those are good ideas, Like you suggested we are running X-Ways but so far not seeing what we need. We checked and found that their ITs have deleted the Server backups but we have a better chance of recovering data from the deleted Server then the individual’s laptop. So the next step will be to image the server and see if we can recover the PST folder from the server. Thanks kindly for the help.
1 Like