How to Recover Deleted Files from a PST File in Outlook

Removing emailsfrom the Deleted Items folder should always be done with caution. But accidentshappen and sometimes we delete emails by mistake. Luckily, there’s a way torecover deleted items in Microsoft Outlook.

First thingsfirst: you must close Outlook immediatelyafter you’ve deleted the items. It’s also important that you not restart the program until the very endof the process. The longer you keep it open, the more unpredictable theresults will become.

Whatis an Outlook PST file?

Your deleted filesare stored as a PST file. Outlook’s instinct is to overwrite a PST file oncechanges are detected such as removing content. Our job is to restore the filesbefore Outlook gets a chance to make changes to the PST.

The methoddiscussed below will require us to make direct changes to the PST file. We dothis using something called a Hex Editor.You will need to download and install one before you attempt email recovery.

There are many Hex Editors available online for free. There are also versions that do not require installation.

Whatis Table of Contents in Outlook?

The plan is tofool Outlook into thinking that it’s corrupted. To be more specific, we’retargeting the Table of Contents or TOC. This is what Outlook uses to categorizeemails before placing them in the appropriate folder.

Normally, the TOCremoves deleted items. But if we corrupt and repair (more on that later) fastenough, we can trick Outlook into thinking there was no change to the PST file.This act will restore all the deleted emails. It will carry on as if nothinghappened.

FindingPST files

Here’s how youlocate the PST files stored in your computer.

Go to File > Data Management. Go through the list of PST files and select the files you need.

Click Open File Location to access the PST files.

Copy the PST files and paste it in a safe location in your hard drive.

Note: We will be editing the copy instead of the originalfile.

Corruptingthe PST files

Open the PST fileyou copied using a Hex Editor. You’ll be greeted by rows and columns of numbersand letters. These are called hexadecimal characters. We will be making changesto these values to achieve the desired results.

Locate hexadecimal positions 7 to 13.

Using the space bar, delete the values under position 7 to 13. This would sometimes replace the original value with “20”.

Once done with your changes, save the PST file and exit the Hex Editor.

If your HexEditor supports it, you can also update the PST file using Fill Selection.

  1. Locate and highlight positions 7 to 13.
  2. Go to Edit > Fill Selection.
  3. Enter “00” under Hex Values.
  4. Hit OK.
  5. Save and exit the program.

Recoveringthe PST files

Now that we were able to successfully corrupt the PST, we will now proceed with recovering the file. To do that, we will be using a tool called scanpst.exe.

As the repair tool scans and fixes the corrupt PST and TOC, it will see the permanently deleted messages and think they’ve only been misplaced. This will result in the messages being moved back to their proper folders.

Open scanpst.exe (Office 365 users will find it here: C:\Program Files\Microsoft Office\root\office16\)

Click Browse and open the edited PST file.

Click Start. After the repair is complete, open the PST file in Outlook.

If the recoverywent according to plan, the deleted emails should now be back in the DeletedItems folder or in the folder they were originally located.

While this method works, it does not have a 100% success rate. You should manage your expectations. If this does not work, there are third-party recovery tools you can look into.