Recovering a deleted Microsoft Outlook PST file
- Have you just discovered that one of your users has lost their Outlook data store (PST file)?
- Are you using POP3 instead of IMAP or Exchange, and therefore don’t have a copy on the mail server?
- Was the PST file stored in a location that isn’t backed up for some reason?
- Did it happen to a very senior member of staff, and through no fault of their own?
- Are you starting to think you, as the Network Manager, might be totally boned?
Welcome to my Tuesday afternoon.
Recovering the data
Under normal circumstances, Pirform’s Recuva is my go-to program for quick and easy file recovery. However, this problem proved too much even for the deep scan option to find a trace of the file. This needed a more thorough solution:
- PhotoRec is a recovery program that completely ignores the file system on the disk, and instead siply scans the underlying data looking for patterns that match known data types. It was originally designed to recover photos, hence the name, but currently works on about 100 different file types, including Outlook’s PST files.
- Once I’d recovered some data, I quickly found the recovery wasn’t perfect; I couldn’t open the PST fies in Outlook. This was hardly surprising given that part of the data store had been overwritten and Recuva couldn’t even begin to attempt a recovery. I then turned to Outlook’s Inbox Repair tool (Scanpst.exe), which is installed by default with Outlook. After running the recovered files through Scanpst, I was able to open them in Outlook.
What the hell happened in the first place
Due to events that still defy proper explanation, the entire local Outlook data store for the Head at my school simply disappeared into the ether, having previously been stored in the Local Settings portion of his user profile on the C: drive. Almost everybody else in the school has their PST file on the network, where it is backed up. Don’t ask me why this account was the exception; I didn’t set it up. I did have to try to clean the mess up, however.
Irritatingly, the disappearance of the PST file coincided with a large Windows Update patch being applied. The patch was the .NET Framework 3.5 SP1 install, and I can’t imagine how it could possibly have caused any data to be erased. However, it did mean there had been a lot of disk writes recently, and as it turned out, almost certainly after the files were deleted. That meant part of the data had been overwritten, and it was enough that Recuva couldn’t help (it did find a bunch of accompanying files in the same folder that had also been deleted, which is how I knew I was looking in the right place, but no dice on the data store itself).
It’s unlikely that if you have to resort to the methods above, you’ll recover the entirety of the file. In this case, the original PST file was split between about 3 different recovered files, with a dozen more containing duplicates of much of the data. In the end, the most recent month’s worth of emails were lost, but the remaining 2 1/2 years of data was recovered. I’d certainly have preferred it if the lost month had been from 2 1/2 years ago rather that the most recent month, but I’ll take what I can get in the circumstances.