Re: Recovering Deleted Emails
jamesblackburn_at_gmail.com
Date: 03/15/05
- Next message: Robert See: "Maximum size of the 'To:, cc:, Subject:' fields?"
- Previous message: Mel Ruttan: "Re: encryping/protecting emails for HIPAA compliance."
- Messages sorted by: [ date ] [ thread ]
Date: 15 Mar 2005 07:47:20 -0800
Hi Ben,
Thanks for the tip. However when I follow your instructions i.e.
replace the 7 bytes with the value of the space bar, and subsequently
run scanpst.exe I encounter problems.
The scanning part works fine, then it pops up a dialogue saying: "The
following file has been scanned: .... Errors were found in this file.
To Repair errors, click repair.
Folders found in this file: 479
Files found in this file: 5719."
If I now click repair I soon after get the following error: "An error
occurred which caused the repair to be stopped. Some modifications may
have been made to the scanned file."
The output file (with the original file name) does not open after this,
however interestingly the .bak file *does* open (when renamed) from
within outlook. Unfortunately there are no recovered items in the
"Deleted Items" folder.
The log file from the process has, at the end:
"**Attempting to fix original file
**Attempting to copy back BBT
Fatal Error: 80040900, dwErr=0
"
I have tried the same technique with another .pst file of mine and get
the same error in the log file.
Is there anything I'm doing wrong/do you have any possible advice?
Many thanks,
James
Ben Winzenz wrote:
> If it is in a pst file, then Deleted Items Recovery no longer
applies.
> Well, sort of. If the e-mails ever existed on your server, then they
may
> still be able to be recovered using the same method and an additional
> registry entry (search Google for DumpsterAlwaysOn). If the last
time he
> moved something to his local folder was beyond your DIR setting, then
you
> can attempt to use the following method. I have never tried it and
got it
> from another forum. There are no guarantees this will work.
>
> This method works only on PSTs, when it works.
>
> Things to remember:
>
> 1. This works under very limited circumstances
> 2. If the PST has begun compacting, it will likely fail
> 3. You're better off NOT emptying the deleted folder until you
are
> sure you won't need the messages
> 4. Don't store messages in the folder unless you are sure the
> messages are trash
>
> If, for some stupid reason you move items to the deleted folder and
> change your mind after emptying the Deleted Items folder, you may be
> able to recover the messages under very specific conditions.
>
>
> How Outlook's Deleted Items folder works
>
>
> A PST is a database. Items are records within the database and there
is
> an index that points to each item. When you empty the Deleted Items
> folder, Outlook doesn't actually delete the items, it just deletes
the
> items' listings from the index. The item is still in the PST, but
> unrecoverable because Outlook has no idea where it is without the
> pointer in the index. The space the item takes up is called
> "whitespace".
>
> When you Compact a PST, the item is finally removed permanently and
the
> whitespace is recovered, often shrinking the PST by many megabytes.
Once
> the PST has 20% "whitespace", Outlook begins compacting the PST. If
the
> Deleted Items folder contained a lot of messages, Outlook may begin
> compacting the PST immediately and the items will be deleted forever
> within a few minutes.
>
> To recover the items which are no longer in the index you need to
force
> Outlook to rebuild the index by causing corruption. You can cause
> corruption by using a Hex editor to delete some characters from the
> beginning of the PST file. If you delete the wrong ones you'll cause
> corruption but not in the index and Outlook won't rebuild the index.
>
>
> Recover the Deleted Items
>
>
> If you don't know what a Hex editor is, you probably shouldn't be hex
> editing anything, but if you want to try, Google for "hex editor
> <http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF8&q=hex+editor> "
-
> UltraEdit is probably the best and easiest one to use. Before doing
> anything to the PST with a Hex Editor, make a copy of the PST, or you
> may end up losing all of your e-mail.
>
> 1. Open the PST in the Hex editor.
> 2. Delete positions 7 through 13 with the spacebar. Since you're
> using hexadecimal numbering, this actually clears 13 characters in
the
> following positions:
> 00007, 00008, 00009, 0000a, 0000b, 0000c, 0000d
> 0000e, 0000f, 00010, 00011, 00012, 00013
> As you clear the characters, the editor displays the code "20"
> in their position.
>
> <http://www.outlook-tips.net/Tricks/i/hexedit.jpg>
>
> 3. Save the PST, it is now corrupted.
> 4. Run the Inbox Repair Tool, SCANPST.exe, to recover the file.
Use
> Windows Search utility to find it. For additional information on the
> Inbox Repair Tool, see KB article 287497
> <http://support.microsoft.com/default.aspx?scid=kb;en-us;287497>
> 5. The Inbox Repair Tool creates a backup and repairs the damage
> and recreates the PST.
>
> Open the new PST in Outlook. The Deleted Items folder should now
contain
> the deleted messages, unless Outlook has already deleted them for
good
> by compacting the PST.
>
>
> --
> Ben Winzenz
> Network Engineer
> Gardner & White
>
> Exchange FAQ's: http://www.swinc.com/resource/exch_faq.htm
> Exchange 2000 FAQ's: http://www.swinc.com/resource/e2kfaq.htm
>
>
> "Mike Barker" <Mike.Barker@emagia.com> wrote in message
> news:045e01c3d622$bc906e40$a101280a@phx.gbl...
> > Thank you!
> >
> > We tried the Recover Deleted Items, but he said they were
> > folders he stored locally on his machine and not on the
> > server.
> >
> > So I guess theyre gone
> > >-----Original Message-----
> > >Mike:
> > >
> > >If you have deleted item retention turned on, in the
> > client select the
> > >deleted items folder. Under tools, select recovery
> > deleted items.
> > >
> > >If you do not have this feature turned on, it may be
> > necessary to standup a
> > >recovery server and recover the mail.
> > >
> > >Hope that helps.
> > >
> > >Tim
> > >
> > >--
> > >Timothy McMichael
> > >timmcmic@online.microsoft.com
> > >
> > >This posting is provided "AS IS" with no warranties, and
> > confers no rights.
> > >"Mike Barker" <Mike.Barker@emagia.com> wrote in message
> > >news:021e01c3d61f$41a92440$a401280a@phx.gbl...
> > >> Hello,
> > >>
> > >> One of my users deleted his emails for whatever reason
> > and
> > >> now needs them back. How might I go about doing this?
> > >
> > >
> > >.
> > >
- Next message: Robert See: "Maximum size of the 'To:, cc:, Subject:' fields?"
- Previous message: Mel Ruttan: "Re: encryping/protecting emails for HIPAA compliance."
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
