Blog: Recovery

Recuva (they pronounce it "recover") is a free utility that can be run from a USB drive or installed on a system.  It's easy to use and has options to pick the type of file (pictures, email, music, documents, etc.) and file locations - or just show all undeletable files on a specific drive. [more]

There is a deep scan option, but if this is necessary, it may be difficult to restore the files.

This is a good way to restore files that may have been accidently deleted or files that have disappeared because of disk errors.  It may be a good thing to use in combination with SpinRite (not free, but a very useful utility when disk hardware errors occur).

http://www.piriform.com/recuva

http://www.grc.com/sr/spinrite.htm


 

I recently found myself in a situation where some pictures, that to me were priceless, had been deleted from my camera memory card. Unfortunately those pictures had not been moved or copied to any other media. Like most of us I wanted a free method of recovering them. I found a software called Recuva, which is a freeware Windows utility to restore files that have been accidentally deleted. This includes files emptied from the Recycle bin as well as images and other files that have been deleted by user error from digital camera memory cards or MP3 players. It will even bring back files that have been deleted by bugs, crashes and viruses! [more]

I download the program and installed it to my USB thumb drive. It installs as a simple .exe, which when ran opens a simple little GUI that allows you to scan any drive, filtering by pictures, music, documents, video or show all files found. After it finds the files you select them from the list and recover them to the location of your choice. I was actually able to find pictures deleted off the memory card over a year ago.

If interested you can download and read more about it hear. http://www.recuva.com/

 

For most people who are running Exchange, the combination of “Recover Deleted Items” and standard backups will be enough to restore most deleted emails. But what about when a user is using a PST file instead of an Exchange mailbox and they deleted an item from the Deleted Items folder? Instead of having to listen to a users agonizing sobs when you deliver the “I’m sorry, we tried everything we could but we were unable to save him” line, try the below ‘the gloves are off’ recovery method. [more]

A PST is essentially a database. Items are records within the database and there is an index that points to each item. When you empty the Deleted Items folder, Outlook doesn't actually delete the items, it just deletes the items' listings from the index. The item is still in the PST, but unrecoverable because Outlook has no idea where it is without the pointer in the index. The space the item takes up is called "whitespace".

When you Compact a PST, the item is finally removed permanently and the whitespace is recovered, often shrinking the PST by many megabytes. Once the PST has 20% "whitespace", Outlook begins compacting the PST. If the Deleted Items folder contained a lot of messages, Outlook may begin compacting the PST immediately and the items will be deleted forever within a few minutes.

To recover the items which are no longer in the index you need to force Outlook to rebuild the index by causing corruption. You can cause corruption by using a Hex editor to delete some characters from the beginning of the PST file. If you delete the wrong ones you'll cause corruption but not in the index and Outlook won't rebuild the index.

Recover the Deleted Items

Acquire a simple Hex Editor. I like XVI32 since it is simple and doesn’t require installation.

  1. Open 'Outlook.pst' in the Hex editor.
  2. Delete positions 7 through 13 with the spacebar. (On the right side of the screen if you are using XVI32) As you clear the characters, the editor displays the code “20” in their position. (On the left side of the screen if using XVI32.)
  3. Save the PST, it is now corrupted.
  4. Run the Inbox Repair Tool, SCANPST.exe, to recover the file. Use Windows Search utility to find it.
  5. The Inbox Repair Tool creates a backup and repairs the damage and recreates the PST.
  6. Open Outlook. The Deleted Items folder should now contain the deleted messages, unless Outlook has already deleted them for good by compacting the PST.
  7. Enjoy your tickertape parade when you save the day with your techo-wizardry.