- Can deleted messages be recovered from PST files? Yes
- How do you recovered deleted MSGs from PST files? Using tools recover the data out of the “unallocated” space
PST files are compound files that contain email messages, contacts, tasks, etc. The PST files are read by Microsoft Outlook. Like other Microsoft files, PST files have their own file structure which includes “unallocated space” from within the file.
If an email is deleted within the PST file it moves to the “unallocated space” of the PST file, and therefore can be recovered. It remains there until it is overwritten.
A PST file has 1,000 messages, and is 100 mb in size.
Deletion of 100 mesages (10% of the data) will not reduce the size of the PST file to 90mb, but it will in fact stay the same size. The 100 messages are now in the “unallocated space” of the PST file (not the hard drive).
Recovering the messages, or access to these data, can be done via a variety of tools, including:
ScanPST is a free utility that comes with every Windows XP machine. Its a Microsoft utility that can repair PST files, at no cost.
The tool is incredibly easy to use, and its functionality is described on the MS Support site. While the PST file may not be corrupted, ScanPST will work on the file to recover everything it can, i.e the messages that has been deleted.
For computer forensics examiners working in the corporate sector recovery of messages within PST files can be critical to a case.