shockersh

How-To corupt an outlook .pst file to recover delete email

Recommended Posts

Here's the info on how-to corrupt a PST file:

 

1 - To corrupt the PST file, open it with the hex editor any will do but like MrGroove said, notepad++ is good

 

2 - Delete positions 7 through 13 with the spacebar. Since you're using hexadecimal numbering, this actually clears 13 characters in the following positions:

 

3 - 00007

00008

00009

0000a

0000b

0000c

0000d

0000e

0000f

00010

00011

00012

00013

(The editor displays the code “20” each time you clear a position with the spacebar.)

 

4 - After clearing those positions in the file, save it. Your PST is now corrupted.

 

5 - Run the Inbox Repair Tool, SCANPST.exe, to recover the file. detailed by MrGroove here: microsoft-office/recovery-deleted-mail-for-pop3-and-imap-t95681.html#p96321

 

On Win2K and WinNT systems, the executable is located in C:\Program Files\Common Files\System\Mapi\1033\NT. You can also find it on the Office 2000 CD-ROM in Drive:\Pfiles\Common\System\Mapi\1033\NT.

 

In WinXP, the file is located in C:\Program Files\Common Files\System\Mapi\1033. For additional information on the Inbox Repair Tool, see Microsoft Knowledge Base article 287497.

 

If you have Office 2007 however either use Windows Vista or Windows 7 etc... SCANPST.exe should be stored in the Office 12 folder (c:\program files\microsoft office\office12\scanpst.exe) or scanost.exe for that matter as well.

 

6 - After creating a backup, the Inbox Repair Tool repairs the damage and recreates the PST. Open the new PST in Outlook. The Deleted Items folder should contain all removed messages, so anything you've emptied will be restored.

 

The KEY here is to use a BACKUP of the .PST or .BAK file you want to restore.

Share this post


Link to post
Share on other sites

oh my god... yes this actually works! Thanks for documenting this. I did this once but couldn't find the how-to in order to repeat it again.

Share this post


Link to post
Share on other sites
oh my god... yes this actually works! Thanks for documenting this. I did this once but couldn't find the how-to in order to repeat it again.

 

word up my friend !!!

Share this post


Link to post
Share on other sites
I'm probably being thick but I can't create a copy of the file, plus I can't see anything that looks like 00007, 000008 when I open it with notepad

 

Depending on where your trying to copy the files, you may have an issue depending on if you have Admin rights etc... What I suggest is to create a folder here: c:\tempmail then copy the PST file there.

 

In regards to opening the file with Notepad. No... You need to open the .pst file using a valid HEX editor. Notepad++ is the one I use however if you google the internet for free hex editors, I'm sure you will find one you can use.

 

This isn't really that EASY to do unfortunately... :( but if you know your way around a PC, you should be able to figure it out.

 

Worse case, you can upload the .pst file to a drop using drop.io and I can do it for you then send you a repaired PST file. Let me know if you want to go down that path. Only issue there..... now a guy on the internet has your .pst and emails. Sure, you can trust me BUT, how do you know that. :twisted::twisted::twisted::twisted:

Share this post


Link to post
Share on other sites

Okay I downloaded the notepad and opened the pst. file with it but I can't understand what to do from there.

 

I've attached a screen shot, I can't understand deleting positions 7 through 13 with the space bar.

 

I appreciate your time

 

Thanks

 

5939488e3b385_Screenshot.jpg.1049cec3acf10a1d91e3957e487bd6bc.jpg

Share this post


Link to post
Share on other sites
Okay I downloaded the notepad and opened the pst. file with it but I can't understand what to do from there.

 

I've attached a screen shot, I can't understand deleting positions 7 through 13 with the space bar.

 

Hi MrMonk.

 

Ok I've done this so I'll explain. Please remember - this is not for the FAINT OF HEART!

 

Step 1 - BACKUP YOUR PST

Step 2 - Confirm you got a good backup (IE: Just copy your .PST file so if you break it, your not screwed)

Step 3 - Download Notepad++ (looks like you already did this)

Step 4 - Enable the HexEditor Plugin.

 

To enable the HexEditor for Notepad++ do the following:

A: Open Notepad++

B: Click Plugins, Plugin Manager, Show Plugin Manager

C: Click Settings Button on bottom of Plugin Manager Window

D: Check Box " Show unstable plugins " and Click OK

E: Scroll down and Check Box " HEX-Editor " and Click Install Button

 

At this point the Hex-Editor will install and tell you to close your Notepad++ to save the changes.

 

Step 4 - Re-Open Notepad++ and open a COPY of the Pst file you want to corrupt

Step 5 - Click the Hex button to view the file in HEX mode

5939488d16578_VirusScanConsole.JPG.9550062b357d58ca2f7357a9c71ceda5.JPGHex - 7.jpg[/attachment]

 

Step 7 - Press Spacebar 7 times. This will clear positions 7 through 13 on line 1. You will notice the space will delete the data and on the left 20's will be displayed on Address 6 - C as shown below

5939488e49691_hex7-13.jpg.5e2a6cfe4f9e71ceb7de33d680797ffb.jpg

 

Now, save the file and continue with the instructions from ShockerSH to repair the PST file you JUST corrupted. :) :)

hex.jpg.553fbe6554fff50d92d3c9c068ca9511.jpg

5939488e46afc_Hex-7.jpg.4ce68a3592f20e4531bd8cfeabb9cd25.jpg

Share this post


Link to post
Share on other sites
You are a legend, thank you so much

 

I appreciate how simple you made it for me.

 

 

 

Thanks

 

To Echo MrMonk21, VERY nice job Vadim! I've ran through this a few times but didn't know about the built-in plugin manager for Notepad++. Very nice.

 

MrMonk21 - Keep us updated on your progress. I'm hoping to hear your golden on the email recovery!

Share this post


Link to post
Share on other sites

Sorry to resurrect an old post but I could do with some help trying to recover emails that have been deliberately deleted from a work computer. I have followed the instructions but am having some trouble. When I move the cursor to column 7 row 1 pressing the space bar does not delete anything, the cursor merely disappears and it looks like the pressing of the space bar is doing nothing.

 

Thankyou

Share this post


Link to post
Share on other sites
Sorry to resurrect an old post but I could do with some help trying to recover emails that have been deliberately deleted from a work computer. I have followed the instructions but am having some trouble. When I move the cursor to column 7 row 1 pressing the space bar does not delete anything, the cursor merely disappears and it looks like the pressing of the space bar is doing nothing.

 

Thankyou

 

This is a late reply.... but are you still working on this?

Share this post


Link to post
Share on other sites
On 8/9/2009 at 8:23 AM, shockersh said:

Here's the info on how-to corrupt a PST file:

 

1 - To corrupt the PST file, open it with the hex editor any will do but like MrGroove said, notepad++ is good

 

2 - Delete positions 7 through 13 with the spacebar. Since you're using hexadecimal numbering, this actually clears 13 characters in the following positions:

 

3 - 00007

00008

00009

0000a

0000b

0000c

0000d

0000e

0000f

00010

00011

00012

00013

(The editor displays the code “20” each time you clear a position with the spacebar.)

 

4 - After clearing those positions in the file, save it. Your PST is now corrupted.

 

5 - Run the Inbox Repair Tool, SCANPST.exe, to recover the file. detailed by MrGroove here: microsoft-office/recovery-deleted-mail-for-pop3-and-imap-t95681.html#p96321

 

On Win2K and WinNT systems, the executable is located in C:\Program Files\Common Files\System\Mapi\1033\NT. You can also find it on the Office 2000 CD-ROM in Drive:\Pfiles\Common\System\Mapi\1033\NT.

 

In WinXP, the file is located in C:\Program Files\Common Files\System\Mapi\1033. For additional information on the Inbox Repair Tool, see Microsoft Knowledge Base article 287497.

 

If you have Office 2007 however either use Windows Vista or Windows 7 etc... SCANPST.exe should be stored in the Office 12 folder (c:\program files\microsoft office\office12\scanpst.exe) or scanost.exe for that matter as well.

 

6 - After creating a backup, the Inbox  Speed Test Scrabble Word Finder Solitaire Repair Tool repairs the damage and recreates the PST. Open the new PST in Outlook. The Deleted Items folder should contain all removed messages, so anything you've emptied will be restored.

 

The KEY here is to use a BACKUP of the .PST or .BAK file you want to restore.

. I did this once but couldn't find the how-to in order to repeat it again.

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Who's Online   0 Members, 0 Anonymous, 13 Guests (See full list)

    There are no registered users currently online