File Recovery – Why Deleted Files Are Not Actually Deleted from Hard Drive

Did you install the recovery tools after losing the PST file?
If so, you may find they're sat right where your Outlook data used to be.

In general (and it may be too late for you now), files deleted from NTFS (and most Unix filesystems too) are less likely to be recovered if the operating system has been writing data to disk since the deletion.

If you can stop all (or most) disk writes immediately after losing a file, and use off-line recovery tools (i.e. booting off a Live CD for recovery and copying any recovered data to another partition or to a USB thumb-drive), you have a pretty good chance of getting the data back.

But on a disk with relatively little free space, there's a strong chance that your data has already been overwritten.

As for your questions:

1. If you've just removed 6.7GB, there should be more than 400MB left on the disk. If there's only 400MB even now, then something else must have been writing to disk and taking up the space previously used by your Outlook PST.
   In which case, you won't be able to recover much (if anything).

2. The 6.7GB file may still be there (parts of it), as long as nothing else has written over it in the meantime.

3. You'll need to get a (possibly partial) file back before you can do much with scanpst

4. Recuva might be able to find the file, but you should seriously consider some off-line recovery method - even if that means taking out the disk and putting it into another PC so that you can examine it without booting off it.
   System Rescue CD could help you too, or any of these others (below) but you should use some other PC to get hold of them and burn to CD:

   • Ultimate Boot CD 4 Win (UBCD4Win)
   • Knoppix-STD
   • Insert
   • FIRE

Try using tail to copy the file continually:

tail -c +0 -f /proc/$pid/fd/$fd > filename

Of course, you will have to stop the tail process by hand (or some other external means) when the download has finished.