Outlook – undelete big files – mission impossible

file-recoverymicrosoft-outlookntfs

I've accidentaly deleted outlook.pst (6.7GB) file, while there was only 400MB free space left on primary NTFS partition (winxp).

I've tried several recovery tools to get this file back.
"Ontrack Easy Recovery Pro" found 0 pst files (complete scan mode), while "Recover My Files" in sector scan mode found 5 pst's, but 4 of them of sizes from 3 to 28 KB, while the 5th one – 1Gb.

I've managed to succesfuly recover 1Gb pst file, which was 1 year old copy (the one used after the latest windows reinstall).

Now, I'm frustrated and confused

  1. Why 1 year old file was succesfuly
    recovered if there were only 400MB
    left on primary partition?

  2. Where's 6.7GB file gone?

  3. I did some reading (i.e. here),
    and it seems that there's almost no
    probability to retrieve the file I'm
    looking for, but wait – none of
    recovery tools i've used found
    zero-sized pst file, moreover – if
    due to fragmentation a file might be
    corrupted – we could use scanpst.exe
    to fix some errors and survive with
    10 or 100 emails missing – whatever.

  4. Could you please recommend some more sophisticated recovery tools
    for this particular task?

Appretiate your help – thanks in advance

Best Answer

Did you install the recovery tools after losing the PST file?
If so, you may find they're sat right where your Outlook data used to be.

In general (and it may be too late for you now), files deleted from NTFS (and most Unix filesystems too) are less likely to be recovered if the operating system has been writing data to disk since the deletion.

If you can stop all (or most) disk writes immediately after losing a file, and use off-line recovery tools (i.e. booting off a Live CD for recovery and copying any recovered data to another partition or to a USB thumb-drive), you have a pretty good chance of getting the data back.

But on a disk with relatively little free space, there's a strong chance that your data has already been overwritten.

As for your questions:

  1. If you've just removed 6.7GB, there should be more than 400MB left on the disk. If there's only 400MB even now, then something else must have been writing to disk and taking up the space previously used by your Outlook PST.
    In which case, you won't be able to recover much (if anything).

  2. The 6.7GB file may still be there (parts of it), as long as nothing else has written over it in the meantime.

  3. You'll need to get a (possibly partial) file back before you can do much with scanpst

  4. Recuva might be able to find the file, but you should seriously consider some off-line recovery method - even if that means taking out the disk and putting it into another PC so that you can examine it without booting off it.
    System Rescue CD could help you too, or any of these others (below) but you should use some other PC to get hold of them and burn to CD:

Related Question