How to recover outlook emails

It has happened many times in my organization that some people have left in not really good terms. So when you go to check their computers you find that they normally delete their emails, sometimes you can find them in the deleted folder (lol) but sometimes they even delete them from there.

Here is a way to get them back, I would like to see how other sys admins deal with this...

Download a hex editor from google.
Open the .pst with the hexeditor and delete positions 7 and 13.(just count the letter and do space bar on top of letter at space 7 and letter at space 13.
This will corrupt the pst file. Save it.

Run SCANPST.EXE, normally located in "C:\Program Files\Common Files\System\MSMAPI\1033". It will make a backup and then it will attempt to repair the file. Once its finished, open the .pst on outlook and emails should now be there.

NOW... if you are a sysadmin and you leave the company and you don't want anyone to recover your emails, or at least make it extra harder for them... then all you need to do after deleted your email is go to (in MS Outlook) Tools > Option > Mail Set up > Data Files > Choose the .pst and click on settings > Compact Now.

Solution 1:

The best way is to get control of the emails before they get deleted. I will discuss generally and point to examples for Exchange because that is the mail system I know best.

1- Get the emails off of the server and to an archive of some kind when they are created. The specific solution depends on your mail server ... GFI and Sherpa are among many available for Exchange.

2- I like IMAP idea (Robert Moir's comment to this answer). It is even better if the mail server can hold on to deleted items for a while. Exchange has a "2 level" trash bin .. one in the user mailbox, then another accessible only by admins on the server. You will have to make sure that the server has enough disk space to support all of the users mail, but disk is cheap.

3- You could also go at this using Outlook archiving, particularly if you can control the settings centrally. If you have AD this is easy to do with Group Policy. Set Outlook to archive daily to a central server location, and include that location in your nightly backups. You could also have a "rotation", moving them nightly to various locations so you have multiple versions around in the event of bad behavior.

Solution 2:

I think there is no real solution to this "problem." Since most organizations keep emails on the server which (hopefully) are regularly backed up, there will always be the option to restore your emails from a recent backup. I guess it wouldn't be ethically correct and even illegal, to remove all backups.

So, in my opinion, a professional way to deal with it is, that your work email (emphasis on "work") should always be handled from the perspective that the company will have access to it. Keep personal things separated from business communication using a different email address and provider (web based.)

Solution 3:

We do the standard exchange backups so I could do it that way if I needed to but I recently found a new field in Exchange at the mailbox store level which is send copy of all email this store uses to another email address.

So while it's only effective from the time I started using it, we now have an archive of all email sent and recieved by everyone in another email server that is just a simple SMTP server. This is done more for legal reasons and in the 8 months its been running other then confirming its still working I've not had to go into it.

Solution 4:

If you control your mail server - you could create copy of every incoming email message, for example using always_bcc feature in postfix.

Solution 5:

If using Exchange, I would approach this from the server side first (For the non-archived emails): Recovering Deleted Items in Exchange 2003.