Using Hex Editor To Perform Email Recovery

By Author: Merge tool
Total Articles: 35
Comment this article

Have you ever come across a situation when you deleted an important email accidentally or a virus attack has resulted in data loss? If you thought that retrieving those important emails will not be possible, then don't get disheartened, you can easily recover your deleted, damaged or inaccessible emails. As we are all aware of the fact, that emails have become an integral part of our business lives and play a vital role in a significant amount of work that is carried out at office. There are important files and photos attached to them which are vital and if in case they get deleted, this might result in great loss. Email data becomes even more important if you are directly dealing with your clients and carrying out business deals through them.
Outlook PST file is the only copy of your emails, notes, contacts, calendars, archives, appointments, etc when you are not using Exchange Server account. Therefore email recovery is an important topic to be considered if a user deletes these useful items accidentally or intentionally. On the other hand, if Outlook is configured to utilize ...
... an Exchange account, administrator has the control to access all those deleted emails. Even in situations when users purge the emails, the administrator side can recover them through Exchange journaling and archiving. But the situation becomes critical when user is working on an account such as POP3. If the user deletes the PST email items permanently using Shift + Delete key or empties the Deleted Items folder, the solutions can be different; however email recovery is still possible.
Deleted items recovery from Outlook PST is possible. At times, when you don't have an updated backup to perform email recovery, a hex editor might work. These programs are usually available as freeware and allow you to manipulate the binary computer files and edit the raw file contents. So, you can easily use these tools to make required changes in any file, including corruption. Technique of recovering deleted PST items is started using Hex editor to corrupt the file and later repair it. But before, you do it, make sure you have a backup file for the same. If you have already compacted the PST and if the deleted item space has been occupied, then the process might fail. In order to perform email recovery using hex editor, follow the steps given below:
1.Open the PST file with a hex editor
2.Change the first eight bits of file ‘00' etc
3.Launch Outlook to view the PST file. Outlook will no longer recognize the file and state it as corrupt.
4.Access Scanpst.exe file to start Inbox Repair Tool and repair corrupt PST file
5.When you repair the corrupt PST, Scanpst.exe tool will recreate all the pointers and hence, the email items that you deleted get restored to their original location.
If you are not comfortable with this tip, then the only other option left is to use a third party Email Recovery software to recover deleted PST items. There are an array of email recovery utilities developed to scan affected PST to restore deleted emails, notes, calendars and other items.