Member Avatar for mfl8625

Hi,
I have a computer that I issued to another user. Two months later the old user decides to tell me that they would like their archive emails. I logged onto them machine and even though I deleted user profiles, I had not emptied the recycle bin. When I went to look at the specific user his documents and settings did not exist. I looked at the other users that had logged into that machine (it is common here for users to share a machine) and theirs were all present. I am looking for the users .pst file.

I have used three different recovery tools from online and they all pretty much recover the same items. It did find the outlook archive.pst but it was empty. The user cannot remember where he archived too and it is like looking for a needle in a haystack since all searches for .pst's turn up nothing, nada. I have the users archives from 2005 to 2007, 2009 & 2010- just need the 2008. People should not use their emails like a file system.............just an observation!

Any suggestions on software that might dig in deeper to find those deleted sectors? I have tried: Easeus Data Recovery,PC Tools File Recovery & RecoveryFix-PST.

(Windows XP Pro OS/MS Office Pro 2007)

Thanks!

  • 2 Contributors
  • 3 Replies
  • 266 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by gerbil

Dani AI

Generated

Short summary tied to the thread: described a missing 2008 archive PST after user-profile deletion; correctly pointed out why normal recoveries can fail. The single best chance now is to stop any further writes to that drive, make a sector‑by‑sector image, and perform all recovery work from that image rather than the live disk.

Immediate practical checklist (in order):

  • Take the machine out of service so the disk is not written to.
  • Remove the drive or boot the machine from a clean USB and attach an external target drive at least as large as the source.
  • Make a full forensic image (sector copy). Example using Linux dd:
    dd if=/dev/sdX of=/mnt/backup/disk-image.dd bs=64K conv=noerror,sync
sha1sum /mnt/backup/disk-image.dd > disk-image.sha1

    FTK Imager or GNU ddrescue are alternative imaging tools. Always verify the image hash.

Recovery approach to run against the image (not the original):

  • Use an MFT-aware NTFS tool and a signature (carving) tool in parallel. Tools known to succeed where simple file-table scans fail include R‑Studio, GetDataBack/ReclaiMe/UFS Explorer and PhotoRec (for raw carving). Let these scan the image — they can find PST fragments even when file-table entries are gone.
  • If a PST is recovered but appears empty or corrupted, run Microsoft’s Inbox Repair Tool (SCANPST.EXE for Outlook 2007) or a reputable PST repair utility against a copy of the recovered file only.

Additional checks before giving up:

  • Search the image for common PST paths on XP (e.g., C:\Documents and Settings\<user>\Local Settings\Application Data\Microsoft\Outlook and My Documents\Outlook Files), look for .bkf or other backup bundles, and check whether mail was archived on the mail server/Exchange rather than locally.

If these steps fail and the data is critical, consider a professional data‑recovery lab (they can sometimes reconstruct files from partially overwritten sectors). All work should proceed from the disk image to avoid further damage.

Recommended Answers

All 3 Replies

Member Avatar for gerbil

All recovery softwares head straight for the file tables [master and perhaps the backup]. With an NTFS system there is no other way... the file tables record which sectors are used for each file, a deletion is made by marking those sectors' entries with an altered bit; the table entries [filename and sectors used] remain intact. If both tables are corrupt then the affected files are pretty much lost to all but the most expensive forensic work.
So if you delete a profile [a collection of files and registry entries] then the associated sectors are marked, as mentioned above. If the Recycle Bin is full or a file etc is too big then it won't be placed in the bin. Shift-Delete, an application delete or a cmd line delete won't put them in there, either. Once so marked they can be overwritten at any time. Pretty much, if those apps don't show the profile's files, then they are gone.

Member Avatar for mfl8625

Thanks gerbil. Not what I wanted to hear, but my bad on not backing this up prior.

Member Avatar for gerbil

I could have written that a bit better. Chopping and moving bits garbled it somewhat. What i meant was.. the user profile could not have gone into [or stayed in] the bin otherwise its file table entries would be intact. Outside the bin, sectors marked as deleted are re-usable, hence are not safe. By file tables being corrupt, I meant only the actual entries for the files you seek being broken, not the table integrity lost.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.