Retrieve deleted e-mail

[jeepnut]

I recently deleted a very important e-mail in Outlook Express. Can anyone please tell me how I can or if I can retriver it back. I also deleted my deleted folder so everything in there is gone also.

thank you!

[Paul Komski]

As long as you didn't compact any folders then the file is most likely to be recoverable.

How did you delete the deleted folder? because this may need to be recovered first.

If there is just text that you want to find (not attachments or other non-text) you may be able to find it by opening the inbox.dbx file or the recovered deleted items.dbx file with Notepad (or a hex editor) and then search through the text.

You could also try the dbxtract or dbxpress (http://www.oehelp.com/DBXtract/Default.aspx) apps as recovery tools.

You could also try GetDataBack (http://www.runtime.org) to recover the deleted file.

[jeepnut]

I actually didn't delete the folder I just went to the deleted items folder and deleted what was in there. I did a search for the deleted items. dbx folder and found nothing. One more thing I might mention I run a program called "eraser" once a week, would that of made it disapear?
thanks

[Fruss Tray Ted]

If you ran Eraser since deleting the file consider it most likely gone.

There are .dbx folders on your drive. Find them, note the location of the Deleted Items folder and run Get Data Back at that location to retrieve them one at a time if there is any there. You will want to view them later with DB-Extract and will not be able to read them with GDB alone.

You may also be able to contact your isp and request a copy of recent emails if their server retains them for a period.

[Paul Komski]

The Deleted Items.dbx and the Inbox.dbx files are to be found in the OE Store Folder, the location of which is given in OE from Tools >> Options >> Maintenance >> Store Folder. These two files represent the folders of the same names stored in OE itself.

OE doesn't delete the contents of the folders when you simply delete emails from them; it just marks them as deleted but they remain intact until you compact the folders from the file menu. Since each folder is represented by one file, an eraser program shouldnt clear any data from the files - though if you deleted the underlying dbx files themselves then eraser would clear them up when it was run.

As you appear not to have deleted any dbx files and have hopefully not compacted any folders then your email's data should still be restorable from either (probably both) the Inbox and the Deleted Items dbx files.

Notepad is not as good as EditPadLite (http://www.editpadpro.com/editpadlite.html) at displaying the source code (particulary if word wrap is not enabled) so I would try opening the dbx files with EditPadLite, turn on word wrap from its options menu and scroll through to see if you can see anything recognisable.

You can also use its Search function from its Search/Replace menu to look for strings that would you help you find the data. Tip: search for Subject: will usually help you jump from mail to mail since just about every email has just one Subject: line.

PS If you find the basic data but have difficulty deciphering it then post back. What you need then to do is to copy all the source code of that email and save it from a new page in EditPadLite but as file with .eml as its extension. Then drag-n-drop that .eml file back into OE or simply open it. If finding the start and the end of the mails is a bit cryptic I'm sure we can help out with that.

[jeepnut]

wow what great information........ thanks so much for replying. Unfortunatly when I used "eraser" to empty my recycle bin and clean my hdd I think everything went bye bye.
I really like Editpadlite.... it's a cool program.
again thanks so much for your help.

[Sylvander]

"when I used "eraser" to empty my recycle bin and clean my hdd"
How did you do that?
I use Eraser all the time.
It doesn't erase the contents of the bin, or even the bin itself.
You can only empty the bin, then "Erase unused space" on chosen partitions, and also erase chosen folders/files.

Since the emails are inside dbx files, you'd have to delete the appropriate dbx files [using Windows Explorer], empty the bin, then "Erase unused space" on the partition that held the files to irrecoverably eliminate the info.
Or erase the dbx files direct.

[jeepnut]

When I right click my recycle bin it gives me the option of "erase recycle bin" I have it set at "Gutman" 35 passes, and my hdd drive set for 7 passes. I maybe wrong in thinking that it's erasing everything in there?
I'm getting confused now....lol :confused:

[Sylvander]

"When I right click my recycle bin it gives me the option of "erase recycle bin""
Ah, right, I remember getting that when running Win98 & Win98SE [it doesn't offer that in Win2000Pro], which Windows version are you running?
What it actually means, and really should say, is "Erase contents of Recycle Bin".

"I have it set at "Gutman" 35 passes...my hdd drive set for 7 passes"
Wow! Are you trying to hide information from some national intelligence agency?

"I maybe wrong in thinking that it's erasing everything in there?"
No, you're right, in that you did indeed erase the contents of the bin...
But your emails don't go to the bin when you delete them [I think so anyway].
From what Paul is saying I gather that the info remains...somewhere [not in the Recycle Bin], and can be restored or recovered [unless the folder is "compacted"].
Perhaps Paul might explain in more detail. :)

[jeepnut]

I'm running Windows XP Pro. I'm really not trying to hide information as much as trying to just keep my hdd clean in hopes that it will run faster.
I haven't compacted any of my e-mail folders so maybe there is still hope? I'll try to see if I can do what Paul is talking about a little more..... all I was able to find is a bunch of letters and numbers mixed together last time I tried, with just a couple of e-mails.
thanks for the responses.

[Paul Komski]

FYI there is more than one eraser program and versions of same.

With the Tolvanen Eraser 5.3 (http://www.tolvanen.com/eraser/download.shtml) the default settings include 35 passes of Gutman.

If you choose to erase the contents of the Recycle Bin (from the RClick drop down menu) with this utility it deletes the contents and then overwrites the deleted files. In other words it erases the files in the recycle bin and not the recycle bin itself.

Most people only do their deletion of emails from within the mail client application (eg Outlook Express in this instance) and the Recycle Bin is not even involved. It only becomes involved if you delete .dbx files from the store folder, which I guess was not done at all. Try opening the Deleted Items.dbx file with EditPad Lite as previously suggested. The contents, as suggested, are not always easy to decipher but lets see if you can at least see some gobbledygook.

[jeepnut]

Yes I would be using the Tolvanen Eraser 5.3. When I try to useing Editpadlite I can only open folders until I get to the "idenities" folder, then I click on that folder and it shows nothing else in there.... I've tried "any file type (*.*), Text Document (*.txt), and HTML Document (*.html;*.htm;*.stml) and it still shows nothing else.

[Paul Komski]

It would be the any file type (*.*) option but the identities folder is not the correct folder. The store folder itself is a couple more levels below this. Each identity folder will have a unique alphanumeric number (for example, {9EFEBDEA-CE00-4DD7-A4D6-CDB85C3EEDBF}) followed by "\Microsoft\Outlook Express". The dbx files should be in the Outlook Express Folder.

You can do it the other way round if you prefer. Find the dbx files in their store folder. RClick on one of them and (if there is an open with ... option use that choice) otherwise just choose Open. Next choose the option to "Select a program from a list". Check the box to "Always use the selected program to open this type of file" (which will associate .dbx files with EditPadLite).

Then browse to where EditPadLite.exe is on the drive; probably at C:\Program Files\JGsoft\EditPadLite\EditPad.exe and select it. Now you should be able to open any of the dbx files by simply double clicking on them.

You can also open them by dragging a dbx file (or a group of files) onto an EditPadLite shortcut icon on say the Desktop.

[jeepnut]

Ok this seems to be the only way I can open my "Deleted box dbx" files.

I do a search for deleted box dbx, then when it comes up I double click it and it gives me the option of opening it with Editpadlite which I do....... 27,595kb, some dating back almost a year ago. I can't find what I'm looking for there's a lot of numbers and letters mixed together with a whole bunch of little square boxes. I can't find one dated on the date I sent it and deleted it or the subject line..... still confused, but thanks so much for hanging in there with me.
Just to let you know it's not no love letter I'm looking for, it's a statement that maybe or will be used in the state courts.

[Paul Komski]

First make sure you have WordWrap turned-on from the Options menu or by toggling with the F11 key. When it is on the bottom scroll bar disappears because the text never flows to the right of the visible page. Then turn on Line Numbers from the same Options menu.

Next from the Edit Menu choose Search and Replace. Try searching for Delivered-To: as the search term and hit the search button. If it finds an entry note the line number. Search for the next Delivered-To: and note its line number again. Now copy all the text between both those line numbers. Open a new page and paste the copied text (the line numbers themselves wont be copied). Save with a name of your choice and with the .eml extension. Double click on the saved file to open in OE.

That should produce a readable eMail as a test. If successful, now keep searching for Delivered-To: instances and see if you can recognise your missing email from the headers.

If you don't find it in the Deleted Items try the Inbox.

[jeepnut]

Ok I think I exhausted all the possibilities of retrieving the e-mail I was looking for. I believe "eraser" must of had something to do with it, dunno for sure though. After doing a search for the subject line and trying the to: options it tells me file not found.
thanks to all of those who responded, I learned some lessons.

[Sylvander]

OK, one lesson to take from this is to make image backups at various points in time so that in situations like this there's a chance one of the backups will include the deleted item.

You get lots of much better other benefits too of course. :D :cool:

[Paul Komski]

Did you try or think to try DBxtraxt (http://www.oehelp.com/DBXtract/Default.aspx). A $7 expense that could be an investment after all your trials.

I don't think imaging is worth consideration when backing-up these sorts of "archive files" that, like any databases, are being updated usually on a daily or hourly basis - and particularly in the vicinity of an eraser type program run on a regular basis. The only sensible way to backup that type of data (if it is important enough data) is by an incremental (non-synchronised) backup routine as practised by most businesses with an accounts database. Or don't be too anal and clean up one's trash can too often.

[jeepnut]

I just ordered DBxtraxt. I'm waiting for an e-mail for download instructions via my payment clearing. I'll post back and let you know if it worked or not.
again thanks for all your help.

[jeepnut]

I recieved my copy of DBXtract. It appears that "eraser" completly erased everything as the program only recovered a few things that I had not used eraser on.
Thanks for all your help.

[Paul Komski]

Sorry you lost your data. :(

Hopefully you wont let it happen again.

[Sylvander]

I have all personal data files such as emails held on a separate small [1 GB] dedicated partition [D:] and "synchronised" using the [FREE] version of "SyncBack".
I notice in the "differences" list that the items most listed as having changed are the dates and times of the dbx files for the emails in Outlook Express.
These are obviously updated EVERY TIME the identity using them is opened.

The good thing about using "SyncBack" to backup/synchronise such data files is that the backup copies at the "destination" are updated so frequently, and this because it doesn't take long to do.

Probably wouldn't have saved your emails in this situation though, because it keeps a backup of the very latest up-to-date version of the files, from the last synchronisation, which would probably be only hours before discovering your need.

Don't know how you could save a copy of every email you'd ever deleted, but I'll try to remember that as something for which a solution is needed. :confused:

[Paul Komski]

Don't know how you could save a copy of every email you'd ever deleted.

You would copy them to a backup location before deleting them.

That might be impractical so a compromise may be needed. You could use SyncBack Pro and setup incremental folders based on say the minute or hour of the year to hold copies of all dbx files (in separate incremental folders based on the minute or hour of the year - or of any other timing that takes your fancy). That too is overkill so a reasonable compromise might be to backup once or twice a day but to ony rewrite (and hence overwrite the backup files) the data once a week.

There are no rules. Only the user can determine how often it is reasonable to make a backup.

[Sylvander]

"You would copy them to a backup location"
How would you do that? [May sound silly, but I don't normally do it]

a. My wife says she would just drag n' drop the email from the client [Outlook or OE] to a folder in Windows Explorer.
I tried that and it makes an ".eml" file, so that would work.

b. Or she suggested configuring the client to NOT delete emails in the "Deleted" folder when the client is closed, but instead to leave them there and then every few months manually delete all the oldest emails. That sounds most practical.