Friday, June 13, 2008

Corrupting your Outlook PST file

Couple of months ago, I accidentally deleted about 1600 emails, some of which were of quite importance. I could have lived without them, but I figured since PST files are basically databases, they will not be deleting emails for real, just flagging them as deleted

I googled around and found this nice tutorial how to get your files back.

The first obstacle I hit was a problem with long filenames. I don't know if my DEBUG.EXE is stupid, but mine wouldn't open a file over 8.3 characters. So I renamed my copy of pst file to something short and upon running again I hit "Insufficient memory" error.


F:\debug a.pst
Insufficient memory

I did a couple of tests and found out, that the size limit for DEBUG.EXE is 574816 bytes. Files larger than that will simply not fit. So if you have more than ten emails in your inbox, you will probably encounter problems as well :).

So I had two options what to do

  1. Download a hex editor and edit it manually
  2. Write a program for corrupting PST files

You already know, which option I chose. It wasn't the geekiness of it, but I figured, that I will be sending this program to my less tech savvy friends and giving them instructions will be much easier if I skip the part with hex editor :).

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char *argv[])
{
 FILE *f = fopen(argv[1], "r+b");
 int length = 6;

 unsigned char *a = (unsigned char*)malloc(sizeof(unsigned char)*length);
 memset(a, 20, length);

 fseek(f, 7, SEEK_SET);
 fwrite(a, 1, length , f);
 fclose(f);
 free(a);
 return 0;
}

Usage: In case you accidentally delete some emails, you need to

  1. Turn Outlook off
  2. Locate your PST file
  3. Run corrupt.exe YourOutlookfile.pst
  4. Start "c:\Program Files\Common Files\System\MSMAPI\1033\SCANPST.EXE" or whichever version you have.

For convenience purposes binary version follows corrupt.zip (7kB).

Thanks to Mark James for creating the amazing Silk icons.

Btw. my favourite hex editor is xvi32. It's really good, check it out.

20 comments:

Anonymous said...

Ondrew:

I just used your corrupt.exe file and retreived by Boss' deleted e-mail messages. I followed your instructions and it work w/o a problem. Thanks so much.

Anonymous said...

I am running Win XP and your software crashed with an error message. Are there any known conflicts?

David said...

BTW, if you are running outlook 2007, you can simply make use of "the Tools->Recover Deleted Items". You just select the proper folder, then click on "Recover..." then tadam! You have access to 2 weeks of deleted items... Dot know if it's also implemented in Outlook 2003 but hope this might help some people... Saved me today!!!

Anonymous said...

Many thanks for this Gem.

I was facing an absolue nightmare but you got me out of the ****.

many thanks

Ian

Steve said...

Recover deleted items only works if you're on an Exchange mail server.
I ran your program, but Scanpst didn't recover any deleted emails.

whall said...

Fantastic approach - you definitely got clever in this instance. Much appreciated!

Anonymous said...

Do you just run the corrupt.exe from the location you saved it? I am not sure I understand the process of running corrupt with YourOutlook.pst

Anonymous said...

Thank you very much for the corrupt.exe, using this file I was able to recover a 700Mb PST files with all the delete items.

Anonymous said...

I just recovered 6000+ emails I deleted accidentally by following your procedure, which ran flawlessly. Thanks!!!

Lisa said...

Hello, I have the same question anonymous had on June 9; do I just run corrupt.exe from the location where I saved it? (on my desktop) Sorry to bug you with the same question.

Thanks for your help

Anonymous said...

Drag your PST onto the corrupt.exe to run it for those having problems.

Anonymous said...

You are the best, just recovered 400 business e-mails!!
THANKS!
RESPECT!

Anonymous said...

BRILLIANT! Thank you so much.

Anonymous said...

This doesn't work. I opened the zip file and double-clicked on Corrupt.exe and keep getting an error message that the memory reference could not be read. So then I tried dragging and dropping my .PST file "onto" the Corrupt.exe file as per Anonymous, and it doesn't do anything.

Arnie said...

I encountered problems on two XP machines. Copied the PST to my local drive and ran everything on my Vista laptop. It worked. Thanks.

Andrew Culture said...

I'm trying to recover sent mail that a user may have deleted after sending and then deleted from 'deleted items', it's PST based mail on Outlook 2003.

When I run corrupt.exe should I see any sort of confirmation message in DOS? It's just returning to the prompt and scanpst.exe isn't finding any deleted emails.

ta star!


Andrew

Autumn said...

This is so wonderful; this saved my job!!!

sen said...

I used your tool, the process is too good compared to all others I found on the web, but I had to retrieve a particular mail i deleted,I could not.

Anonymous said...

I had the same problem sen did. I had a specific e-mail I was looking for. The instructions worked great and I recovered all kinds of deleted e-mails, but not the one I needed. It had a 4MB attachment to it, maybe that was the problem? Would still like to find it if anyone has any other ideas.

Syed Khairuddin Ahmed said...

I tried but it but it keeps on giving me the error corrupt pst has encountered an error and needs to be close.