Now we need to look at the PST file without Outlook to see what’s ‘under the hood’. Then we ‘permanently’ deleted that message.Īfter doing that, Outlook shows only one item in the Deleted Items folder. Turns out we didn’t have to try that hard. One of the deleted items had some unique text ‘PassportDetails’ that would be simple to search for with a hex editor looking at the ‘raw’ PST file. To test that we created a small Outlook PST file and put a few emails in it. ‘Permanently’ deleted items are still available to be read, despite Microsoft’s wording. We (foolishly) hoped that Microsoft might have changed the Outlook deletion given its use in high-security organizations, including many governments.Īlas, it’s the same behavior in PST and OST files. We wanted to check that Outlook didn’t truly erase items when ‘permanently deleted’. Windows files work a similar way with ‘deleted’ files merely marked as free space. Once a record is marked as ‘deleted’ the space used by that record can be reused for a new entry, which is also a faster way to add a new record (instead of creating extra space for a new record, just reuse old unneeded space). Tagging as ‘deleted’ and hiding from the application is the fastest way to do it and databases are usually programmed with speed as a primary goal. It’s standard database procedure for a deleted record simply to be flagged ‘deleted’ rather than fully erased or overwritten.
For anyone interested in the gory details or testing themselves, here’s how we checked that out.
When Outlook displays a ‘This will be permanently deleted’ it’s not really deleted.
0 kommentar(er)
