Exchange/Outlook Hard-Delete

When typically working with e-mail within Outlook you will read your e-mail, and then perhaps delete it which will move it to the “Deleted Items” folder. From there, you may choose to “Empty” the folder, or you may have some automated policy to delete the contents during logoff, or other automated period. If you are using Microsoft Exchange, then it becomes available for a short period of time in the recovery of the Deleted Items folder. This time period is based on the retention settings configured in Exchange, typically 14 days.

However, there is an additional feature in Outlook called a “Hard Delete”. This occurs when you hold down the shift key while pressing the delete key. When you do this, it performs a Hard Delete. What happens is that the item is then moved immediately to the recovery area on the folder you deleted it from. It skips the Deleted Items folder all together.

What is less known about Item Recovery in Outlook is that in reality each folder has it’s own Recovery Folder, and that my default, Microsoft Outlook 2003 and prior will only show you the option (under Tools) to open the recovery folder for the deleted items folder. However, when you hard delete an item it goes into the recovery folder of the folder from which it was hard deleted from. These recovery folders are hidden by default in Outlook 2003 and prior.

In Microsoft KB246153, we see how to make a registry change to enable item recovery on every folder:

As a side note, Microsoft recently added a feature to their support website which is called “Fix it for me” which will perform many tasks such as registry changes for you without requiring a manual edit of the registry.

Also, one final note, once an item has been purged from the recovery folder or the retention period (14 days by default) has passed, the e-mails will no longer be recoverable except via backups. And even still, if a message was received, hard-deleted and purged between backup intervals, the recoverability is next to impossible.