How Long Can Forensic Examiners Recover Deleted Emails from a PST File?

Deleted emails inside an Outlook PST file remain recoverable for surprisingly long windows. Soft-deleted items stay in the Deleted Items folder until the user manually purges. Hard-deleted items live in the Recoverable Items dumpster for 14 to 30 days. Permanently deleted items often survive in deallocated B-tree pages for months or years until Outlook auto-compact runs. Sherlock Forensics PST Viewer Forensic Edition recovers all four layers in a single scan.

TL;DR: A forensic examiner can recover deleted emails from a PST file across four time-distinct surfaces: the Deleted Items folder (indefinite until manual purge), the Recoverable Items dumpster (14 to 30 days), the deallocated B-tree page set (months to years) plus slack space in compacted regions. The window narrows but does not close as time passes.

The Four PST Delete Surfaces

Outlook does not perform a single "delete" action. The application chains a series of state transitions, each of which produces a different forensic recovery surface. Understanding which surface a given message is on tells you how long it remains recoverable.

Surface 1: Deleted Items folder. When the user presses the Delete key on a message in the Inbox, Outlook moves the message to the Deleted Items folder. The message is still indexed plus still walks the Outlook search engine. From the PST file's perspective the message is just in a different folder. Recovery is trivial. The window is indefinite, bounded only by the user manually emptying the Deleted Items folder.

Surface 2: Recoverable Items dumpster. When the user empties the Deleted Items folder (Shift+Delete from any folder or Empty Folder), Outlook moves the message to the Recoverable Items dumpster. The dumpster is not visible to the user in the Outlook folder pane but is preserved inside the PST file. Default retention is 14 days for Outlook 2010 onward; Exchange-managed PSTs follow the Exchange retention policy, which is commonly set to 30 days. Recovery from the dumpster is a deliberate forensic action; the message survives in PST file structure with its full body, headers plus attachments intact.

Surface 3: Deallocated B-tree pages. When the dumpster retention window expires, the PST B-tree index marks the message as deallocated. From Outlook's perspective the message is gone; the search engine does not return it. From the PST file's perspective the binary body still lives in the deallocated page. The Sherlock PST Viewer Forensic Edition B-tree carving method recovers these messages until Outlook auto-compact runs. Auto-compact is opt-in plus typically fires once per quarter on user request, so the deallocated-page recovery window is often months to years long.

Surface 4: Slack space in compacted regions. Even after Outlook auto-compact, fragments of the deleted message body often persist in slack space between B-tree page boundaries. Sherlock's slack-space carving method recovers partial messages from these fragments. Recovery confidence drops because the message body may be incomplete or interleaved with unrelated fragments, but for evidentiary purposes a partial body is often enough to establish that the message existed.

What This Means for Investigations

If you are an HR investigator, legal counsel, IT auditor or examiner working a workplace investigation, the practical implication is that the standard user response of "I deleted it" almost never means the message is unrecoverable. The forensic question is which of the four surfaces the message is currently on. The earlier in the deletion lifecycle you preserve the PST file (ideally via forensic image rather than copy), the more surfaces remain available.

The corollary for IT administrators: if you are wiping a PST file for litigation hold compliance or for departing-employee cleanup, the recoverable surfaces persist far longer than the Outlook user interface suggests. A defensible wipe requires either secure overwrite of the underlying disk sectors that contained the PST plus all auto-compact backup files OR forensic-grade deletion that explicitly clears each of the four recovery surfaces.

For investigators who need to know what is actually recoverable from a specific PST, the Sherlock PST Viewer Forensic Edition at \$67 USD lifetime license runs all four carving methods in a single scan plus produces a court-ready PDF report documenting the per-message recovery confidence. The same scan also surfaces sender IP attribution from RFC-822 Received headers plus SPF, DKIM, DMARC authentication results for the recovered messages.

When Are Deleted Emails Truly Gone?

Three conditions need to be met before a deleted PST email is genuinely unrecoverable: (1) the message has progressed past the Recoverable Items dumpster window, (2) Outlook auto-compact has run AT LEAST once since the dumpster expiry, (3) the slack-space region that contained the message has been overwritten by new PST writes. In practice condition 3 is the slowest. PST files grow rather than shrink for most users, so previously-allocated slack space remains untouched for years.

The defensible answer to the question in the headline is therefore: deleted emails are recoverable from a PST file for at least 14 to 30 days through the dumpster path, then for months to years through the deallocated-page path, then indefinitely in fragmentary form through slack space. Plan your forensic preservation timeline plus your data-destruction compliance accordingly.