In Outlook Express 6, each folder is stored as a dbx file, which is with 2-GB size limit. When a message is deleted or moved to another folder, it is flagged as deleted and still occupies space in original folder. Compacting a folder releases the spaces occupied by deleted/moved messages. A bak file, copy of corresponding folder, is created before compaction and is moved to recycle bin after the process. If i can find the file Inbox.bak, the missing messages will be recovered. However, Inbox.bak was gone due to full of recycle bin.
i made a dd image file of the affected partition (C: ~80GB). My first action on this image file was using Windows System Restore, but it didn't backup user data, like emails and documents. Some Windows/Linux data recovery tools didn't help either. During these trials, there is a valuable thing found, INFO2, the log file of recycle bin. i opened it by using rifiuti2 and found that the target Inbox.bak is 1.4GB.
Arne Schloh decoded Outlook Express dbx file format and kindly published in http://oedbx.aroh.de/doc/OE_Dbx_FileHeader.html, 2 portions in file header are very useful for me
0x0000 "cf ad 12 fe" Equal for all dbx files. 0x007c-0x0080 used space of the file.
Then i successfully recovered Inbox.bak by the following steps
- write a script to search hex string "cfad12fe" over the image file and record their positions.
- check all used space values related to found positions, there is one near 1.4GB.
- extract this 1.4GB portion and save as a dbx file.
- open this dbx file by Outlook Express, and it is what i need, my luck.