Recover an Exchange user mailbox from an OST file
Solved Email & Outlook
RK
Rachel Kim
September 28, 2020
2 replies
8,540 views
Reviewed by moderators

Admin mistake on our side: a departed employee's Exchange mailbox was deleted before anyone exported it, and legal now needs its contents. What survives is the OST on the returned laptop.

Is the OST genuinely recoverable into something usable, and is there anything server side worth trying first?

Accepted Answer
Verified by Edwin J. Hoffer, Email Systems Specialist ยท Reviewed September 2020

Try the server first, because Exchange may not have actually thrown the mailbox away yet. The server copy beats any recovery from cache.

Deleted mailboxes enter a retention period, thirty days by default on both Exchange Server and Exchange Online, during which an admin can reconnect or restore them intact. On premise that is the disconnected mailbox area, in 365 it is a soft deleted mailbox restorable through PowerShell or the admin center. Check how long ago the deletion happened before touching the laptop, inside the window this is a clean administrative restore with nothing lost.

Past the window, the OST on that laptop graduates from cache to sole surviving copy. It is genuinely recoverable: the file contains the mailbox as of its last sync, and a standalone converter reads it without the dead account, SysTools OST Converter parses the file directly and exports to PST for legal review or import into another mailbox.

Handle the laptop accordingly before anything else: image or copy the OST out via %localappdata%\Microsoft\Outlook without starting Outlook on it, since launching Outlook against a dead account can prompt profile changes that touch the file. Copy first, convert the copy and note the last sync time visible in the converted data since the recovered snapshot is only as current as the final sync before the laptop was returned.

Deletion was 47 days ago so the window had closed. Copied the OST off first, converted and legal has their PST covering everything to the last sync. Retention policy meeting scheduled for obvious reasons.