Recover Deleted email

Agreed.. mail logging or a replica that hadn't replicated after the email was deleted would be your only options as sjef says.

Well, of course..:)  Good Point, Rickal.

Thank You, Marilyng. Of course, one might assume that a backup is either unavailable or didn't have the messages the user was looking to recover, but perhaps.......maybe.......  8-)

> The email was deleted after it was received so backup is not an option.
I assume one has to read:
> The email was deleted immediately after it was received so backup is not an option.

Basically what I'm looking for is some kind of tool that will scan the file for deleted areas.  The same thing you would do to recover deleted info on a hard drive.  The file has not been compacted and there is lots of free space.  The info must be sitting somewhere on the database.
Thanks again

Ooops, sorry Sjef, you have caught me again....didn't catch that.

I'd say you are out of options. Unless someone else here has some magic trick to recover deleted Notes messages I haven't heard of as of yet, but would love to...............

Wouldn't we all...

Alas, there is no second Trash in a Notes mail database. There was a time there wasn't even a first Trash in the mail...

Yeah, agreed, the only thing you can recover is the delete stub, and that just has who sent it and the date.  Rest is blank.  sjef's ID: 16688216 is the correct answer.

Regarding the last Author Comment, from what I understand with the workings of Lotus Notes, the databases re-use and write over empty space, so if you delete a message completely out, the db is going to use that space with its next write. Our legal department either loves or hates this feature, depending on their position in a case.

Short answer, you cannot recover data from disk sectors that contained deleted data. The only way I could see is if you got lucky enough to catch it before a new document was written over the deleted one.

Actually, there's an Advanced database option: don't overwrite free space. Go tell your legal department!!  :)

So if you don't overwrite the free space.  You are saying that the data can be recovered.  Can someone explain how this can be performed.  How do I view the free space of a mail file and see the deleted data.

Thanks,

Usually, the option if not activated. IMHO, just forget it.

YOu can view the contents of the delete stub using notespeek.  Ytria also has a tool, but I have tried to recover deleted, and it's not like files you delete off your hard drive where you can sniff bits or files having a particular prefix.  Although an interesting thought to try and step through a Notes database bit/byte by bit/byte.   I don't know of any way to grab the contents of the white space.

Sometimes, you're lucky and the trash folder isn't emptied, so the stuff is there.  But, if I select all, hit delete, it moves to the trash folder. If I empty trash, it deletes it and leaves a delete stub in it's place.  The delete stub retains the note ID and when you replicate to the server or to a replica it's the delete stub that tells notes to delete the corresponding documents in the replica.

So, if I hit delete in the trash, the documents are removed from THAT replica.  The same documents exist in another replica until I replicate.  When I do, then notes reads the delete stubs and removes the corresponding documents.

The delete stubs expire (usually in 30 days) so, if I deleted a bunch of documents on the server, but Joe has a local replica and doesn't replicate in thirty days, when he finally does, the deleted documents come back from JOE'S replica.  Because that's where they still exist in their full form, and the delete stubs on the server expired and were removed by the server.

Good stuff, Marilyng!

Funny story.. a Notes Admin doing a hugh migration accidentally selected all in the NAB to see how many people she had left to migrate.  Then for some reason, she hit the delete key.  The only reason she lucked out was because the NAB's replicated every 15 minutes, so when she discovered her error, it was a mad dash to turn off replication and find the replica that had the original documents and quick as a bunny make new copies (ctrl+copy, ctr+paste).  We finally located a LAPTOP that hadn't replicated where we recovered the deleted person documents.

Marillyng, that story sounds familiar! I have had to do that in the past. Only once though! That is the kind of mistake you only make one time. Heh.