What to do if you delete your mailbox?

Background

Whenever the F-Secure Anti-Virus product detects a virus or some other malware, it suggests various methods to get rid of the malware. You can either disinfect, delete or rename the file containing the detected malware. When the malware arrives in an e-mail message, you have to exercise special caution because the contaminated email message goes to your e-mail inbox which in most cases is just a single file that contains all the incoming e-mails. For example, Microsoft Outlook and Outlook Express store e-mails to a file called inbox.pbx or similar.

Disinfection of such a mailbox file is not recommended because the mailbox files are usually very complicated and sensitive to modifications. The easiest way to get rid of the contaminated file is just to delete the e-mail message that contains a virus or other kind of malware. If you accidentally delete the entire e-mail inbox file while trying to get rid of the the malware, you will lose all your e-mail messages stored in the inbox.

Because the F-Secure Anti-Virus products do not store the deleted files in a recycle bin (like Windows does), an accidentally deleted mailbox file cannot be restored easily.

Note! The primary restoring method is always to take backups regularly.

Tip! In Windows XP, you can restore your files by using the System Restore feature of the operating system. For more information about system restore, refer to your Windows XP documentation.

How to restore the mailbox

Even if a file has been deleted from the hard disk by the F-Secure Anti-Virus, there still is a small chance that you can restore it.

Note! By following the below steps you may be able to restore your mailbox file. The recovery of your e-mail messages is not, however, guaranteed!

To restore your mailbox file, do as follows:

1. As soon as you notice that your emails are gone, stop using your computer. (It would be best if you stopped using the computer right after you selected the Delete option from the F-Secure Anti-Virus product.) Further usage of your computer can lead to overwriting your deleted mailbox file which makes the recovery of the file almost impossible. In any case, do not switch off your computer!


2. If possible, use another computer to find a file recovery software that you can use. There are many file recovery software available in the Internet. F-Secure does not recommend any specific software. Search for a suitable software by using terms, such as "File Recovery" or "Windows File Undelete". There are also evaluation versions available and even free versions of such software.


3. It is recommended that you first install the file recovery software to a floppy disk or other removable storage device, insert the storage device then into your computer (i.e. the computer containing the infected file) and start the file recovery software directly from the external storage device. Still, try to keep usage of the computer as minimal as possible.


4. Run the file recovery software and use either a scan to find the recoverable files or pinpoint the location of the deleted mailbox file. There might also be a chance to look for certain filenames among the recoverable files.

   What to look for:
   Look for filenames containing a word or words, such as "inbox" or "mail", or for file extensions, such as ".pst", ".dbx" or ".mbx". These are just examples, but you will probably spot the correct recoverable file easily.

5. Once you have found the correct file, e.g. inbox.pst, recover or undelete it (this depends on the software used; the feature for restoring the file could also be called something else).

Note: If the software issues a warning stating that the file may not be correctly recovered, some of the file's original data might have already been overwritten by the operating system or some other application. This means that it is almost impossible to recover the file!

6. Once the file to be recovered is found, the file recovery software will ask you where to save the recovered file. It is recommended that you copy or place the recovered file either to another external storage device or hard disk but if no such device or hard disk exist, save it, e.g. to the root of your C-drive (c:\).


7. If your mailbox file was correctly recovered without any errors, locate now the correct place for the mailbox file so that your e-mail client can use it. If you have started your e-mail client before the recovery operation, it has probably created a new mailbox file which is now empty. Find the file, e.g. by using the Find function (look again for the same information as mentioned in Step 4). If you cannot find the mailbox file, consult your e-mail client documentation or contact technical support.


8. Once you have found the correct place for your mailbox, take a backup of the current empty (or almost empty) mailbox file, if any, and replace then the current mailbox file with the one you just recovered.


9. Start now your e-mail client and check if you got your e-mails back. Good luck!

Take backups of your files regularly!