data remains

Scrubbing email out of a Windows computer

the legacy approach to email, typified by Microsoft's Outlook program, permanently mated email to one computer. Many flaws in this mode of operation are obvious, but I recently ran across a flaw that isn't so obvious.

Before getting rid of an old Windows XP laptop, I was removing data files and un-installing applications. Turns out it's fairly hard to totally scrub the details of Outlook and Outlook Express email accounts from the Windows Registry.
 


Before removing Outlook 2003, I wanted to insure that I knew the password (this wasn't my computer). To that end, I ran Mail PassView from Nirsoft. Nir Sofer, the man behind nirsoft.net, makes some excellent, free, portable software for Windows.


In addition to passwords, Mail PassView displays many other attributes of an email account as shown below.


=============================
Name             : Firstname LastnameApplication     : Thunderbird
Email             : someuser@gmail.com
Server            : pop.gmail.com
Server Port     : 123
Secured         : No
Type              : POP3
User              : someuser
Password       : apasswordwashere
Profile            :
Password Strength : Medium
SMTP Server          :  smtp.gmail.com
SMTP Server Port   :  25
==============================

It supports a long list of email clients including Thunderbird, all versions of Outlook, Windows Mail (both the Live and dead versions), IncrediMail and Eudora. If a webmail account has a password stored in a Windows application (such as a Hotmail password stored in a Microsoft Messenger app) chances are that Mail PassView can find it.


Running Mail PassView before removing Outlook 2003 revealed everything, including the fact that Outlook was configured for both a POP3 account from an ISP and a Gmail IMAP account.


It also revealed a surprise, Outlook Express had, at one time, been used for email on this machine. I ran Outlook Express to see what was there, and found just a single, very old, message. Even though the account was not really used, the owner of the computer certainly would not appreciate the details of their old email address (including the password) being available to the next user of the computer.


So, I un-installed both Outlook Express and Outlook 2003.


Since Windows applications often leave traces behind, I re-ran Mail PassView and fell off my chair. It reported all the same data that it had before un-installing the email programs. It was as if the applications had never been removed.