SingleItemRecovery in Exchange 2013, recovering emails from Purges folder with Search-Mailbox cmdlet.

Sometimes I got a call from a user claiming that some data from his mailbox has been removed by an invisible force.

Usually I am able to find lost folder/files under other sub folder (Well! Would you look at that!)

User then tries to tell he/she didn’t do anything. IT WAS OUTLOOK!

tea_thinkerYup, definitely Outlook…

There are moments when items indeed haven’t been moved but deleted. What options do we have? Here I would like to highlight functionality called “Single Item Recovery”. To enable it we can use:

Set-Mailbox <mailbox_name> -SingleItemRecoveryEnabled $true

single_item_recovery_1

What happens when user deletes data from his mailbox? Those go to “Deleted items” on the first place, later, if item has been removed from there as well it goes to “Recover Deleted Items”, that allows user to recover items from Outlook doing those 4 steps:

single_item_recovery_2

When user removed the elements from above place, items go to another folder that is not visible for user – called “Purges”.

There is a great article about that work-flow on technet:

https://technet.microsoft.com/en-us/library/ee364755%28v=exchg.150%29.aspx

Below picture comes from there as well:

single_item_recovery_3On testuser1 I have removed everything from “recover deleted items” but one item – just to let you see how it would be visible. To get number of items that are sits in “Purges” we can use below command:

Get-MailboxFolderStatistics -Identity “<mailbox_name>” -FolderScope RecoverableItems -IncludeAnalysis | ft

single_item_recovery_4So we clearly see here that there is something we can recover, there is also one item in “Deletions” and that folder shows us items in “Recover Deleted Items” option in Outlook.

Now how to get those elements from there? We can use Search-mailbox query for that:

Search-Mailbox <source_mailbox_name> -TargetMailbox <destination_mailbox_name> -TargetFolder ODZYSK3 -SearchDumpsterOnly

With SearchDumpsterOnly we specify scope of our search only for “Deletions” and “Purges” – it is not searching in “Deleted Items” folder as you would think of.

single_item_recovery_5

single_item_recovery_6Interesting thing is, if any of the messages that have been recovered has had already been read – here in that example where we haven’t had read any of them – that status would be remembered, and that status would be also reflected in the target mailbox after recovery. So for example if 4 messages that were in purges were read, the unread counter on the Purges folder in target mailbox will show us 3135.

What we can do now is to export that to PST and import to the proper mailbox 🙂

We need to do it that way as we cannot give name of the target mailbox same as the source mailbox in Search-Mailbox cmdlet.

So hey! We have recovered the deleted elements! We didn’t let to surprise ourselves, we were prepared! Just like Ross 😀

single_item_recovery_7