Sometimes I got a call from a user claiming that some data from his mailbox has been removed by an invisible force.
Usually I am able to find lost folder/files under other sub folder (Well! Would you look at that!)
User then tries to tell he/she didn’t do anything. IT WAS OUTLOOK!
Yup, definitely Outlook…
There are moments when items indeed haven’t been moved but deleted. What options do we have? Here I would like to highlight functionality called “Single Item Recovery”. To enable it we can use:
Set-Mailbox <mailbox_name> -SingleItemRecoveryEnabled $true
What happens when user deletes data from his mailbox? Those go to “Deleted items” on the first place, later, if item has been removed from there as well it goes to “Recover Deleted Items”, that allows user to recover items from Outlook doing those 4 steps:
When user removed the elements from above place, items go to another folder that is not visible for user – called “Purges”.
There is a great article about that work-flow on technet:
Below picture comes from there as well:
On testuser1 I have removed everything from “recover deleted items” but one item – just to let you see how it would be visible. To get number of items that are sits in “Purges” we can use below command:
Get-MailboxFolderStatistics -Identity “<mailbox_name>” -FolderScope RecoverableItems -IncludeAnalysis | ft
So we clearly see here that there is something we can recover, there is also one item in “Deletions” and that folder shows us items in “Recover Deleted Items” option in Outlook.
Now how to get those elements from there? We can use Search-mailbox query for that:
Search-Mailbox <source_mailbox_name> -TargetMailbox <destination_mailbox_name> -TargetFolder ODZYSK3 -SearchDumpsterOnly
With SearchDumpsterOnly we specify scope of our search only for “Deletions” and “Purges” – it is not searching in “Deleted Items” folder as you would think of.
Interesting thing is, if any of the messages that have been recovered has had already been read – here in that example where we haven’t had read any of them – that status would be remembered, and that status would be also reflected in the target mailbox after recovery. So for example if 4 messages that were in purges were read, the unread counter on the Purges folder in target mailbox will show us 3135.
What we can do now is to export that to PST and import to the proper mailbox 🙂
We need to do it that way as we cannot give name of the target mailbox same as the source mailbox in Search-Mailbox cmdlet.
So hey! We have recovered the deleted elements! We didn’t let to surprise ourselves, we were prepared! Just like Ross 😀