MS Exchange mailbox and single item recovery
Preparation and requirements
Exchange Single Item Restore is a built-in Exchange server feature, supported by Microsoft. See for a complete description the Microsoft TechNet site.
The following Exchange PowerShell commands are examples to prepare the Exchange server retention, to provide quick Exchange Item Restore using the Microsoft built-in features.
Use the following example Exchange PowerShell commands to prepare the Exchange server for quick Exchange Single Item Restore:
Preparation step 1
Example to configure Exchange deleted item retention period to 60 for all Exchange databases. This retention is used for recovery from the Recoverable folder tree (Dumpster).
Get-MailboxDatabase | Set-MailboxDatabase -DeletedItemRetention "60.00:00:00" Get-MailboxDatabase -Status| FT Name, Server, DeletedItemRetention, LastFullBackup
Preparation step 2
Example to enable Single Item Restore (SIR) for all existing user mailboxes. It is not possible to force this setting for newly created mailboxes. Therefore SIR needs to be set for each new mailbox. With SIR enabled, recovery from the Recoverable Purges & Versions folders is available.
Get-Mailbox -filter {(recipienttypedetails -eq "usermailbox")} | where {!$_.SingleItemrecoveryEnabled} | Set-Mailbox -SingleItemRecoveryEnabled $True Get-Mailbox | FT Name, RetainDeletedItemsFor, SingleItemRecoveryEnabled
Preparation step 3
Example to create an Exchange Security Group Exchange for the “Mailbox Import Export” role. This example adds the user Administrator to this role. To make use of this role, restart a new Exchange PowerShell instance.
New-RoleGroup "Mailbox Import-Export Management" -Roles "Mailbox Import Export" Add-RoleGroupMember "Mailbox Import-Export Management" -Member Administrator Get-RoleGroupMember "Mailbox Import-Export Management"
Instructions
The next section contains the step by step guidance on the different recovery options:
Self-service recovery using the Deleted Item folder & Recover Deleted Items
When a user deletes a mail item, this results in moving the item to the Deleted Items folder. The Deleted Items folder is visible in both Outlook and Outlook Web Access, items can be moved back by the user.
This self-service item recovery is a standard feature of Outlook Web Access and Outlook for Windows, see also the Microsoft Office support article.
Example self-service recovery: get items from the "Deleted items" folder
When a user deletes a mail item, this results in moving the item to the Deleted Items folder. The Deleted Items folder is visible in both Outlook and Outlook Web Access; the user can move the items back.
Example self-service recovery: restore items from the "Recover deleted items" folder
In case a removed item is not in Deleted Items anymore, within the Exchange retention, the user can restore the item with Recover deleted items. This feature is available in Outlook Web Access and Outlook for Windows.
Start the Recover Deleted Items feature, using the right mouse context menu in the Deleted Items folder: select Recover Deleted Items and use the Wizard to search the missed items and select Recovery.
Single Item Recovery (SIR), using the "Recoverable folder" structure (Dumpster)
When enabled, the Exchange Administrator can recover items or mailboxes using the Recoverable Folder structure (Dumpster), for more information, see Microsoft TechNet.
The following steps can be used as an example to use the Microsoft Single Item Recovery. This feature doesn’t support restoring the items from the Recoverable Items folder structure direct in the original mailbox. Therefore, some extra steps are required:
- Restore the items from the Recoverable Items folder to a temporary mailbox
- Export this folder structure to a PST export file
- Import this PST file to the original mailbox
Step-by-step example, restore recoverable items using a temporary PST file
For the step-by-step example, the following parameters are used:
| Parameter | Value |
|---|---|
| Exchange Administrator username / mailbox | Administrator |
| Recovery for the Recoverable Items tree for mailbox | Kate James |
| Folder used for recovered items on target mailbox | RecoveredItems |
| Temporary PST file for export | \\<server_name>\PST\KateJames.pst |
- Execution of the PowerShell commands for recovery is only available for an Exchange Administrator, add this user to the Exchange Security group "Organization Management"
- The temporary PST file, used for export/import the recovered items, will be created in a shared folder. The Exchange security group "Exchange Trusted Subsystem" requires full read/write permission on this shared folder
- Use Exchange PowerShell to restore Recoverable Items folder (Dumpster) for mailbox "Kate James" to the Administrator mailbox, subfolder RecoveredItems
Search-Mailbox -Identity "Kate James" -TargetMailbox Administrator –TargetFolder RecoveredItems –SearchDumpsterOnly RunspaceId : 14423653-59f0-4482-b057-9c0d1ee749dc Identity : sales.local/UsersExchange/Kate James TargetMailbox : sales.local/Users/Administrator Success : True TargetFolder : \RecoveredItems\Kate James-2-3-2017 14:21:14 ResultItemsCount : 8 ResultItemsSize : 2.567 MB (2,691,827 bytes)
After this PowerShell cmdlet, the recovered items are restored to a folder in the Administrator mailbox.
Remark: This example recover all items in the Recoverable Items folder. Using a search query, only specific items can be selected. Some example:
-SearchQuery "from:Marjorie" -SearchQuery "subject:acquisition"
- Export temporary folder RecoveredItems from mailbox Administrator to the PST export file. The export request is queued and processed by the Exchange Mailbox Replication service (MRS). After completion, cleanup this request.
Microsoft TechNet, New-MailboxExportRequest:
New-MailboxExportRequest -Mailbox Administrator –SourceRootFolder "RecoveredItems" -FilePath \\<servername>\PST\KateJames.pst ---- // ------------ // ----------- // --------------- MailboxExport // Completed // Administrator // 100 Get-MailboxExportRequest –Status Completed | Remove-MailboxExportRequest
- Import the temporary PST file in the original target mailbox "Kate James":
Microsoft TechNet, New-MailboxImportRequest:
New-MailboxImportRequest -FilePath \\localhost\PST\KateJames.pst -Mailbox "Kate James" -TargetRootFolder "RecoveredItems" Name // Mailbox // Status ---- // ------- // ------ MailboxImport1 // sales.local/UsersExchange/Kate James // Queued Get-MailboxImportRequest | Get-MailboxImportRequestStatistics Name // StatusDetail // TargetAlias // PercentComplete ---- // ------------ // ----------- // --------------- MailboxImport // Completed // kjames // 100 Get-MailboxImportRequest -Status Completed | Remove-MailboxImportRequest
After the PST import, the complete Recoverable Items folder structure is restored in the original mailbox, "Kate James". She can search the missing mails in this folder structure and move them back to the original folder.
Alternative solutions
In the case, item or mailbox recovery using the Microsoft methods is not possible, restore of a database backup is required. Using the Virtual Drive tool, it is possible to mount the Exchange database as Recovery Database directly from the backup storage location.
Restore MS Exchange mailboxes from the Virtual Drive using Microsoft tools.