MS Exchange mailbox and single item recovery

Exchange Single Item Restore is a built-in Exchange server feature, supported by Microsoft. See the Microsoft TechNet site for a complete description.

Before beginning recovery of mailboxes or single items, a few preparatory steps must be carried out:

Preparation

The following Exchange PowerShell commands are examples to prepare the Exchange server to provide quick Exchange Item Restore using the Microsoft built-in features.

Use the following Exchange PowerShell commands to prepare the Exchange server for single item recovery:

Step 1: Configure Retention

These commands configure the Exchange deleted item retention period to 60 days for all Exchange databases.

This retention is used for recovery from the Recoverable folder tree (Dumpster).

Get-MailboxDatabase | Set-MailboxDatabase -DeletedItemRetention "60.00:00:00"

Get-MailboxDatabase -Status| FT Name, Server, DeletedItemRetention, LastFullBackup

Step 2: Enable Single Item Restore

These commands enable Single Item Restore (SIR) for all existing user mailboxes. It is not possible to force this setting for newly created mailboxes, therefore SIR needs to be set for each new mailbox.

With SIR enabled, recovery from the Recoverable Purges & Versions folders is available.

Get-Mailbox -filter {(recipienttypedetails -eq "usermailbox")} | where {!$_.SingleItemrecoveryEnabled} | Set-Mailbox -SingleItemRecoveryEnabled $True

Get-Mailbox | FT Name, RetainDeletedItemsFor, SingleItemRecoveryEnabled

Step 3: Create User

These commands create an Exchange Security Group for the “Mailbox Import Export” role and adds the user Administrator to this role.

New-RoleGroup "Mailbox Import-Export Management" -Roles "Mailbox Import Export" Add-RoleGroupMember "Mailbox Import-Export Management" -Member Administrator

Get-RoleGroupMember "Mailbox Import-Export Management"

To make use of this role, restart a new Exchange PowerShell instance once complete.

Instructions to Restore

There are two methods of recovery that can be used for Mailbox and Single Item Restores:

Recovery using the Deleted Item folder

When a user deletes a mail item, this results in moving the item to the Deleted Items folder. The Deleted Items folder is visible in both Outlook and Outlook Web Access, items can be moved back by the user.

This self-service item recovery is a standard feature of Outlook Web Access and Outlook for Windows, see also the Microsoft Office support article.

Recovery using the "Recover deleted items" tool

In cases where a deleted item is no longer in Deleted Items folder anymore but is still within the Exchange retention, the user can restore the item using Recover deleted items.

This feature is available in Outlook Web Access and Outlook for Windows.

To use the Recover Deleted Items tool:

  1. Navigate to the Deleted Items folder
  2. In the top menu ribbon, switch to the Folder tab
  3. Select Recover Deleted Items from the Clean Up section
  4. Locate the missing items
  5. Select Ok to begin recovery

Single Item Recovery (SIR) using the Recoverable Folder structure (Dumpster)

When enabled, the Exchange Administrator can recover items or mailboxes using the Recoverable Folder structure (Dumpster), for more information, see Microsoft TechNet.

The following steps explain how to use the Microsoft Single Item Recovery. This feature doesn’t support restoring the items from the Recoverable Items folder structure direct in the original mailbox. Therefore, some extra steps are required:

  • Restore the items from the Recoverable Items folder to a temporary mailbox
  • Export this folder structure to a PST export file
  • Import this PST file to the original mailbox

Restore recoverable items using a temporary PST file

The following example parameters are used in the below example:

Parameter Value
Exchange Administrator username / mailbox Administrator
Recovery for the Recoverable Items tree for mailbox Kate James
Folder used for recovered items on target mailbox RecoveredItems
Temporary PST file for export \\<server_name>\PST\KateJames.pst

You must replace these example values with those relevant to your recovery

  1. Execution of the PowerShell commands for recovery is only available for an Exchange Administrator, add this user to the Exchange Security group "Organization Management"
  2. The temporary PST file, used for export/import the recovered items, will be created in a shared folder. The Exchange security group "Exchange Trusted Subsystem" requires full read/write permission on this shared folder
  3. Use Exchange PowerShell to restore Recoverable Items folder (Dumpster):

    The following command is to restore mailbox "Kate James", to the Administrator mailbox, sub-folder RecoveredItems:

    Search-Mailbox -Identity "Kate James" -TargetMailbox Administrator –TargetFolder RecoveredItems –SearchDumpsterOnly
    				
    RunspaceId       : 14423653-59f0-4482-b057-9c0d1ee749dc
    Identity         : sales.local/UsersExchange/Kate James
    TargetMailbox    : sales.local/Users/Administrator
    Success          : True
    TargetFolder     : \RecoveredItems\Kate James-2-3-2017 14:21:14
    ResultItemsCount : 8
    ResultItemsSize  : 2.567 MB (2,691,827 bytes)

    This example recovers all items in the Recoverable Items folder. Using a search query, only specific items can be selected. For example:

    -SearchQuery "from:Marjorie"
    -SearchQuery "subject:acquisition"
  4. Export temporary folder RecoveredItems from mailbox Administrator to the PST export file. The export request is queued and processed by the Exchange Mailbox Replication service (MRS). After completion, cleanup this request:
    New-MailboxExportRequest -Mailbox Administrator –SourceRootFolder "RecoveredItems" -FilePath \\<servername>\PST\KateJames.pst
    				
    ---- // ------------ // ----------- // ---------------
    MailboxExport // Completed // Administrator // 100
    					
    Get-MailboxExportRequest –Status Completed | Remove-MailboxExportRequest

    Microsoft TechNet, New-MailboxExportRequest:

  5. Import the temporary PST file in the original target mailbox "Kate James":
    New-MailboxImportRequest -FilePath \\localhost\PST\KateJames.pst -Mailbox "Kate James" -TargetRootFolder "RecoveredItems"
    				
    Name // Mailbox // Status
    ---- // ------- // ------
    MailboxImport1 // sales.local/UsersExchange/Kate James // Queued
    					
    Get-MailboxImportRequest | Get-MailboxImportRequestStatistics
    Name // StatusDetail // TargetAlias // PercentComplete
    ---- // ------------ // ----------- // ---------------
    MailboxImport // Completed // kjames // 100
    
    Get-MailboxImportRequest -Status Completed | Remove-MailboxImportRequest

    Microsoft TechNet, New-MailboxImportRequest:

  6. After the PST import, the complete Recoverable Items folder structure is restored in the original mailbox, "Kate James". It is then possible to search the missing mails in this folder structure and move them back to the original folder.

Alternative solutions

In the case where item or mailbox recovery using the Microsoft methods is not possible, restore of a database backup is required. Using the Virtual Drive tool, it is possible to mount the Exchange database as Recovery Database directly from the backup storage location.