daknetworks.com

Recover Deleted Items from Exchange 2013 | Recover Deleted Items from Outlook2013 | Recover Deleted Items from Outlook 2016

DEFINITIONS

DELETE - deletes the messages from the folder. Moves the messages into the DELETED-ITEMS folder (or the TRASH folder).

RETENTION - the time that you can recover items even if the messages were permanently-deleted (or deleted from the DELETED-ITEMS folder).

DISCOVERY

Exchange 2013 will have a RETENTION time for permanently-deleted messages. This setting is on the MAILBOX-DATABASE and will apply to the MAILBOX or individual account unless the MAILBOX has its own settings.

To see the settings, first find all the MAILBOX-DATABASEs names and their retention time:

-get-mailboxdatabase |select Name,DeletedItemRetention

It will spit out something like:

Name                                                        DeletedItemRetention
----                                                        --------------------
Mailbox A                                                   14.00:00:00
Mailbox B                                                   14.00:00:00
Mailbox C                                                   14.00:00:00

Great! You know that you have 14 days to retrieve something that was deleted.

SET RECOVERY

If you need to set recovery on a MAILBOX-DATABASE to say 30 days or if a retention is not set and you need to set it:

set-mailboxdatase "mailbox b" -DeletedItemRetention 30.00:00:00
(days.hours:minutes:seconds)

If you need to set recover on a MAILBOX,

set-mailbox foo.user -RetainDeletedItemsFor 720.00:00:00

And if you need to put on a Litigation Hold; which retains all items including deleted items and original versions of modified items as well as archiving is on hold:

set-mailbox foo.user -LitigationHoldEnabled $True

Or if in ECP:

-select ACCOUNT.NAME
-click MAILBOX-FEATURES (left-hand side)
-scroll to see "Litigation hold: Disabled"
-click ENABLE
-set number of days; or leave blank for indefinite

RECOVER IN OUTLOOK 2013 | RECOVERY IN OUTLOOK 2016

-click DELETED-ITEMS (on the left-hand side).
-click RECOVER-DELETED-ITEMS-FROM-SERVER (at the top).

You should see a list of the messages from the last 2 weeks.

-control-click to select the messages you want.
-click OK to restore them.

It should put them back into the folder where they went missing.

Or access on the web site at OWA.

-add yourself to the mailbox account.
-access OWA: https://mail.foo-domain.tld/owa/ This e-mail address is being protected from spambots. You need JavaScript enabled to view it /#path=/mail
-right-click DELETED-ITEMS (on the left-hand side).
-click RECOVER-DELETED-ITEMS

It should put them back into the folder where they went missing.

RECOVER IN EXCHANGE 2016

If that's too much trouble for the person, then you can do it on their behalf in the EMS.

This will put all the recovery items in the user's mailbox in a recovery-folder called 'foo.user.recovery':

Search-Mailbox foo.user -SearchDumpsterOnly -TargetMailbox foo.user -TargetFolder foo.user.recovery -LogLevel Full

And if you really want to search through the recovery items and restore them:

Search-Mailbox foo.user -SearchQuery "sent: '04/10/17' AND from: 'foo.sender'" -TargetMailbox foo.user -TargetFolder "foo.user.recovery" -LogLevel Full

NOTES:

I have this in 2 places; one for recover-deleted items and one for retention: http://www.daknetworks.com/blog/522-exchange-retention-retaindeleteditemsfor