How to restore deleted Outlook items using the RecoverableItems Cmdlet

  • Article

Are you an Administrator who has ever had an Outlook user delete a large number of mails and asked to recover the deleted items to their original folder location? Maybe mail was deleted from your environment based on a Retention policy or an environment wide deletion of a specific mail.  Office 365 has released the Get-RecoverableItems and Restore-RecoverableItems cmdlet which provides Administrators the ability to:

  • Search Deleted Items and Recover Deleted Items folders
  • Restore deleted items to their original folder location
  • Control both the type and amount of items restored
  • Restore deleted items for users in bulk

This cmdlet is very simplistic. The Get-RecoverableItems cmdlet provides the ability to search the Deleted Items and/or Recover Deleted Items folders based on the following properties:

  • Last Modified Date
  • Item Type (Ipm.note, Ipm.task, Ipm.appointment, Ipm.task, Ipm.contact)
  • Item Folder Location (Deleted Items or Recover Deleted Items)
  • Subject
  • Item EntryID
  • Folder EntryID (Original folder location of the item prior to deletion)

The Restore-RecoverableItems cmdlet copies Outlook items from the Deleted Items and/or Recover Deleted Items folder to their original folder location based on the supported parameters. Now lets review a couple of scenarios in which an Administrators may find these cmdlets helpful.

How to search and restore a deleted outlook item?

The Get-RecoverableItems cmdlet allows Administrators to create a basic search query to search the Deleted Items and Recover Deleted Items folders based on a specific set of properties. In scenarios where a Outlook users is not able to find a Outlook item Administrators can now confirm if the item has been indeed deleted without logging into the users mailbox or just taking the user's word for it! Lets take a look at this at this user scenario....

Paula manages the Sales Department FY17 related accounting mail by moving important items to a folder named “FY17 Accounting Sales”. A power user, Paula performs a search for all mail with a subject containing “FY17 Accounting” in Outlook. Unable to locate the mail items Paula contacts Support.

 

Paula was able to provide the following information regaurding the deleted mail items:

Subject of the mail contained the text “FY17 Accounting”

Mail was located in the “FY17 Accounting Sales” folder

She moved the mail to the folder around September 5th

 

Based on this information, Tom the Office 365 Administrator was able to create the following search query to look for the missing mail item based on the information provided by Paula. After running the Get-RecoverableItems cmdlet he was able to identify 2 messages which matched the search query. (Note: "SubjectContains" will return all items which contains the string passed in the parameter)

Tom was able to confirm the missing mail item was located in the Recover Deleted Items folder (Recoverable Items\Deletions). The Restore-RecoverableItems cmdlet was then used to restore the specific mail item that Paula wanted to recover.

Tip: Use the Get-RecoverableItems cmdlet to create a search query to find an Outlook item. Once you have a list of results you can use properties like last modified date, item type, etc. to narrow the amount of items restored or to restore a specific item.

How to restore deleted items for users in bulk?

On September 1st, Tom the Office 365 Administrator performed a Compliance Search action to query and delete all mail that contained “FY17 Internal Auditing” in the subject within his environment. Tom was then asked to restore the deleted mail for only users in the Accounting Department.  Using the Restore-RecoverableItems cmdlet it is possible to restore messages which contained the string "FY17 Internal Auditing".

One key limitation to highlight, any mail that contains the string "FY17 Internal Auditing" will be returned. Thus, it is possible to restore more than the single item in question.  It maybe helpful to review the results of the Get-RecoverableItems cmdlet to confirm the specific items that will be restore using the search criteria. If required, additional item properties can be used to isolate the single item that should be restore such as EntryID or Last Modified Time.

To restore items for users in bulk take the following steps:

Step 1: Create a csv file that contains the user's SMTP Address using the header "SMTPAddress"

Step 2: In Exchange PowerShell run the Restore-RecoverableItems cmdlet for each user defined in the csv file

Import-CSV C:\users.csv | ForEach {Restore-RecoverableItems -Identity $_.SMTPAddress -SubjectContains "FY17 Internal Auditing"  -SourceFolder DeletedItems -FilterItemType Ipm.note}

This PowerShell cmdlet will complete the following actions:

  • Restore all mail items that contain the string "FY17 Internal Auditing" located in the Recoverable Items folder
  • This cmdlet will be ran for each user listed in the csv file

Note: Items will only be restored to the original folder location if this information is available for the item. If this information cannot be found the item will be restored to the default folder for the item type.

Tips

  • Use the Get-RecoverableItem output to identify specific information about the Outlook item like the EntryID and FolderID
  • What to know how long it will take to run a Restore-RecoverableItems cmdlet? Select several mailboxes and run the cmdlet with the Measure-Command cmdlet. It will output the amount of time it takes for the cmdlet to complete. The amount of time it takes for a restore depends on a number of factors including the number of items being restore or the number of users. It is import to benchmark performance because each environment is different.
  • The Get-RecoverableItems and Restore-RecoverableItems cmdlets outputs alot of information. Try exporting results to a csv file using the Export-CSV or Out-file cmdlet. Opening the results in excel provides an easy way to filter output base on Last Modified Date, Subject, etc.
  • Limit the amount of items returned from a Get-RecoverableItems cmdlet by using the ResultSize parameter

Limitations

  •  RecoverableItems cmdlets can only be ran against a user's primary mailbox (Note: These cmdlets cannot be ran against an Archive Mailbox)
  •  SubjectContains parameter will return all Outlook items that contain a specific string value:

For example, if you pass the string "FY17 Accounting". The RecoverableItems cmdlet would return items with the following subjects:

Subject: FY17 Accounting

Subject: Fy17 Accounting Report

Subject: Please sending reports for FY17 Accounting

  • Unable to restore Outlook items based on the applied Retention Tags
  • Outlook items are restored based on the last modified date of an item which can change (Note: This value can be updated by both users modifying the item or Exchange processes accesing the item.)
  • Unable to use cmdlet to restore items located in the Purges Folder (Note: For more information regaurding the Purges folder, check out the TechNet article  Recoverable Items folder in Exchange 2016)

Permissions

To run this cmdlet you must have one of the Exchange RBAC roles with the "Mailbox Import Export Role" assigned.

Availability

The cmdlet is only available for Exchange Online.

Syntax

Parameters Required Values
Identify Yes Identity parameter defines the identity of the mailbox or mail user (Use Alias or SMTP Address)
SourceFolder Optional Source folder parameter defines the location of the item (If undefined, the query will search both Deleted Items and Recover Delete Items folders.)•DeletedItems (Deleted Items folder)•RecoverableItems (Recover Deleted Items folder)
FilterStartTime/FilterEndTime Optional FilterStartTime/FilterEndTime parameter defines the date/time range based on Last Modified Date of the item•01/02/2018 12:00:00 AM ( Date with long time pattern)
SubjectContains Optional SubjectContains parameter will filter items based on the text in the Subject field of the item
ResultSize Optional ResultSize parameter limits the number of items returned by the Get-RecoverableItems cmdlet (Items with the most recent last modified date are returned)
EntryID Optional EntryID parameter is use to define a specific item
LastParentFolderID Optional  LastParentFolderID parameter defines the original folder location of the item prior to it being deleted
FilterItemType Optional FilterItemType parameter defines the type of mailbox item•IPM.Note•IPM.Contact•IPM.Appointment (Appointments and Meetings)•IPM.Task