Recover deleted messages in a user's mailbox in Exchange Online
Administrators can search for and recover deleted email messages in a user's mailbox. This includes items that are permanently deleted (purged) by a person (by using the Recover Deleted Items feature in Outlook or Outlook on the web (formerly known as Outlook Web App)), or items deleted by an automated process, such as the retention policy assigned to user mailboxes. In these situations, the purged items can't be recovered by a user. But administrators can recover purged messages if the deleted item retention period for the item hasn't expired.
Note
In addition to using this procedure to search for and recover deleted items (which are moved to the Recoverable Items\Purges folder if either single item recovery or litigation hold is enabled), you can also use this procedure to search for items residing in other folders in the mailbox and to delete items from the source mailbox.
What you need to know before you begin?
Estimated time to complete: 15-30 minutes.
Procedures in this article require specific permissions. See each procedure for its permissions information.
Single item recovery must be enabled for a mailbox before the item you want to recover is deleted. In Exchange Online, single item recovery is enabled by default when a new mailbox is created. In Exchange Server, single item recovery is disabled when a mailbox is created. For more information, see Enable or disable single item recovery for a mailbox.
To search for and recover items, you must have the following information:
Source mailbox: This is the mailbox being searched.
Search criteria: Criteria include sender or recipient, or keywords (words or phrases) in the message.
You need the Mailbox Import Export RBAC role before you can do this procedure or procedures.
Use EAC for recovering deleted messages
In the EAC, navigate to Recipients > Mailboxes.
Select the mailbox for which you want to recover deleted messages.
Under Others > Recover deleted items, select the link Recover deleted items.
Use the filters available to locate the messages you want to recover, and then select Apply filter.
Select the messages you want to recover, and then click Recover deleted items.
Using PowerShell to manage deleted items
Step 1: Connect to Exchange Online PowerShell
For instructions, see Connect to Exchange Online PowerShell.
Step 2: Search for and recover missing items
This example returns all of the available recoverable deleted messages with the specified subject in the mailbox laura@contoso.com for the specified date/time range.
Get-RecoverableItems -Identity laura@contoso.com -SubjectContains "FY17 Accounting" -FilterItemType IPM.Note -FilterStartTime "2/1/2018 12:00:00 AM" -FilterEndTime "2/5/2018 11:59:59 PM"
For detailed syntax and parameter information, see Get-RecoverableItems.
Step 3: Restore recovered items
Once you have finalized the filters for the messages you want to recover, you can restore them to the user's mailbox by using the Restore-RecoverableItems cmdlet.
Restore-RecoverableItems -Identity "malik@contoso.com","lillian@contoso.com" -FilterItemType IPM.Note -SubjectContains "Fiscal Year Review" -FilterStartTime "3/15/2019 12:00:00 AM" -FilterEndTime "3/25/2019 11:59:59 PM" -MaxParallelSize 2
After using the Get-RecoverableItems cmdlet to verify the existence of the item, this example restores the specified deleted items in the specified mailboxes:
Mailboxes: malik@contoso.com, lillian@contoso.com
Item type: Email message
Message subject: Fiscal Year Review
Location: Recoverable Items\Deletions
Date range: 3/15/2019 to 3/25/2019
Number of mailboxes processed simultaneously: 2
For detailed syntax and parameter information, see Restore-RecoverableItems.
More information
Users can recover a deleted item if it hasn't been purged and if the deleted item retention period for that item hasn't expired. If users need to recover deleted items from the Recoverable Items folder, point them to the following articles: