Restore deleted data in Exchange Online

3 minutes

Restoring deleted email messages is a two-step process:

Recover the deleted data into a target (discovery) mailbox. You can use either the Exchange admin center (EAC) or Exchange Online PowerShell to recover deleted data. This training unit examines each method.
Restore the recovered data. You must use Exchange Online PowerShell to restore the recovered data. You can't use the EAC to restore recovered data.

Soft and hard deletions

When a user deletes a mailbox item (such as an email message, a contact, a calendar appointment, or a task), the system moves the item to the Recoverable Items folder and into a subfolder named Deletions. This process is referred to as a soft deletion.

How long the Deletions folder keeps deleted items depends on the deleted item retention period the organization sets for the mailbox. An Exchange Online mailbox keeps deleted items for 14 days by default. However, Exchange Online administrators can change this setting to increase the period up to a maximum of 30 days. Users can recover, or purge, deleted items before the retention time for a deleted item expires. To do so, they use the Recover Deleted Items feature in Microsoft Outlook or Outlook on the web.

A user can purge a deleted item by using the Recover Deleted Items feature in Outlook or Outlook on the web. This process is referred to as a hard deletion.

In Exchange Online, single item recovery is enabled by default when you create a new mailbox. As such, an administrator can still recover hard-deleted items before the deleted item retention period expires. Also, if a user or a process changes a message, the system retains a copy of the original item when an organization enables single item recovery.

Recover deleted email messages

Administrators can search for and recover deleted email messages in a user's mailbox. This process includes items that are:

Permanently deleted (purged) by a person. These items are recovered by using the Recover Deleted Items feature in Outlook or Outlook on the web.
Deleted by an automated process. An example of an automated process is a retention policy assigned to user mailboxes. In this case situation, a user can't recover the purged items. However, administrators can recover purged messages if the deleted item retention period for the item has yet to expire.

Note

Organizations can use this procedure to search for and recover deleted items. When a user deletes an item, the system moves it to the Recoverable Items\Purges folder if their organization enabled either single item recovery or litigation hold. Organizations can also use this procedure to search for items residing in other folders in the mailbox. Lastly, this procedure can delete items from the source mailbox (also known as search and destroy).

You must enable single item recovery for a mailbox before the system deletes the item you want to recover. In Exchange Online, single item recovery is enabled by default when you create a new mailbox. In Exchange Server, when you create a mailbox, the system disables single item recovery.

To search for and recover items, you must have the following information:

Source mailbox. The source mailbox is the mailbox you search.
Target mailbox. This target mailbox is the discovery mailbox in which you recover messages. Exchange Setup creates a default discovery mailbox. In Exchange Online, a discovery mailbox is also created by default. If necessary, you can create other discovery mailboxes. For more information, see Create a discovery mailbox.
Search criteria. Criteria can include the sender, recipient, or keywords (words or phrases) in the message.

Use the Exchange admin center to recover deleted messages

You can use the Exchange admin center (EAC) or Exchange Online PowerShell to recover deleted email messages. Complete the following steps to recover deleted messages using the EAC:

In the Exchange admin center, select Recipients in the navigation pane, and then select Mailboxes.
On the Mailboxes page, select the mailbox for which you want to recover deleted messages. Then select the display name of the deleted message.
Under More actions, select Recover deleted items.
Enter values for the appropriate filter criteria from the drop-down lists.
Select Apply filter.

Use Exchange Online PowerShell to recover deleted items

If you prefer to use PowerShell to recover deleted items, you must use the Get-RecoverableItems cmdlet.

Tip

Use the Get-RecoverableItems cmdlet to create a search query to find an Outlook item. Once you create a list of results, you can narrow the number of items restored or restore a specific item. To do so, you can use properties like the last modified date, item type, and so on.

Complete the following steps to recover deleted messages using Exchange Online PowerShell:

Connect to Exchange Online PowerShell.
Use the Get-RecoverableItems cmdlet to recover deleted messages. For example, the following command returns all of the available recoverable deleted messages with the specified subject in the mailbox laura@contoso.com for the specified date/time range.
```
Get-RecoverableItems -Identity laura@contoso.com -SubjectContains "FY17 Accounting" -FilterItemType IPM.Note -FilterStartTime "2/1/2023 12:00:00 AM" -FilterEndTime "2/5/2023 11:59:59 PM"
```

You can verify that you successfully searched the messages you want to recover. To do so, sign-in to the discovery mailbox you selected as the target mailbox and review the search results.

Restore recovered items using Exchange Online PowerShell

You can't use the Exchange admin center to restore recovered items. You must use Exchange Online PowerShell to restore recovered items. After you recover messages to a discovery mailbox, you can restore them to the user's mailbox by using the Restore-RecoverableItems cmdlet.

Complete the following steps to restore recovered messages using Exchange Online PowerShell:

Connect to Exchange Online PowerShell.
Use the Restore-RecoverableItems cmdlet to recover deleted messages. After using the Get-RecoverableItems cmdlet to recover the item in this example, you'll use the Restore-RecoverableItems cmdlet to restore the specified deleted items in the specified mailboxes.
```
Restore-RecoverableItems -Identity "malik@contoso.com","lillian@contoso.com" -FilterItemType IPM.Note -SubjectContains "COGS Review" -FilterStartTime "3/15/2023 12:00:00 AM" -FilterEndTime "3/25/2023 11:59:59 PM" -MaxParallelSize 2
```

This example restores the specified deleted items in the specified mailboxes:

Mailboxes: malik@contoso.com, lillian@contoso.com
Item type: Email message
Message subject: COGS Review
Location: Recoverable Items\Deletions
Date range: March 15, 2023 to March 25, 2023
Number of mailboxes processed simultaneously: 2

To verify that you successfully restored messages to the user's mailbox, have the user review the messages in the target folder. This folder is the one you specified in the Restore-RecoverableItems command.

Knowledge check

Choose the best response for the following question. Then select “Check your answers.”

Check your knowledge

Continue