MS Exchange mailbox and single item recovery

Preparation and requirements

Exchange Single Item Restore is a built-in Exchange server feature, supported by Microsoft. See for a complete description the Microsoft TechNet site.

The following Exchange PowerShell commands are examples to prepare the Exchange server retention, to provide quick Exchange Item Restore using the Microsoft built-in features.

Use the following example Exchange PowerShell commands to prepare the Exchange server for quick Exchange Single Item Restore:

Preparation step 1

Example to configure Exchange deleted item retention period to 60 for all Exchange databases. This retention is used for recovery from the Recoverable folder tree (Dumpster).

Get-MailboxDatabase | Set-MailboxDatabase -DeletedItemRetention "60.00:00:00" Get-MailboxDatabase -Status| FT Name, Server, DeletedItemRetention, LastFullBackup

Preparation step 2

Example to enable Single Item Restore (SIR) for all existing user mailboxes. It is not possible to force this setting for newly created mailboxes. Therefore SIR needs to be set for each new mailbox. With SIR enabled, recovery from the Recoverable Purges & Versions folders is available.

Get-Mailbox -filter {(recipienttypedetails -eq "usermailbox")} | where {!$_.SingleItemrecoveryEnabled} | Set-Mailbox -SingleItemRecoveryEnabled $True Get-Mailbox | FT Name, RetainDeletedItemsFor, SingleItemRecoveryEnabled

Preparation step 3

Example to create an Exchange Security Group Exchange for the “Mailbox Import Export” role. This example adds the user Administrator to this role. To make use of this role, restart a new Exchange PowerShell instance.

New-RoleGroup "Mailbox Import-Export Management" -Roles "Mailbox Import Export" Add-RoleGroupMember "Mailbox Import-Export Management" -Member Administrator Get-RoleGroupMember "Mailbox Import-Export Management"

Step-by-step instructions

The next section contains the step by step guidance on the different recovery options:

Self-service recovery using the Deleted Item folder & Recover Deleted Items

When a user deletes a mail item, this results in moving the item to the Deleted Items folder. The Deleted Items folder is visible in both Outlook and Outlook Web Access, items can be moved back by the user.

This self-service item recovery is a standard feature of Outlook Web Access and Outlook for Windows, see also the Microsoft Office support article.

Example self-service recovery: get items from the "Deleted items" folder

When a user deletes a mail item, this results in moving the item to the Deleted Items folder. The Deleted Items folder is visible in both Outlook and Outlook Web Access; the user can move the items back.

Example self-service recovery: restore items from the "Recover deleted items" folder

In case a removed item is not in Deleted Items anymore, within the Exchange retention, the user can restore the item with Recover deleted items. This feature is available in Outlook Web Access and Outlook for Windows.

Start the Recover Deleted Items feature, using the right mouse context menu in the Deleted Items folder: select Recover Deleted Items and use the Wizard to search the missed items and select Recovery.

Single Item Recovery (SIR), using the "Recoverable folder" structure (Dumpster)

When enabled, the Exchange Administrator can recover items or mailboxes using the Recoverable Folder structure (Dumpster), for more information, see Microsoft TechNet.

The following steps can be used as an example to use the Microsoft Single Item Recovery. This feature doesn’t support restoring the items from the Recoverable Items folder structure direct in the original mailbox. Therefore, some extra steps are required:

  • Restore the items from the Recoverable Items folder to a temporary mailbox
  • Export this folder structure to a PST export file
  • Import this PST file to the original mailbox

Step-by-step example, restore recoverable items using a temporary PST file

For the step-by-step example, the following parameters are used:

Parameter Value
Exchange Administrator username / mailbox Administrator
Recovery for the Recoverable Items tree for mailbox Kate James
Folder used for recovered items on target mailbox RecoveredItems
Temporary PST file for export \\<server_name>\PST\KateJames.pst
  1. Execution of the PowerShell commands for recovery is only available for an Exchange Administrator, add this user to the Exchange Security group "Organization Management".

  2. The temporary PST file, used for export/import the recovered items, will be created in a shared folder. The Exchange security group "Exchange Trusted Subsystem" requires full read/write permission on this shared folder.

  3. Use Exchange PowerShell to restore Recoverable Items folder (Dumpster) for mailbox "Kate James" to the Administrator mailbox, subfolder RecoveredItems:

    Search-Mailbox -Identity "Kate James" -TargetMailbox Administrator –TargetFolder RecoveredItems –SearchDumpsterOnly

    RunspaceId : 14423653-59f0-4482-b057-9c0d1ee749dc
    Identity : sales.local/UsersExchange/Kate James
    TargetMailbox : sales.local/Users/Administrator
    Success : True
    TargetFolder : \RecoveredItems\Kate James-2-3-2017 14:21:14
    ResultItemsCount : 8
    ResultItemsSize : 2.567 MB (2,691,827 bytes)

    After this PowerShell cmdlet, the recovered items are restored to a folder in the Administrator mailbox.

    Remark: This example recover all items in the Recoverable Items folder. Using a search query, only specific items can be selected. Some example:

    -SearchQuery "from:Marjorie"
    -SearchQuery "subject:acquisition"

  4. Export temporary folder RecoveredItems from mailbox Administrator to the PST export file. The export request is queued and processed by the Exchange Mailbox Replication service (MRS). After completion, cleanup this request.

    Microsoft TechNet, New-MailboxExportRequest:

    New-MailboxExportRequest -Mailbox Administrator –SourceRootFolder "RecoveredItems" -FilePath \\<servername>\PST\KateJames.pst

    ---- // ------------ // ----------- // ---------------
    MailboxExport // Completed // Administrator // 100

    Get-MailboxExportRequest –Status Completed | Remove-MailboxExportRequest

  5. Import the temporary PST file in the original target mailbox "Kate James":

    Microsoft TechNet, New-MailboxImportRequest:

    New-MailboxImportRequest -FilePath \\localhost\PST\KateJames.pst -Mailbox "Kate James" -TargetRootFolder "RecoveredItems"

    Name // Mailbox // Status
    ---- // ------- // ------
    MailboxImport1 // sales.local/UsersExchange/Kate James // Queued

    Get-MailboxImportRequest | Get-MailboxImportRequestStatistics
    Name // StatusDetail // TargetAlias // PercentComplete
    ---- // ------------ // ----------- // ---------------
    MailboxImport // Completed // kjames // 100

    Get-MailboxImportRequest -Status Completed | Remove-MailboxImportRequest

  6. After the PST import, the complete Recoverable Items folder structure is restored in the original mailbox, "Kate James". She can search the missing mails in this folder structure and move them back to the original folder.

Alternative solutions

In the case, item or mailbox recovery using the Microsoft methods is not possible, restore of a database backup is required. Using the Virtual Drive tool, it is possible to mount the Exchange database as Recovery Database directly from the backup storage location.

Restore MS Exchange mailboxes from the Virtual Drive using Microsoft tools