Recover Deleted Items using The PowerShell in Exchange Online

Microsoft has introduced two new CMD in Exchange Online, which admins can utilize and restore the emails from Deleted Items and Recoverable Items Folders.

• Get-RecoverableItems
• Restore-RecoverableItems

In this post, I will demonstrate how can we search and restore emails from Recoverable Items folder using the PowerShell.

For Demonstration purpose I have Created a folder name “TestFolder” in my mailbox and have placed some test message in it.

 

Now Let’s (Shift + Del) Permanently them, permanently deleted emails skip the Deleted Items Folder and directly goes to Recoverable Items.

Now that we have permanently Deleted the test emails, let's search for them using the PowerShell.

Search using the Subject keywords

We can use the below CMD to search the emails with the subject containing the “test”

Get-RecoverableItems -Identity USerID -SubjectContains "Test"

This will bring us the list of all the emails contains “test” in the subject line, we can also use the complete subject of the deleted emails to find the specific email.

Example: CMD can be run without using the parameter (-SourceFolder RecoverableItems) to include search from the Deleted Items Folder, I am using the parameter to restrict the search within Recoverable Items Folders only.

Get-RecoverableItems userid -SourceFolder RecoverableItems -SubjectContains "Test Email 1"

RunspaceId           : 054cf13e-2854-4a87-8bc9-421e7d5cfbfd
Identity             : FsNmDYNFjMRMsjyKUX78tvYAAcPBXLhGAAAAABTTPIv2KjBOhSke7IKz6G8HAMNmDYNFjMRMsjyKUX78tvYAAAAAARQA
MailboxIdentity      : userid
ItemClass            : IPM.Note
Subject              : Test Email 1
EntryID              : 0000000014D33C8BF62A304E85291EEC82B3E86F0700C3660D83458CC44CB23C8A517EFCB6F60000000001140000
SourceFolder         : Recoverable Items\Deletions
LastParentFolderID   : C3660D83458CC44CB23C8A517EFCB6F60001C30A1A92
LastModifiedTime     : 02/28/2018 19:23:58
LastParentPath       : TestFolder
OriginalFolderExists : True
IsValid              : True

As we can see that the “OriginalFolderExists” is true this means the folder from where the emails were deleted is still exist and hence the email can be restored back to the original folder.

Search Deleted emails using Source Folder:

If the user is not aware of the subject like keywords, admins to do the dump of all the emails available in the Deleted and Recoverable items folder, and can share the same with the end user, where the user can identify the emails and then those items can be restored.

Get-RecoverableItems -Identity USERID -SourceFolder RecoverableItems

Or for Deleted Items use.

Get-RecoverableItems -Identity USERID -SourceFolder DeletedItems

OR just run with any parameter to do the search in both the folders.

Get-RecoverableItems -Identity USERID

Search Deleted emails using Last Parent Path:

We can also find the items based on the “Last Parent Path”, it’s the folder from where the emails were permanently deleted.

To do the same first find the one of email from the folder and then get its “LastParentFolderID”, same as shown below.

SourceFolder         : Recoverable Items\Deletions
LastParentFolderID   : C3660D83458CC44CB23C8A517EFCB6F60001C30A1A92
LastModifiedTime     : 02/28/2018 19:23:58
LastParentPath       : TestFolder

Now that we have the “LastParenFolderID” run the command like below to get all the items that were deleted from the “TestFolder”.

Get-RecoverableItems -Identity USERID LastParentFolderID C3660D83458CC44CB23C8A517EFCB6F600000000010F

Restore Deleted emails:

Now that we have Identified the emails which we need to restore, so let’s restore the emails.

There are multiple ways to restore the emails, lets first use the subject keyword method.

Restore Based on Subject-Keyword:

Restore all the emails matching the Subject “Test” from Recoverable items folder.

Restore-RecoverableItems -Identity userid -SubjectContains "test" -SourceFolder RecoverableItems

Restore the emails using the Last Parent FolderID:

To restore the emails using the last parent folder id we need to first fetch it using the steps showing in the picture below.

Now that we have the “LastParentFolderID” we can run the below CMD to restore all the message which were deleted from the folder Named “TestFolder”

Restore-RecoverableItems USERID -LastParentFolderID 49E10BC037762B48BD1CB1EA9415EACD0000C2C76B69

This completes my post on restoring emails using PowerShell, I hope you will find it informative.