How to Recover Deleted Emails in Microsoft Exchange Server

In this article, Bharat Bhushan shows you how to recover deleted emails in Exchange Server.

This article is sponsored by Stellar Info.

Key takeaway

It is simple to restore deleted emails from the Deleted Items folder in Outlook and Outlook on the Web (OWA). Follow these steps:

• Open the Deleted Items folder in Outlook.
• Find the deleted email, right-click on the email, and click Restore.

Users may delete emails or other mailbox items accidentally while freeing space in their mailbox or data file. However, deleted items don’t get purged or permanently deleted immediately.

Users can easily restore items from the Deleted Items folder in Outlook, within the retention period specified by your organization. When the retention period is over, deleted items can still be retrieved in Exchange Server.

But before you can recover deleted items, you need to understand the places/folders where you can find the them.

Where can you find deleted items in Exchange Server?

In a Microsoft Exchange Server environment, there are three places where you can find deleted items and recover them. These are:

• Deleted Items folder: This folder is in the user’s Outlook. When an item is deleted, the user can simply restore it from this folder without any intervention from an administrator.
• Recover deleted items from server (Recoverable Items folder): This folder is also in the user’s Outlook. This folder is like a Recycle Bin for deleted items. When a user empties the Deleted Items folder, they can find and retrieve the items from the Recoverable Items folder.
• Purged items: If the items have been removed from the Deleted Items and Recoverable Items folders, they are kept in a vault which is only accessible by the Exchange Server administrator.

Understanding email deletion in Exchange Server

When an item is deleted, it goes into the Deleted Items folder. If the item is deleted from the Deleted Items folder, it goes into the Recoverable Items section. Users can retrieve deleted items without intervention by an administrator. However, if the items are deleted from the Recoverable Items folder, then only the administrator can retrieve the emails using the discovery services.

There could be retention policies set by Exchange administrators to automatically delete items which are older than a certain period. Such items go straight to the vault and can only be retrieved by the administrator.

By default, recoverable items have a retention period of 14 days. If the mailbox has a litigation hold, the emails will not be deleted while the litigation hold is enabled.

Ways to recover deleted emails in Exchange Server

Let’s see how to recover deleted emails and other mailbox items in Exchange Server.

Recover from Deleted Items Folder in Outlook

Users can easily recover deleted emails from the Deleted Items folder in Outlook and Outlook on the Web (OWA). Here’s how:

• Open the Deleted Items folder in Outlook.
• Find the deleted email, right-click on the email, and click Restore.

Administrators can use the Exchange Management Shell (EMS) to search through a user’s mailbox with the Search-Mailbox command (see the below example).

Search-Mailbox "<mailbox>" -SearchQuery "from:'SenderName' AND 'Keywords'" -TargetMailbox "Discovery Search Mailbox" -TargetFolder "Deleted Items" -LogLevel Full

Recover from Recoverable Items

The Recoverable Items section holds the following folders:

• Deletions, include soft deleted items and items deleted using Shift+Delete keys.
• Versions, hold different versions of the items.
• Purges, hold all the items which were purged from the recoverable deleted items.

Only an administrator with the right permissions can restore deleted items using the following commands.

• Get-RecoverableItems: To find the deleted items.
• Restore-RecoverableItems: To restore the deleted items.

Recover emails from Purged folder

To recover items from the Purged folder, you should first check if the single item recovery feature is enabled on the mailbox. You should also check the retention period of the Recoverable Items folder (Dumpster). If the default retention period is over, you cannot recover such items from the database.

To recover deleted items, first search through the mailbox using the New-MailboxExportRequest command:

New-MailboxExportRequest -Mailbox "Discovery Search Mailbox" -SourceRootFolder "RecoveryFolderName" -FilePath <unc path to destination>

Then, run the following command to export the recovered item to a PST file:

New-MailboxExportRequest -Mailbox "Discovery Search Mailbox" -SourceRootFolder "RecoveryFolderName" -ContentFilter {Subject -eq "'Email Subject'"} -FilePath <unc path to destination>

Now, you can copy the PST file to the user’s device.

Recover deleted items using a third-party tool

You can use specialized tools to recover deleted items from live, corrupt, or standalone Exchange Server databases. Stellar Repair for Exchange helps you recover deleted mailbox items from Exchange database (EDB) files.

This Exchange recovery tool can open EDB files from any version of Exchange Server, of any size, and in any state. After scanning the EDB file, it shows all the EDB data, including the deleted items. You can use the tool to export the deleted and recoverable items to a PST file, to a live Exchange Server database, or Office 365.

Exchange Litigation/In-Place Hold feature can prevent mailbox item loss at the expense of increased storage space

In this article, we discussed the deletion process in Exchange Server and four different ways to recover deleted emails and other items in Exchange Server. However, you can recover the deleted items within the retention period. If you want to stop users deleting emails permanently and prevent retention policies affecting the ability to restore mailbox items, consider enabling the Litigation/In-Place Hold feature on mailboxes.