Skip to content

Recover mail items from Recovery mail folder (the Dumpster) using PowerShell | Part 3#5

In the current article, we will review how to use the PowerShell cmdlet Search-Mailbox to recover mail items stored in the Recovery mail folder (also named the Dumpster). The recovery mail folder considers as a “system folder”, and it’s not visible to the user (mailbox owner).

Table of contents

Recovery mail folder

The purpose of the Recovery mail folder is to serve as a “container” for Soft Deleted mail items and Hard deleted mail items.

Using the Search-Mailbox PowerShell cmdlet enables Exchange administrator, to “look at” the content of the Recovery mail folder + Copy ALL the recovery mail folder content to a Target Mailbox or, only specific items stored in the Recovery mail folder.

Suppose you want more information about the “Recovery mail folder”, read the article Recover deleted mail items in the Exchange Online environment | Single item recovery | 2#7.

The parameter “SearchDumpsterOnly”

By default, the Search-Mailbox PowerShell cmdlet will perform a search in all the mailbox folders (inbox, etc.), including the Recovery mail folder (the Dumpster).

In a scenario in which we want to restrict the search scope only to the Recovery mail folder (the Dumpster), we can use the following cmdlet parameter -SearchDumpsterOnly

Using this parameter is suitable for a scenario in which we need to help users to recover mail items that were deleted and stored in the Recovery mail folder (the Dumpster).

Scenario 1: Emails that are disappearing.

A user that reports about “emails that disappeared”, and we need to check if these mail items are deleted (as mentioned, the user cannot access the specific folder in the “Recovery mail folder store” which stored Hard Deleted mail items).

Scenario 2: Restore (recover) mail items saved by In-Place Hold or Litigation Hold.

In case that we use the option of – In-Place Hold or Litigation Hold, mail items that deleted by the user will be saved in the Recovery mail folder (the Dumpster).

Only the Exchange administrator can access this special folder and one of the methods that Exchange administrator can use for “fetching” data from the Recovery mail folder (the Dumpster) is by using the Search-Mailbox PowerShell cmdlet.

Recovery mail folder (the Dumpster) and deleted mail items “Lifetime”

An additional detail that I would like to mention is, that by default, the Recovery mail folder (the Dumpster) stored deleted mail items for a period of 14 days. At the end of this period, Soft Deleted and Hard deleted mail items older than 14 days, will be permanently deleted without any option to recover this mail item!

In other words, the Search-Mailbox PowerShell cmdlet can serve as a utility for viewing and export the content of the Recovery mail folder (the Dumpster) but, cannot help us to recover old mail items.

Note: The exception to this “14 days rule” is an Exchange mailbox with Litigation Hold or In-Place Hold.

Scenario description

The Goals

The goals we seek to achieve are:

  1. View + Copy mail items stores in a specific Exchange mailbox in the Recovery mail folder (the Dumpster).
  2. The search is implemented by defining a specific Search Query (search criteria), that will help us to locate specific mail items that answer the Search Query.
  3. The Search Results will be copied to a Target Mailbox and saved in a dedicated folder (Target Folder).
  4. In addition, we want to create a detailed report (Log), about each mail items that appear in the Search Results (the Log \ Report file will be saved in the Target Folder)

Source mailbox + Target mailbox (and Target Folder)

  • The Source Mailbox (the mailbox on which we perform the search) is Bob’s mailbox
  • The Target Mailbox which we use for storing the search result (the mail items) is Adele’s
  • The Target Folder name will be – Search Results – Bob -Recovered mail items.
Scenario description - Search mailbox + Save search results to other mailbox

The mailbox search scope

In the current scenario, we restrict the Search-Mailbox cmdlet to perform a search in the “Source Mailbox” only in the Recovery mail folder (the Dumpster).

Primary mailbox

  1. The Search-Mailbox cmdlet will perform a search only for mail items stored in the Recovery mail folder (the Dumpster).

Archive mailbox

In case that the Source Mailbox has Archive mailbox,

  1. The Search-Mailbox cmdlet will perform a search only for mail items stored in the Archive Mailbox Recovery mail folder (the Dumpster).

An example of the outcome of search results

In the following screenshot, we can see an example of a scenario in we use the Search-Mailbox cmdlet to perform a search on Bob’s mailbox – Recovery mail folder and copy the Search results to Adele’s mailbox.

The Search-Mailbox cmdlet creates a New folder (Target Folder) and store all the Search Results (copy the mail items) in this folder (the Target folder).

In our scenario, Bob mailbox has an archive mailbox + Bob Mailbox uses In-Place Hold.

The search results folder hierarchy includes two separated “spaces”:

  1. Archive mailbox (A in screenshot)
  2. Primary mailbox (B in screenshot)

To understand better the result that we got, let’s review the Primary mailbox (B in the screenshot)

In our case, we perform a search that “ignore” the content of the mailbox and relates only to the Recovery mail folder (the Dumpster).

Under the Primary mailbox store, we can see the Recoverable Items store.

The Recoverable item’s store includes the following sub folders:

  1. Deletions: this is the folder that store – Soft Deleted mail items
  2. Purges: this is the folder that store – Hard Deleted mail items
  3. DiscoveryHolds: this is the folder that store – mail items that saved by the In-Place policy.
Search-Mailbox Recover mail items from recover folder Dumpster

Connect to Exchange Online PowerShell

To be able to run the PowerShell commands specified in the current article, you will need to Connect to Exchange Online PowerShell.

Start Windows PowerShell as administrator and run the cmdlet Connect-ExchangeOnline.

Connect-ExchangeOnline

In the following section, we will demonstrate various type of scenario in which we use the Search-Mailbox cmdlet + the parameter SearchDumpsterOnly, for “fetching” mail items from the Recovery mail folder (the Dumpster).

Search and Copy mail items from Recovery Folder (Dumpster) | ALL mail items

In this example, we use the Search-Mailbox cmdlet without any Search query filters.

In this scenario, our goal is to copy all the mail items that exist in the Source Mailbox in the Recovery mail folder (the Dumpster) the Target Mailbox.

Search + Save a copy ALL mail items | Search Query – NO Filter (no Search Query)

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -TargetMailbox "Destination mailbox" -TargetFolder "Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search and Copy mail items from Recovery Folder (Dumpster) | Search query Filter – specific Type of Mail item

In this scenario, we want to locate (search) and copy only a specific type of mail items from the Source Mailbox stored in Recovery mail folder (the Dumpster).

Search + Save a copy of mail items | Search Query filter – Calendar items

Search for mail items stored in Recovery mail folder (the Dumpster), look for a specific type of mail items – Calendar items.

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery "Kind:meetings" -TargetMailbox "Destination mailbox" -TargetFolder "Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery "Kind:meetings" -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search + Save a copy of mail items | Search Query – Contact items

Search for mail items stored in Recovery mail folder (the Dumpster), look for a specific type of mail items – Contacts items.

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery "Kind:contacts" -TargetMailbox "Destination mailbox" -TargetFolder "Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery "Kind:contacts" -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Note: By default, if not specified, the Search-Mailbox cmdlet will look for all types of message types.

When using the option the “kind” search filter, valid values can be one or more of the following:

  • Email
  • Meetings
  • Tasks
  • Notes
  • Docs
  • Journals
  • Contacts
  • IM

Search and Copy mail items from Recovery Folder (Dumpster) | Search query Filter – Text String

In this section, we use Search Query that looks for mail items that include a specific text string.

General note – because we use the quotation marks, the search will fetch only results in which all the words in the text string that we define appear.

For example, in our example, we look for the text string: “A meeting in New York.”
Mail items that include the words “New York” or “meeting” will not appear in the Search Results.

Only mail items that include all the text phrases that appear inside the quotation marks, will be considered as “valid mail items” that answer the Search Query (exact phrases or keywords in subjects of items).

Search + Save a copy of mail items | Search Query – Mail items with Text String in mail SUBJECT

In the following example, we look for mail items stored in Recovery mail folder (the Dumpster) that include a specific TEXT string that appears in E-mail Message Subject line.

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery Subject:"Text String" -TargetMailbox "Destination mailbox" -TargetFolder "Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery Subject:"A meeting in New York" -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search + Save a copy of mail items | Search Query – Mail items with Text String in mail BODY

Search for mail items stored in Recovery mail folder (the Dumpster), that include a specific TEXT string that appears in E-mail Message Body.

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery body:"Text String" -TargetMailbox "Destination mailbox" -TargetFolder "Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery body:"A meeting in New York" -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search + Save a copy of mail items | Search Query – Mail items with Text String in mail BODY or Mail Subject

Search for mail items stored in Recovery mail folder (the Dumpster), that include a specific TEXT string that appears in E-mail Message Body or Mail Subject.

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery "Text String" -TargetMailbox "Destination mailbox" -TargetFolder "Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery "A meeting in New York" -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Additional PowerShell command syntax that we can use for performing a search that includes two types of search criteria is:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery {Subject:"A meeting in New York" OR body:"A meeting in New York"} -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search and Copy mail items from Recovery Folder (Dumpster) | Search query Filter – specific Date or Date Range

General information about the subject of “Date and Date format.”

The subject of the date format that we use in the Search-Mailbox query is a little tricky because the date format is affected the Windows OS Date format, the Exchange Online Mailbox Date format, etc.

Case 1: Most of the time, the date format that you need to use in the Search Query is your Windows OS Date format.

Case 2: When using a date format in Search-Mailbox queries needs to be in a format that conforms to the Exchange server’s Regional settings.

In case that you get an error such as – “The KQL parser threw an exception,”, use the “month name” instead of the format of “month number.”

For example, instead of using the Date format – 07/21/2017 use the following format – 02/July/2017.

Search + Save a Copy of mail items | Search Query – Emails SENT on a Specific Date

Search for mail items stored in Recovery mail folder (the Dumpster), that sent on a specific date.

PowerShell command syntax

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery sent:mm/dd/yyyy -TargetMailbox "Destination mailbox" -TargetFolder "Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery sent:21/07/2017 -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search + Save a copy of mail items | Search Query – Emails SENT in a specific Date Range

Search for mail items stored in Recovery mail folder (the Dumpster), that sent on a specific Date Range.

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery {sent:mm/dd/yyyy..mm/dd/yyyy} -TargetMailbox "Target mailbox" -TargetFolder "Target Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery {sent:21/06/2017..07/21/2017} -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search + Save a copy of mail items | Search Query – Emails RECEIVED in a specific Date Range

Search for mail items stored in Recovery mail folder (the Dumpster), that Received on a specific date range.

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery {Received:mm/dd/yyyy..mm/dd/yyyy} -TargetMailbox "Target mailbox" -TargetFolder "Target Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery {Received:21/06/2017..21/07/2017} -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search + Save a copy of mail items | Search Query – Emails SENT in a specific Date + Emails RECEIVED in a specific Date

Search for mail items stored in Recovery mail folder (the Dumpster), that Sent or Received on a specific date range.

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery {sent:mm/dd/yyyy OR Received: mm/dd/yyyy} -TargetMailbox "Destination mailbox" -TargetFolder "Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery {sent:30/07/2017 OR Received:30/07/2017} -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search and Copy mail items from Recovery Folder (Dumpster) | Search query Filter – sender or by Recipient

In this section, we would like to search mail items that were sent from a specific sender or reach to a specific recipient.

Search + Save a copy of mail items | Filter scope – Email sent by a specific SENDER

Search for mail items stored in Recovery mail folder (the Dumpster), that was Sent from a specific Sender (the FROM mail field).

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery from:"E-mail address" -TargetMailbox "Target mailbox" -TargetFolder "Target Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery from:"John@o365info.com" -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search + Save a copy of mail items | Filter scope – Emails sent TO a specific RECIPIENT

Search for mail items stored in Recovery mail folder (the Dumpster), that was Received by a specific recipient (sent to a specific recipient – the TO mail field).

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery to:"E-mail address" -TargetMailbox "Target mailbox" -TargetFolder "Target Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery to:"Alice@outlook.com" -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search and Copy mail items from Recovery Folder (Dumpster) | Search query
Filter – E-mail Attachments

In this section, we would like to search mail items that have an attachment.

Search + Save a copy of mail items | Filter scope – Emails that include a specific attachment file name

Search for mail items stored in Recovery mail folder (the Dumpster), that have an attachment with a specific file name.

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery attachment:"Attachment file name" -TargetMailbox "Target mailbox" -TargetFolder "Target Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery attachment:"Customer.pdf" -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search + Save a copy of mail items | Filter scope – specific attachment type (suffix)

Search for mail items stored in Recovery mail folder (the Dumpster), that have an attachment with a specific File extension.

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery {Attachment -like "*.suffix"} -TargetMailbox "Target mailbox" -TargetFolder "Target Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery {Attachment -like "*.PDF"} -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search + Save a copy of mail items | Filter scope – Emails with Attachment

Search for mail items stored in Recovery mail folder (the Dumpster), that have an attachment with, that have an attachment.

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery {HasAttachment -eq $true} -TargetMailbox "Target mailbox" -TargetFolder "Target Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery -SearchQuery {HasAttachment -eq $true} -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Search + Save a copy of mail items | Filter scope – E-mail items size greater than X MB

Search for mail items stored in Recovery mail folder (the Dumpster), that their size is “bigger” (greater) than a specific size.

PowerShell command syntax:

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery {Size -gt <size in KB or MB>} -TargetMailbox "Target mailbox" -TargetFolder "Target Folder" -LogLevel Full

PowerShell command example:

Search-Mailbox "Bob" -SearchDumpsterOnly -SearchQuery -SearchQuery {Size -gt 5MB} -TargetMailbox "Adele" -TargetFolder "Search Results - Bob" -LogLevel Full

Writing advanced/combined search filters

An additional part that I would like to mention briefly is the subject of defining a more advanced or more sophisticated search query that combines two or more “filter” or search conditions.

To define two or more filters, we can use the logical operators such as “OR”,”AND” and more.

In the following diagram, we can see some examples of the syntax that we use for defining a more advanced Search Query.

Using a combination of Search Query parameters

Example 1

Look for all mail items that answer the following search criteria:

Mail items with an attachment + in addition, the mail subject is “Test”.

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery {HasAttachment -eq $true and subject:Test} -TargetMailbox "Target mailbox" -TargetFolder "Target Folder"

Example 2

Look for all mail items that answer the following search criteria:

Mail items in mail or calendar.

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery {kind:email OR kind:meetings} -TargetMailbox "Target mailbox" -TargetFolder "Target Folder"

Example 3

Look for all mail items that answer the following search criteria:

Mail items that have the subject Test + sent from john@o365info.com + sent on a specific date 30/07/2017.

Search-Mailbox "Source Mailbox" -SearchDumpsterOnly -SearchQuery {Subject:"Test" AND From:"john@o365info.com" AND Sent:"30/07/2017"} -TargetMailbox "Target mailbox" -TargetFolder "Target Folder"
o365info Team

o365info Team

This article was written by our team of experienced IT architects, consultants, and engineers.

This Post Has One Comment

Leave a Reply

Your email address will not be published. Required fields are marked *