Display information about Deleted mail items using the PowerShell cmdlet Get-RecoverableItems | 2#3 5/5 (2) 5 min read

In the current article, we review how to display information about deleted mail items, by using the PowerShell cmdlet – Get-RecoverableItems.

Restore deleted mail items to their original folder using PowerShell| The article series

The article series includes the following articles:

The purpose of the PowerShell cmdlet – Get-RecoverableItems is to help us to display (view or even export) information about deleted mail stored in Exchange mailbox.

As mentioned in the former article, the uniqueness of the PowerShell cmdlet – Get-RecoverableItems is, the ability to view info about “standard Deleted mail and in additional, Soft deleted mail items.

Quick reminder and reference

In the next article, we review the use of the PowerShell cmdlet – Restore-RecoverableItems that help us to restore deleted mail items of a specific Exchange mailbox.

In the context of the PowerShell cmdlets Get-RecoverableItems, the term “deleted mail items” refers to two types of deleted mail items:

  1. Standard Deleted items – the term “standard deleted mail items” is not a formal technical term, but instead, I term which I use for relating to mail items that are stored in the mailbox folder – “Deleted items” (the mailbox recycle bin).
  2. Soft Deleted mail items – mail items that were deleted from the mailbox recycle bin and classified as “Soft Deleted mail items.” These mail items are stored in the “Deletion” folder, a special hidden system folder, that is part of the “Recoverable item folder” space and store Soft Deleted mail items.

Display Deleted mail items | Filter by – Folder scope

In case that we use the PowerShell cmdlet Get-RecoverableItems as it is, without any parameters, the Restore-RecoverableItems display information about all deleted mail items, that are stored in one of the following mailbox folders:

  1. Deleted items (recycle bin) folder.
  2. Deletion folder – the special hidden folder that is part of the “Recoverable item folder” space and store Soft Deleted mail items.

PowerShell command example

Using “Folder scope” for display information on specific types of deleted mail items

To be able to display information only about a specific type of deleted mail items,
we can use the parameter “SourceFolder.”

The structure of the PowerShell command is written as follows:

Display Deleted mail items | Deleted mail items stored in the mailbox recycle bin folder.

To view\display only mail items that are stored in the Deleted items (recycle bin) folder, we can use the following syntax:

Display Deleted mail items | Soft deleted mail items

To display information only about Soft Deleted mail items, we can use the following syntax:

Display Deleted mail items | Filter by – Date

To display Deleted mail items from a specific date range, we use the following 2 parameters:

  • FilterStartTime
  • FilterEndTime

PowerShell command syntax example:

Display Deleted mail items | Filter by – E-mail message subject

To display deleted mail items that have a specific text string in their subject, we can use the parameter – SubjectContains

PowerShell command syntax example:

Display Deleted mail items | Filter by – E-mail message type

Exchange mailbox serves as a container for various types of “mail items.”
For example, standard E-mail message, calendar meeting, task items and mail contact item.

When we ask to view deleted mail items, the PowerShell cmdlet
Get-RecoverableItems will display all the types of mail items that considered as “deleted mail items.”

In case that we need to define a search filter that looks for a specific type of deleted mail items, we can use the parameter “FilterItemType”.

The following table displays the 4 types of “mail item”:

E-mail message IPM.Note
Contact IPM.Contact
Calendar item IPM.Appointment
Task item IPM.Task

For example, in case that we want to display only deleted mail items that considered as “calendar mail items”, we can use the following syntax:

Display Deleted mail items | Filter by – Number of deleted mail items

By default, the PowerShell cmdlet Get-RecoverableItems display all the deleted mail items.
In case that we want to ask to display only a specific amount of deleted mail items, we can use the parameter – ResultSize

For example, we want to display only the last 5 mail items that classified as “Deleted mail items.”

Count the number of deleted mail items

In case that we want to count the number of deleted mail items, we can use the following PowerShell syntax:

Additional PowerShell command syntax that we can use for counting the mail items is:

Display Deleted mail items | Filter by – Last parent folder id

The term “Last parent folder identity” define the identity of the Exchange mailbox folder that hosts the mail items before the mail items were deleted.

The “Last parent folder identity” appears is a property named – LastParentFolderID

In case that we need to define a scenario in which we want to restore only specific deleted mail items which were located in a specific folder, we can use the parameter -LastParentFolderID

For example

Additional options for displaying output

Group by

In case that we want to display all the deleted mail items grouped by “mail type” such as – E-mail message mail items, calendar mail items and so on, we can use the following PowerShell syntax:

Export information

In case that you want to export information about all the deleted mail items of a specific Exchange mailbox, we can use the following PowerShell command syntax:

Now it’s Your Turn!
It is important for us to know your opinion on this article

Related Post

Please rate this

Eyal Doron on EmailEyal Doron on FacebookEyal Doron on GoogleEyal Doron on LinkedinEyal Doron on PinterestEyal Doron on RssEyal Doron on TwitterEyal Doron on WordpressEyal Doron on Youtube
Eyal Doron
Share your knowledge.
It’s a way to achieve immortality.
Dalai Lama

Leave a Reply

Your email address will not be published. Required fields are marked *