To prevent your organization from email spoofing and phishing attacks, it's not enough to only…
How to Recover deleted items from Microsoft 365 mailbox
An excellent method to recover deleted items from mailboxes is in the Exchange admin center and with PowerShell. Deleted items can be notes, tasks, messages, or calendar items. You can find and restore the deleted items in the Deleted Items folder, Recover Deleted Items, and Purged Items. In this article, you will learn how to recover deleted items from a mailbox in Microsoft 365.
Table of contents
Soft vs. hard deleted items
There are three types of deleted items in a mailbox:
- Deleted Items: Deleted items in the Deleted Items folder
When the user deletes an item, such as a message, task, or calendar appointment, in Outlook or OWA, it goes to the Deleted Items folder. The soft-deleted item will stay in the folder as long as the user wants.
- Recover Deleted Items: Soft deleted items in Recover Deleted Items that are deleted from the Deleted Items folder
The user can move the deleted item from the Deleted Items folder to the Recovered Deleted Items, where it will stay for a maximum of 30 days, depending on your settings.
- Purged Items: Permanently hard deleted items that are purged from Recover Deleted Items
From the Recover Deleted Items, the user can choose to restore or purge (hard delete) selected items. It’s important to understand that purged items are permanently deleted and can only be seen and restored by an admin.
The table below shows the three different types of deleted items to restore.
Deleted Items folder | Recover Deleted Items | Purged Items |
---|---|---|
Soft-deleted items | Soft-deleted items | Hard-deleted items |
User and admin can view and restore these items | User and admin can view and restore these items | Only admin can view and restore these items |
Required permissions
Before you start, you must assign the required permissions to recover deleted items in the Exchange admin center.
Without the permissions, you can’t use the feature in the Exchange admin center and you will get the below error if you run the commands in Exchange Online PowerShell.
Get-RecoverableItems: The term ‘Get-RecoverableItems’ is not recognized as a name of a cmdlet, function, script file, or executable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
We recommend following the steps in How to fix recover deleted items greyed out in Exchange Online.
- You need to assign the admin as a member of the Discovery Management role group
- Add the Mailbox Import Export role to the Discovery Management role group
Note: Wait at least one hour for the permissions to take effect.
Recover deleted items in Exchange admin center
After you assign the required permission you can recover deleted items for a Microsoft 365 mailbox.
Note: The items in the Deleted Items folder can stay there for as long as you want. But when you delete an item from the Deleted Items folder, it will move to the Recover Deleted Items. These deleted items will stay in the recycle bin for 14 days by default, and you can set the Exchange Online deleted items retention period up to a maximum of 30 days.
Recover deleted items
To recover deleted items in EAC, follow these steps:
- Sign in to Exchange admin center
- Click Recipients > Mailboxes
- Click on a mailbox from the list
- Click the tab Others
- Click Recover deleted items
The list shows all the deleted items and the folder type where to find them, such as Deleted Items, Recoverable Items\Deletions, and Recoverable Items\Purges. It also shows the original folder where each mail item was placed, such as Inbox, Sent Items, or Calendar.
- Select the items you want to recover
- Click Recover deleted items
- It successfully recovers each item to the original folder
Verify recover deleted items
To verify you recovered the deleted items to the original folder in Outlook, follow these steps:
- Sign in to Outlook
- Click the folder
- Verify the mail item is back to the original folder (Junk Email)
- Verify the other mail item is back to the original folder (Sent Items)
- Verify the last mail item is back to the original folder (Inbox)
- Verify the items don’t appear in the Deleted Items folder or Recover Deleted Items
Recover deleted items with PowerShell
To recover deleted items with PowerShell, go through the below steps.
Note: The items in the Deleted Items folder can stay there for as long as you want. But when you delete an item from the Deleted Items folder, it will move to the Recover Deleted Items. These deleted items will stay in the recycle bin for 14 days by default, and you can set the Exchange Online deleted items retention period up to a maximum of 30 days.
Connect to Exchange Online PowerShell
To run the PowerShell commands specified in the current article, you must Connect to Exchange Online PowerShell.
Connect-ExchangeOnline
Get recoverable items with PowerShell
To find deleted items in mailboxes, we will use the Get-RecoverableItems PowerShell cmdlet. This cmdlet will get all the items in the Deleted Items folder, Recover Deleted Items, and Purged Items.
Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com"
Display deleted items by SourceFolder
Run the PowerShell command to get a list of all the deleted items of a single mailbox.
Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com" | Select-Object Subject, ItemClass, SourceFolder, LastParentPath
The PowerShell output shows the below result.
Subject ItemClass SourceFolder LastParentPath
------- --------- ------------ --------------
Re: Healthcare Professional Email list IPM.Note Recoverable Items\Deletions Junk Email
Canceled: Meeting customer IPM.Schedule.Meeting.Canceled Recoverable Items\Deletions Inbox
Canceled: Meeting with customer IPM.Schedule.Meeting.Canceled Recoverable Items\Deletions Inbox
FW: Weekly meeting Sales IPM.Note Recoverable Items\Deletions Inbox
Re: Follow Up IPM.Note Recoverable Items\Deletions Junk Email
IPM.Note Recoverable Items\Deletions Junk Email
FW: Meeting IPM.Note Recoverable Items\Deletions Inbox
Meeting IPM.Note Recoverable Items\Deletions Inbox
RE: REMINDER IPM.Note Recoverable Items\Deletions Junk Email
spam IPM.Note Deleted Items Inbox
Your digest email IPM.Note Deleted Items Inbox
FW: Subject1 IPM.Note Deleted Items Inbox
Canceled: Meeting IPM.Schedule.Meeting.Canceled Recoverable Items\Purges Inbox
FW: Meeting IPM.Note Recoverable Items\Purges Inbox
FW: Meeting with customer IPM.Note Recoverable Items\Purges Inbox
You can choose to display deleted items in the mailbox using the -SourceFolder parameter.
Run the below PowerShell command to display deleted items in the Deleted Items folder.
Get-RecoverableItems "Stephen.Hunter@m365info.com" -SourceFolder DeletedItems
Run the below PowerShell command to display soft deleted items in the Recoverable Items\Deletions folder.
Get-RecoverableItems "Stephen.Hunter@m365info.com" -SourceFolder RecoverableItems
Run the below PowerShell command to display hard deleted items in the Recoverable Items\Purges folder.
Get-RecoverableItems "Stephen.Hunter@m365info.com" -SourceFolder PurgedItems
Display deleted items by FilterItemType
To view deleted items of a single mailbox will show all the mail item types (ItemClass). The below table shows all the deleted item types.
FilterItemType | Item Class Description |
---|---|
IPM.Appointment | Calender item (Meetings and appointments) |
IPM.Contact | Contact |
IPM.File | File |
IPM.Note | Email message |
IPM.Task | Task item |
To search for a specific type of deleted mail items, use the -FilterItemType parameter. Run the below PowerShell command to display only the deleted calendar items.
Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com" -FilterItemType IPM.Appointment
To display the number of deleted mail items of a single mailbox, use the below PowerShell command.
(Get-RecoverableItems "Stephen.Hunter@m365info.com").count
The PowerShell output will show the count of the number of deleted items.
Display deleted items by Date
To display the deleted mail items for a specific day, use the -FilterStartTime and -FilterEndTime parameters. Use the short date format mm/dd/yyyy to specify a date.
Run the below PowerShell command example to display the deleted items for a single mailbox on a specific date.
Get-RecoverableItems "Stephen.Hunter@m365info.com" -FilterStartTime "4/15/2024" -FilterEndTime "4/16/2024"
Display deleted items by Subject
Run the below PowerShell command with the -SubjectContains parameter to display a deleted item with a specific text string in their subject.
Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com" -SubjectContains "Healthcare"
The PowerShell output shows the below result.
LastParentPath : Junk Email
LastParentFolderID : DC498BC89A10B34E8A7B9BC03E1040F8000000000114
OriginalFolderExists : True
Identity : Stephen.Hunter@m365info.com
MailboxIdentity : a2ff010e-0e03-4c56-8863-2ae7f07876dd\e7a17671-2398-474a-bca5-5330e8602e89
ItemClass : IPM.Note
Subject : Re: Healthcare Professional Email list
PolicyTag : 3dbb5f39-dc76-4916-9db3-fa9191760a55
EntryID : 000000005A01B97AEDFF8D44BCBCAFF9CB9F8EA50700DC498BC89A10B34E8A7B9BC03E1040F800001AE485C00000
DC498BC89A10B34E8A7B9BC03E1040F800007D4A02AB0000
SourceFolder : Recoverable Items\Deletions
LastModifiedTime : 04/04/2024 23:22:18
IsValid : True
ObjectState : New
Export deleted items of single mailbox
If you need to show the user which deleted items they want to restore, it’s best to export all the deleted items of single mailbox.
You need to create a temp folder in the (C:) drive, if you haven’t done it already.
To export all the deleted items of a single mailbox, use the following PowerShell command.
Get-RecoverableItems "Stephen.Hunter@m365info.com" | Export-Csv "C:\temp\DeletedItems.csv"
Restore deleted items with PowerShell
To restore deleted items of a single mailbox, we will use the Restore-RecoverableItems Powershell cmdlet.
Restore specific deleted items for a single mailbox
Run the below PowerShell command to restore a specific deleted item of a single mailbox using the -EntryID parameter.
Restore-RecoverableItems "Stephen.Hunter@m365info.com" -EntryID "000000006BA04B4D9119D447A37F56736C9593C307008A9E28902796144FA963DDD937E7B38500000000015600008A9E28902796144FA963DDD937E7B3850000000183260000"
The PowerShell output shows that it restored the item to the Calender folder because the original folder no longer exists.
RestoredToFolderPath : Calendar
RestoreToFolderId : LgAAAABroEtNkRnUR6N/VnNslZPDAQCKniiQJ5YUT6lj3dk357OFAAAAAAENAAAC
WasRestoredToOriginalFolder : False
WasRestoredSuccessfully : True
Identity : Stephen.Hunter@m365info.com
MailboxIdentity : a2ff010e-0e03-4c56-8863-2ae7f07876dd\e7a17671-2398-474a-bca5-5330e8602e89
ItemClass : IPM.Appointment
Subject : Juneteenth (Observed)
PolicyTag :
EntryID : 000000006BA04B4D9119D447A37F56736C9593C307008A9E28902796144FA963DDD937E7B38500000000015600008A9E28902796144FA963DDD937E7B3850000000183260000
SourceFolder : Deleted Items\United States holidays
LastModifiedTime : 08/17/2023 13:55:50
IsValid : True
ObjectState : New
Run the below PowerShell command to restore specific deleted items of a single mailbox by subject.
Restore-RecoverableItems -Identity "Stephen.Hunter@m365info.com" -SubjectContains "Healthcare"
The PowerShell output shows it restored the item to the Junk Email folder, where it was originally located.
RestoredToFolderPath : Junk Email
RestoreToFolderId : LgAAAABaAbl67f+NRLy8r/nLn46lAQDcSYvImhCzTop7m8A+EED4AAAAAAEUAAAB
WasRestoredToOriginalFolder : True
WasRestoredSuccessfully : True
Identity : Stephen.Hunter@m365info.com
MailboxIdentity : a2ff010e-0e03-4c56-8863-2ae7f07876dd\e7a17671-2398-474a-bca5-5330e8602e89
ItemClass : IPM.Note
Subject : Re: Healthcare Professional Email list
PolicyTag : 3dbb5f39-dc76-4916-9db3-fa9191760a55
EntryID : 000000005A01B97AEDFF8D44BCBCAFF9CB9F8EA50700DC498BC89A10B34E8A7B9BC03E1040F800001AE485C00000DC498BC89A10B34E8A7B9BC03E1040F800007D4A02AB0000
Restore all deleted items for a single mailbox
First, you can measure the estimated time that is needed to restore all the deleted items of single mailbox
Measure-command {Restore-RecoverableItems "Stephen.Hunter@m365info.com"}
The PowerShell output shows the below result.
Days : 0
Hours : 0
Minutes : 0
Seconds : 8
Milliseconds : 506
Ticks : 85069215
TotalDays : 9,84597395833333E-05
TotalHours : 0,00236303375
TotalMinutes : 0,141782025
TotalSeconds : 8,5069215
TotalMilliseconds : 8506,9215
To restore all the items in the Deleted Items folder, Recover Deleted Items and Purged items, use the below PowerShell command.
Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com" | Restore-RecoverableItems
Restore deleted items with LastParentFolderID
In our example, we will restore all the deleted items that were located in a specific folder (Inbox).
First, you need to find the value of the -LastParentFolderID parameter with the Get-RecoverableItems cmdlet, which we showed in the previous steps.
Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com"
The PowerShell output shows a list of all the deleted items.
LastParentPath : Inbox
LastParentFolderID : DC498BC89A10B34E8A7B9BC03E1040F800000000010C
OriginalFolderExists : True
Identity : Stephen.Hunter@m365info.com
MailboxIdentity : a2ff010e-0e03-4c56-8863-2ae7f07876dd\e7a17671-2398-474a-bca5-5330e8602e89
ItemClass : IPM.Note
Subject : test
PolicyTag :
EntryID : 000000005A01B97AEDFF8D44BCBCAFF9CB9F8EA50700DC498BC89A10B34E8A7B9BC03E1040F800000000010A0000
DC498BC89A10B34E8A7B9BC03E1040F8000068B682910000
SourceFolder : Deleted Items
LastModifiedTime : 04/15/2024 22:34:50
IsValid : True
ObjectState : New
Once we have the value of the -LastParentFolderID, we can restore all the deleted items to the original folder.
Note: If the original folder no longer exists, the LastParentFolderID value is empty, and the OriginalFolderExists value is False. This means that you can’t restore the deleted items with the -LastParentFolderID parameter.
Run the below PowerShell command.
Restore-RecoverableItems "Stephen.Hunter@m365info.com" -LastParentFolderID "DC498BC89A10B34E8A7B9BC03E1040F800000000010C"
Restore all hard deleted items for a single mailbox
To restore all the purged items of a single mailbox, you can use the below PowerShell command.
Get-RecoverableItems "Stephen.Hunter@m365info.com" -SourceFolder PurgedItems | Restore-RecoverableItems "Stephen.Hunter@m365info.com"
That’s it!
Read more: How to Restore a deleted Microsoft 365 mailbox »
Conclusion
You learned how to recover deleted items from Microsoft 365 mailbox. First, you need to assign the required permissions to search and recover deleted items for mailboxes. Then you can choose to restore the deleted items in Exchange admin center or with PowerShell.
Did you enjoy this article? You may also like Manage mailbox folder permission with PowerShell. Don’t forget to follow us and share this article.
This Post Has 0 Comments