How to Recover deleted items from Microsoft 365 mailbox

An excellent method to recover deleted items from mailboxes is in the Exchange admin center and with PowerShell. Deleted items can be notes, tasks, messages, or calendar items. You can find and restore the deleted items in the Deleted Items folder, Recover Deleted Items, and Purged Items. In this article, you will learn how to recover deleted items from a mailbox in Microsoft 365.

Soft vs. hard deleted items

There are three types of deleted items in a mailbox:

• Deleted Items: Deleted items in the Deleted Items folder
  
  When the user deletes an item, such as a message, task, or calendar appointment, in Outlook or OWA, it goes to the Deleted Items folder. The soft-deleted item will stay in the folder as long as the user wants.

• Recover Deleted Items: Soft deleted items in Recover Deleted Items that are deleted from the Deleted Items folder
  
  The user can move the deleted item from the Deleted Items folder to the Recovered Deleted Items, where it will stay for a maximum of 30 days, depending on your settings.

• Purged Items: Permanently hard deleted items that are purged from Recover Deleted Items
  
  From the Recover Deleted Items, the user can choose to restore or purge (hard delete) selected items. It’s important to understand that purged items are permanently deleted and can only be seen and restored by an admin.

The table below shows the three different types of deleted items to restore.

Deleted Items folder	Recover Deleted Items	Purged Items
Soft-deleted items	Soft-deleted items	Hard-deleted items
User and admin can view and restore these items	User and admin can view and restore these items	Only admin can view and restore these items

Required permissions

Before you start, you must assign the required permissions to recover deleted items in the Exchange admin center.

Without the permissions, you can’t use the feature in the Exchange admin center and you will get the below error if you run the commands in Exchange Online PowerShell.

We recommend following the steps in How to fix recover deleted items greyed out in Exchange Online.

1. You need to assign the admin as a member of the Discovery Management role group
2. Add the Mailbox Import Export role to the Discovery Management role group

Recover deleted items in Exchange admin center

After you assign the required permission you can recover deleted items for a Microsoft 365 mailbox.

Recover deleted items

To recover deleted items in EAC, follow these steps:

1. Sign in to Exchange admin center
2. Click Recipients > Mailboxes
3. Click on a mailbox from the list
4. Click the tab Others
5. Click Recover deleted items

The list shows all the deleted items and the folder type where to find them, such as Deleted Items, Recoverable Items\Deletions, and Recoverable Items\Purges. It also shows the original folder where each mail item was placed, such as Inbox, Sent Items, or Calendar.

6. Select the items you want to recover
7. Click Recover deleted items

8. It successfully recovers each item to the original folder

Verify recover deleted items

To verify you recovered the deleted items to the original folder in Outlook, follow these steps:

1. Sign in to Outlook
2. Click the folder
3. Verify the mail item is back to the original folder (Junk Email)

4. Verify the other mail item is back to the original folder (Sent Items)

5. Verify the last mail item is back to the original folder (Inbox)

6. Verify the items don’t appear in the Deleted Items folder or Recover Deleted Items

Recover deleted items with PowerShell

To recover deleted items with PowerShell, go through the below steps.

Connect to Exchange Online PowerShell

To run the PowerShell commands specified in the current article, you must Connect to Exchange Online PowerShell.

Connect-ExchangeOnline

Get recoverable items with PowerShell

To find deleted items in mailboxes, we will use the Get-RecoverableItems PowerShell cmdlet. This cmdlet will get all the items in the Deleted Items folder, Recover Deleted Items, and Purged Items.

Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com"

Display deleted items by SourceFolder

Run the PowerShell command to get a list of all the deleted items of a single mailbox.

Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com" | Select-Object Subject, ItemClass, SourceFolder, LastParentPath 

The PowerShell output shows the below result.

Subject                                ItemClass                     SourceFolder                LastParentPath
-------                                ---------                     ------------                --------------
Re: Healthcare Professional Email list IPM.Note                      Recoverable Items\Deletions Junk Email
Canceled: Meeting customer             IPM.Schedule.Meeting.Canceled Recoverable Items\Deletions Inbox
Canceled: Meeting with customer        IPM.Schedule.Meeting.Canceled Recoverable Items\Deletions Inbox
FW: Weekly meeting Sales               IPM.Note                      Recoverable Items\Deletions Inbox
Re: Follow Up                          IPM.Note                      Recoverable Items\Deletions Junk Email
                                       IPM.Note                      Recoverable Items\Deletions Junk Email
FW: Meeting                            IPM.Note                      Recoverable Items\Deletions Inbox
Meeting                                IPM.Note                      Recoverable Items\Deletions Inbox
RE:  REMINDER                          IPM.Note                      Recoverable Items\Deletions Junk Email
spam                                   IPM.Note                      Deleted Items               Inbox
Your digest email                      IPM.Note                      Deleted Items               Inbox
FW: Subject1                           IPM.Note                      Deleted Items               Inbox
Canceled: Meeting                      IPM.Schedule.Meeting.Canceled Recoverable Items\Purges    Inbox
FW: Meeting                            IPM.Note                      Recoverable Items\Purges    Inbox
FW: Meeting with customer              IPM.Note                      Recoverable Items\Purges    Inbox

You can choose to display deleted items in the mailbox using the -SourceFolder parameter.

Run the below PowerShell command to display deleted items in the Deleted Items folder.

Get-RecoverableItems "Stephen.Hunter@m365info.com" -SourceFolder DeletedItems

Run the below PowerShell command to display soft deleted items in the Recoverable Items\Deletions folder.

Get-RecoverableItems "Stephen.Hunter@m365info.com" -SourceFolder RecoverableItems

Run the below PowerShell command to display hard deleted items in the Recoverable Items\Purges folder.

Get-RecoverableItems "Stephen.Hunter@m365info.com" -SourceFolder PurgedItems

Display deleted items by FilterItemType

To view deleted items of a single mailbox will show all the mail item types (ItemClass). The below table shows all the deleted item types.

FilterItemType	Item Class Description
IPM.Appointment	Calender item (Meetings and appointments)
IPM.Contact	Contact
IPM.File	File
IPM.Note	Email message
IPM.Task	Task item

To search for a specific type of deleted mail items, use the -FilterItemType parameter. Run the below PowerShell command to display only the deleted calendar items.

Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com" -FilterItemType IPM.Appointment

To display the number of deleted mail items of a single mailbox, use the below PowerShell command.

(Get-RecoverableItems "Stephen.Hunter@m365info.com").count

The PowerShell output will show the count of the number of deleted items.

Display deleted items by Date

To display the deleted mail items for a specific day, use the -FilterStartTime and -FilterEndTime parameters. Use the short date format mm/dd/yyyy to specify a date.

Run the below PowerShell command example to display the deleted items for a single mailbox on a specific date.

Get-RecoverableItems "Stephen.Hunter@m365info.com" -FilterStartTime "4/15/2024" -FilterEndTime "4/16/2024"

Display deleted items by Subject

Run the below PowerShell command with the -SubjectContains parameter to display a deleted item with a specific text string in their subject.

Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com" -SubjectContains "Healthcare"

The PowerShell output shows the below result.

LastParentPath       : Junk Email
LastParentFolderID   : DC498BC89A10B34E8A7B9BC03E1040F8000000000114
OriginalFolderExists : True
Identity             : Stephen.Hunter@m365info.com
MailboxIdentity      : a2ff010e-0e03-4c56-8863-2ae7f07876dd\e7a17671-2398-474a-bca5-5330e8602e89
ItemClass            : IPM.Note
Subject              : Re: Healthcare Professional Email list
PolicyTag            : 3dbb5f39-dc76-4916-9db3-fa9191760a55
EntryID              : 000000005A01B97AEDFF8D44BCBCAFF9CB9F8EA50700DC498BC89A10B34E8A7B9BC03E1040F800001AE485C00000
                       DC498BC89A10B34E8A7B9BC03E1040F800007D4A02AB0000
SourceFolder         : Recoverable Items\Deletions
LastModifiedTime     : 04/04/2024 23:22:18
IsValid              : True
ObjectState          : New

Export deleted items of single mailbox

If you need to show the user which deleted items they want to restore, it’s best to export all the deleted items of single mailbox.

You need to create a temp folder in the (C:) drive, if you haven’t done it already.

To export all the deleted items of a single mailbox, use the following PowerShell command.

Get-RecoverableItems "Stephen.Hunter@m365info.com" | Export-Csv "C:\temp\DeletedItems.csv"

Restore deleted items with PowerShell

To restore deleted items of a single mailbox, we will use the Restore-RecoverableItems Powershell cmdlet.

Restore specific deleted items for a single mailbox

Run the below PowerShell command to restore a specific deleted item of a single mailbox using the -EntryID parameter.

Restore-RecoverableItems "Stephen.Hunter@m365info.com" -EntryID "000000006BA04B4D9119D447A37F56736C9593C307008A9E28902796144FA963DDD937E7B38500000000015600008A9E28902796144FA963DDD937E7B3850000000183260000"

The PowerShell output shows that it restored the item to the Calender folder because the original folder no longer exists.

RestoredToFolderPath        : Calendar
RestoreToFolderId           : LgAAAABroEtNkRnUR6N/VnNslZPDAQCKniiQJ5YUT6lj3dk357OFAAAAAAENAAAC
WasRestoredToOriginalFolder : False
WasRestoredSuccessfully     : True
Identity                    : Stephen.Hunter@m365info.com
MailboxIdentity             : a2ff010e-0e03-4c56-8863-2ae7f07876dd\e7a17671-2398-474a-bca5-5330e8602e89
ItemClass                   : IPM.Appointment
Subject                     : Juneteenth (Observed)
PolicyTag                   : 
EntryID                     : 000000006BA04B4D9119D447A37F56736C9593C307008A9E28902796144FA963DDD937E7B38500000000015600008A9E28902796144FA963DDD937E7B3850000000183260000
SourceFolder                : Deleted Items\United States holidays
LastModifiedTime            : 08/17/2023 13:55:50
IsValid                     : True
ObjectState                 : New

Run the below PowerShell command to restore specific deleted items of a single mailbox by subject.

Restore-RecoverableItems -Identity "Stephen.Hunter@m365info.com" -SubjectContains "Healthcare"

The PowerShell output shows it restored the item to the Junk Email folder, where it was originally located.

RestoredToFolderPath        : Junk Email
RestoreToFolderId           : LgAAAABaAbl67f+NRLy8r/nLn46lAQDcSYvImhCzTop7m8A+EED4AAAAAAEUAAAB
WasRestoredToOriginalFolder : True
WasRestoredSuccessfully     : True
Identity                    : Stephen.Hunter@m365info.com
MailboxIdentity             : a2ff010e-0e03-4c56-8863-2ae7f07876dd\e7a17671-2398-474a-bca5-5330e8602e89
ItemClass                   : IPM.Note
Subject                     : Re: Healthcare Professional Email list
PolicyTag                   : 3dbb5f39-dc76-4916-9db3-fa9191760a55
EntryID                     : 000000005A01B97AEDFF8D44BCBCAFF9CB9F8EA50700DC498BC89A10B34E8A7B9BC03E1040F800001AE485C00000DC498BC89A10B34E8A7B9BC03E1040F800007D4A02AB0000

Restore all deleted items for a single mailbox

First, you can measure the estimated time that is needed to restore all the deleted items of single mailbox

Measure-command {Restore-RecoverableItems "Stephen.Hunter@m365info.com"}

The PowerShell output shows the below result.

Days              : 0
Hours             : 0
Minutes           : 0
Seconds           : 8
Milliseconds      : 506
Ticks             : 85069215
TotalDays         : 9,84597395833333E-05
TotalHours        : 0,00236303375
TotalMinutes      : 0,141782025
TotalSeconds      : 8,5069215
TotalMilliseconds : 8506,9215

To restore all the items in the Deleted Items folder, Recover Deleted Items and Purged items, use the below PowerShell command.

Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com" | Restore-RecoverableItems

Restore deleted items with LastParentFolderID

In our example, we will restore all the deleted items that were located in a specific folder (Inbox).

First, you need to find the value of the -LastParentFolderID parameter with the Get-RecoverableItems cmdlet, which we showed in the previous steps.

Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com"

The PowerShell output shows a list of all the deleted items.

LastParentPath       : Inbox
LastParentFolderID   : DC498BC89A10B34E8A7B9BC03E1040F800000000010C
OriginalFolderExists : True
Identity             : Stephen.Hunter@m365info.com
MailboxIdentity      : a2ff010e-0e03-4c56-8863-2ae7f07876dd\e7a17671-2398-474a-bca5-5330e8602e89
ItemClass            : IPM.Note
Subject              : test
PolicyTag            : 
EntryID              : 000000005A01B97AEDFF8D44BCBCAFF9CB9F8EA50700DC498BC89A10B34E8A7B9BC03E1040F800000000010A0000 
                       DC498BC89A10B34E8A7B9BC03E1040F8000068B682910000
SourceFolder         : Deleted Items
LastModifiedTime     : 04/15/2024 22:34:50
IsValid              : True
ObjectState          : New

Once we have the value of the -LastParentFolderID, we can restore all the deleted items to the original folder.

Run the below PowerShell command.

Restore-RecoverableItems "Stephen.Hunter@m365info.com" -LastParentFolderID "DC498BC89A10B34E8A7B9BC03E1040F800000000010C"

Restore all hard deleted items for a single mailbox

To restore all the purged items of a single mailbox, you can use the below PowerShell command.

Get-RecoverableItems "Stephen.Hunter@m365info.com" -SourceFolder PurgedItems | Restore-RecoverableItems "Stephen.Hunter@m365info.com"

That’s it!

Read more: How to Restore a deleted Microsoft 365 mailbox »

Conclusion

You learned how to recover deleted items from Microsoft 365 mailbox. First, you need to assign the required permissions to search and recover deleted items for mailboxes. Then you can choose to restore the deleted items in Exchange admin center or with PowerShell.

Did you enjoy this article? You may also like Manage mailbox folder permission with PowerShell. Don’t forget to follow us and share this article.