Restore deleted mail items to their original folder using PowerShell – introduction | 1#3

The current article series is dedicated to the subject of – Viewing + Restoring deleted mail items from an Exchange Online mailbox, to their original folder, using two new PowerShell cmdlets Get-RecoverableItems and Restore-RecoverableItems.

Restore deleted mail items to their original folder using PowerShell | The article series

The article series includes the following articles:

1. Restore deleted mail items to their original folder using PowerShell – introduction | 1#3 (this article)
2. Display information about Deleted mail items using the PowerShell cmdlet Get-RecoverableItems | 2#3
3. Restoring Deleted mail items using the PowerShell cmdlet Restore-RecoverableItems | 3#3

The magic of using Get-RecoverableItems and Restore-RecoverableItems cmdlets

Exchange mail clients, such as Outlook and OWA, include a built-in option that enables the user (mailbox owner) to recover by himself “standard deleted mail items” (mail items stored in the “Deleted mail” folder), and Soft Deleted items” (mail items stored in the “Deletion” folder).

So, the obvious question could be – what is the advantage of using the set of the PowerShell cmdlets Get-RecoverableItems and Restore-RecoverableItems?

The answer is using this set of PowerShell cmdlets, have three major advantages:

1. Manage the event of – viewing and restore deleted mail items | Server side

The interesting thing is that until now, Exchange didn’t provide a dedicated method for the Exchange Administrator to view and restore deleted mail items. I use the term “dedicated” because Exchange online includes an option to search and export the content of a mailbox to a PST file, but this “ability” is not dedicated to deleted mail items.

You can read more information about the procedure in the article Using Office 365 content search for exporting deleted mail items to a PST file – prefix | 1#3.

2. Manage the event of – viewing and restore deleted mail items | Remotely

The set of the PowerShell cmdlets Get-RecoverableItems and Restore-RecoverableItems, enable Exchange Administrator to manage the task of restoring deleted mail items remotely without user intervention.

In the past, the available methods of Exchange Administrator to manage an event of restore deleted mail items was to physically reach the user’s desktop or assign to himself the Full Access permissions on the user mailbox.

Using the PowerShell cmdlet Get-RecoverableItems, provide us the ability to remotely view and display detailed information about the deleted mail items of a specific Exchange mailbox, and based upon this information, decide how and what mail items to recover.

3. Restore deleted mail items to their original folder

Regarding the PowerShell cmdlet Restore-RecoverableItems, the outstanding and interesting advantage of this cmdlet is, the ability to restore the deleted mail items to their original mail folder.

Until the present time, before the PowerShell cmdlet Restore-RecoverableItems appear, we didn’t have the option to restore deleted mail items to their original mail folder.

In many scenarios, although we and the user are happy that we were able to restore deleted mail items, what saddened the happiness was the fact that the user needs to implement a tedious and arduous process of locating the “original mail folder” that hosts the deleted mail items, and manually “scatter” the mail items that were recovered between this mail folder.

Exchange environment and the subject of “Deleted mail items”

If we ask to be honest, for most of us, the subject of “restoring deleted mail items” in the Exchange-based environment, could be considered as a complicated and confusing subject.

For example, to be able to manage well the process of – restoring deleted mail items in an Exchange environment, we need to be familiar with the architecture of Exchange mailbox (Single item recovery, Recovery mail items system folders and the Dumpster), the “life cycle” of deleted mail items, the various types of mail deletion classification such as – standard deletion, Soft deleted mail item and Hard deleted mail item.

In the current article, we provide a brief review of the basic terms and concepts that relate to the subject of – deleted mail item in Exchange environment.

In case that you want to read more detailed information about Exchange Online recovery mail items folder structure and concepts, you can read the articles Recover deleted mail items – Office 365 | 4#7 and Recover deleted mail items in the Exchange Online environment | Deleted mail flow | 3#7.

Although we cannot get into a detailed description of how Exchange infrastructure handles an event of deletion of mail items, it is necessary to mention some basic terms and concept that relate to “deleted mail items.

When a user deletes a mail item, the mail items are “sent” to the “Deleted items” mailbox folder. It is important to emphasize that although the mail items are stored in the “Deleted items” folder. It is important to empathize that technically; the mail items are not deleted.

For example, the apparently deleted mail items can stay forever in the “Deleted items” folder (number 1).

Soft Deleted mail items

In case that the user decides to empty the “Deleted items” folder or to delete a specific mail item stored in the “Deleted items” folder, the operation described as “Soft Deleted.”

When the user deletes a mail item that is stored in the “Deleted items” folder, the mail items are sent to a specially hidden mailbox store, that described as – “Recoverable item folder” (a parallel term is the “Dumpster” folder).

An important thing that I would like to mention is that even though we use the term “Recoverable item folder”, which allegedly refers to a singular folder, in reality, the “Recoverable item folder” is implemented as “array of system folders” that each of them has a unique function.

When the mail item is Soft deleted, the mail item is sent to the “Recoverable item folder space” to a folder named “Deletions” (number 2).

Deleted mail items policy

The important thing that we need to know is, that Exchange applies a special policy named – “Deleted mail items policy” on the “Recoverable item folder space.”

By default, the “Deleted mail items policy” define a time window of 14 days for the mail item that is stored in the “Recoverable item folder space.” After this period has elapsed, the mail item will permanently be deleted without being able to recover.

In Exchange Online based environment the default “14 days” policy can be extended to a maximum of 30 days. In case that you need a longer time period of defining a policy that will keep forever deleted mail items that are stored in the “Recoverable item folder space”, you can use the option of Litigation Hold or In-Place Hold that required an E3 or Exchange plan 2 licenses.

The “Deletions” folder doesn’t appear as a standard mailbox folder which the user can access, but, the user has the ability to view the content of the “Deletions” folder + delete or restore mail items from the “Deletions” folder by using the option of – “Recover Deleted items.”

Hard Deleted mail items

In case that for some reason the user decides to access the “Deletions” folder, and delete the mail items that stored in the “Deletions” folder the action defined as – Hard Delete.

In this case, the mail items will be moved from the “Deletions” folder to an additional special system folder named – “Purges” (number 3).

The user (mailbox owner) is not able to view the content of the “Purges” folder!

Only Exchange administrator has the ability to view or restore mail items stored in the “Purges” folder. In other words, only the Exchange Administrator can recover Hard deleted mail items.

We cannot use the set of the PowerShell cmdlets Get-RecoverableItems and Restore-RecoverableItems for recovering Hard Deleted mail items.

Restoring deleted mail items | The user himself vs. Restore implemented via PowerShell

The current article series is dedicated to the new PowerShell cmdlets Get-RecoverableItems and Restore-RecoverableItems, which we can use for restoring deleted mail items from Exchange mailbox.

But before we continue to the “technical part” in which we review the syntax of this PowerShell cmdlets, it is important that we answer a couple of questions.

Q1: Can a user (mailbox owner) has the ability to restore Deleted mail items?
A1: The answer is “Yes.”

Deleted mail items, sent to the mailbox Recycle bin (“Deleted items” folder). The user can easily view the content of the mailbox recycle bin (“Deleted items” folder) and “move” the mail items to any folder he chooses (notice that there is no option to recover the mail items to their original folder).

Regarding deleted mail items that considered as – Soft Deleted mail items, Outlook mail client, and OWA mail client includes a built-in interface that enables a user to perform a restore process of Soft Deleted mail items.

Q2: Is there a scenario where a user cannot perform a restoration of deleted mail by himself?
A2: The answer is “Yes.” In case that the Deleted mail items considered as – Hard Deleted mail items, the user (mailbox owner) cannot recover these mail items by himself. Only Exchange administrator with will be able to perform the procedure of restoring – Hard Deleted mail items meaning, mail items that are stored in the “Recoverable item folder space” in the “Purges” folder.

You can read more detailed information about how to perform Hard Deleted mail items recovery in the following articles:

• Using Office 365 content search for exporting deleted mail items to a PST file – prefix | 1#3
• Recover mail items from Recovery mail folder (the Dumpster) using PowerShell | Part 3#5

Q3: Given that a user can restore deleted mail items by himself, what are the advantage of using the PowerShell cmdlets Get-RecoverableItems and Restore-RecoverableItems?

A3:

Case 1 – Restoring Hard Deleted mail items

Using the set of the PowerShell cmdlets Get-RecoverableItems and Restore-RecoverableItems don’t include the option of performing the procedure of restoring – Hard Deleted mail items. Referring to the above point the PowerShell cmdlets Get-RecoverableItems and Restore-RecoverableItems don’t have any advantage vs. the ability of the user (mailbox owner) to recover deleted mail items.

Case 2 – Restoring Deleted mail items + Soft Deleted mail items

The main advantage of using the PowerShell cmdlets Get-RecoverableItems and Restore-RecoverableItems is that these cmdlets know how to use a special property of a mail item, that includes information about the mail folder that stores the mail item before the mail items were deleted.

Using the information stored in this property (named –LastParentFolderID), we have the ability to help users not only to recover Deleted mail items but, also restore the deleted mail items to the original location.

Recap and takeaways

The type of deleting mail items scenario

Regarding the term “deletion of mail items”, in the Exchange-based environment, there are 3 types of mail deletion scenarios:

1. Standard mail item deletion
2. Soft deleted mail item
3. Hard deleted mail item

The procedure of restoring deleted mail items by the user himself or by using the PowerShell cmdlets (Get-RecoverableItems and Restore-RecoverableItems), is relevant only to the following types of mail depletion scenarios:

1. Standard mail deletion – a scenario in which the user delete a mail item, and the mail item is sent to the mailbox recycle bin meaning – the “Deleted items” folder.
2. Soft deleted mail – a scenario in which the user deletes mail items that stored in the Deleted items folder (and the mail items sent to the “Deletions” folder).
3. Hard deleted mail item

The set of PowerShell cmdlets (Get-RecoverableItems cmdlet and the Restore-RecoverableItems cmdlet) cannot be used in a scenario of Hard Deleted mail items and cannot be used to view and recover mail items that are stored in the “Purges” folder.

Restore deleted mail items and Soft Deleted mail to their original mail folder

To be able to understand better what is the big advantage of using the Restore-RecoverableItems cmdlet that “know” how to restore deleted mail items to their original folder,” let’s briefly review the process of restoring a mail item by the user himself using the Outlook or OWA graphic interface.

Scenario 1 – Restore “standard” deleted mail

In the following diagram, we can see an example of such a scenario. When the user accesses his mailbox recycle bin (“Deleted items” folder), he can see all the mail items that stored in the recycle bin but notice an important fact – the user doesn’t have any “recover” menu option.

The meaning is that the “recovery process” is implemented by dragging the mail items from the recycle bin store the “destination mail folder.” The basic assumption is that the user knows what the “original mail folder” that stores the mail items before they were deleted, but the reality is a little more complicated.

In many scenarios, the user doesn’t remember the what was the original folder, and he will need to guess what was the original folder or just drop the mail items in any folder that he randomly chooses.

Another version of the “deleted mail item” scenario, is a scenario in which the deleted mail items consider as Soft Deleted mail items (mail items stored in the “Deletions” folder in the “Recoverable item folder space”).

In this case, when the user views the content to the “recovery mail items” folder, he has a menu option that enables him to restore the mail items.

But the important thing that we should Know is that the “restore procedure” is not implemented by restoring the Soft Deleted a mail item to his original mail folder but instead, to the “last folder” that host the mail item before he was deleted.

In this scenario, the “last folder” is the – “Deleted items” folder (mailbox recycle bin).

Although the user has the ability to restore the Soft Deleted mail item, the user is facing the same problem of – how to locate to restore the mail item to the “real folder” that host the mail item.

In the following diagram, we can see an example of such a scenario.

Mail item that was stored in a folder named – “Customers 2018” was deleted and moved to the mailbox recycle bin (the “Deleted items” folder).

If the user decides to empty the recycle bin, the mail items considered as – Soft Deleted mail items (moved to the “Deletions” folder in the “Recoverable item folder space”).

When the user decides to recover the Soft Deleted a mail item, the restore process “move” the mail item back to the last folder which hosts the file, the “Deleted items” folder (mailbox recycle bin).

How does the Restore-RecoverableItems cmdlet know “how to restore deleted mail items to their original folder”?

The “magic” of restoring the Soft Deleted mail items to their original folder is implemented by using two properties of the Soft Deleted a mail item:

• LastParentFolderID – this property includes the GUID value of the “original folder” that hosts the mail items before they were deleted.
• OriginalFolderExists – this property uses the values of True or False for defining the status of the original folder. For example, if the original folder that hosts the mail items before they were deleted still exists, the value is True.

When we perform deleted mail restore procedure using the Restore-RecoverableItems cmdlet, the Restore-RecoverableItems cmdlet knows how to read the information stored in the LastParentFolderID mail item property, and based upon this information, how to restore the deleted mail items to the folder that hosts the mail items before he was deleted.

It is important to mention that these special properties exist only in Exchange mailboxes that hosted by Exchange 2016 server and above. In Office 365 based environment, the basic assumption is that the Exchange Online infrastructure is implemented by using Exchange 2016 server infrastructure.

The Get-RecoverableItems and Restore-RecoverableItems couple

Restoring deleted mail items via PowerShell is implemented by using a set of two PowerShell cmdlets:

Get-RecoverableItems cmdlet

This is the PowerShell cmdlet that we use for viewing (displaying) information about the deleted mail items of a specific user (specific Exchange Online mailbox). It is important to mention that the Get-RecoverableItems cmdlet will be able to display deleted mail items that store in the mailbox recycle bin (Deleted items folder) and in the “Purges” folder that store Soft Deleted mail items.

For example:

View the content of the user mailbox recycle bin (Deleted items folder):

Get-RecoverableItems <Mailbox Name> -SourceFolder DeletedItems

View the content of a user mailbox – “Deletions“ folder (Soft Deleted mail items):

Get-RecoverableItems <Mailbox Name> -SourceFolder Recoverableitems

Restore-RecoverableItems cmdlet

This is the “other half” of the two-cmdlets set that is used to recover (restore) the deleted mail items.

The most basic use of the Restore-RecoverableItems can be implemented by using the following syntax:

Restore-RecoverableItems <Mailbox Name>

In this scenario, the Restore-RecoverableItems cmdlet will access the user mailbox and start an automatic recovery process of the following type of deleted mail items:

1. All the mail items stored in the mailbox recycle bin meaning, the “Deleted items” folder.
2. All the mail items that defined as – Soft deleted mail item meaning, the mail items that are stored in the “Deletions” folder in the “Recoverable item folder space”).

Permissions to use the Get-RecoverableItems and Restore-RecoverableItems cmdlets

To be able to use the Get-RecoverableItems and Restore-RecoverableItems cmdlets, the user needs to have the rule Mailbox Import Export role.

What are the non-supported scenarios (what recovery scenario cannot be implemented)?

Up until now, what review the deleted mail recovery scenarios that can be implemented by using the PowerShell cmdlets Get-RecoverableItems and Restore-RecoverableItems.

At the same time, it is important that we know about the limitation of this PowerShell cmdlets or in other words, what are the recovery mail scenarios, which are not supported when using the above PowerShell cmdlets.

• At the current time, the Get-RecoverableItems and Restore-RecoverableItems cmdlets are only supported in the Office 365 cloud environment (Exchange Online).
• We cannot use the Get-RecoverableItems and Restore-RecoverableItems cmdlets for – view the content of the Purges folder or restore mail items stored in the Purges. In other words, at the current time, this set of PowerShell cmdlet cannot be used for recovering Hard deleted mail items.
• We cannot use the Restore-RecoverableItems cmdlet for restoring deleted mail items based on Retention tags.
• We cannot use the Restore-RecoverableItems cmdlet for restoring deleted mail items to a “destination folder” which we choose. The Restore-RecoverableItems cmdlet will automatically restore the deleted mail items to their original folder (the mailbox folder that hosts the deleted mail items before they were deleted). In case that the original folder doesn’t exist, the mail items will be restored to the “Root mailbox folder.”
• We cannot use Restore-RecoverableItems cmdlet for – restoring a deleted “mail folder” (this command can restore “mail items” but not a “Mail Folder” object).
• We cannot use the Get-RecoverableItems and Restore-RecoverableItems cmdlets for restoring deleted mail items stored in an Archive mailbox.
• In case that the original folder that host the deleted mail was deleted, we cannot solve this issue by creating a new folder with an identical name because the information about the “original folder” is saved using the original folder GUID identity