skip to Main Content

Restoring Deleted mail items using the PowerShell cmdlet Restore-RecoverableItems | 3#3

In the current article, we review the use of the PowerShell cmdlet Restore-RecoverableItems.

Restore deleted mail items to their original folder using PowerShell | The article series

The article series includes the following articles:

  1. Restore deleted mail items to their original folder using PowerShell – introduction | 1#3
  2. Display information about Deleted mail items using the PowerShell cmdlet Get-RecoverableItems |2#3
  3. Restoring Deleted mail items using the PowerShell cmdlet Restore-RecoverableItems |3#3 (this article)

The purpose of the PowerShell cmdlet Restore-RecoverableItems is to help us to restore deleted mail items in their original folder.

As mentioned in the previous article, the uniqueness of the PowerShell cmdlet Restore-RecoverableItems is the ability to restore Deleted mail items to their original folder (the folder that stored the mail items before they have been deleted).

A quick reminder and reference

In the previous article, we review the use of the PowerShell cmdlet Get-RecoverableItems helps us to display information about the delete mail items of a specific Exchange mailbox.

In the context of the PowerShell cmdlets Get-RecoverableItems and Restore-RecoverableItems, the term “deleted mail items” refers to two types of deleted mail items:

  1. Standard Deleted items – the term “standard deleted mail items” is not a formal technical term, but instead, I term which I use for relating to regulated mail items that are stored in the mailbox folder – “Deleted items” (the mailbox recycle bin).
  2. Soft Deleted mail items – mail items that were deleted from the mailbox recycle bin and classified as “Soft Deleted mail items.” These mail items are stored in the “Deletion” folder, a special hidden system folder, that is part of the “Recoverable item folderspace and store Soft Deleted mail items.

Restore Deleted mail items | Filter by – Folder scope

In case that we use the PowerShell cmdlet Restore-RecoverableItems as it is, without any folder scope parameters, the Restore-RecoverableItems cmdlet will automatically restore all the following types of deleted mail items:

  • Standard Deleted items
  • Soft Deleted mail items

In case that we use the PowerShell cmdlet Restore-RecoverableItems without any folder scope, the cmdlet will automatically restore the two type of deleted mail items.

PowerShell command example:

Restore-RecoverableItems "Jeff"

Using “Folder scope” for restoring the specific type of deleted mail items
To be able to perform a restore procedure that related only to specific types of “deleted mail,” we use the parameter “SourceFolder.”

The structure of the PowerShell command is written as follows:

Restore-RecoverableItems <mailbox> -SourceFolder <The mailbox folder>

Restore only standard Deleted mail items (Deleted items stored in the recycling bin)

To restore only “standard Deleted mail items,” meaning mail items that are stored in the “Deleted items” folder, we need to use the following PowerShell command syntax:

Restore-RecoverableItems "Jeff" -SourceFolder DeletedItems

Restore only Soft Deleted mail items.

To restore only “Soft Deleted mail items,” meaning mail items that are stored in the “Deletion” folder (sub-folder in the “Recoverable item folder” space), we need to use the following PowerShell command syntax:

Restore-RecoverableItems "Jeff" -SourceFolder RecoverableItems

Restore Deleted mail items | Filter by – Date

To restore deleted mail items from a specific date range, we use the following 2 PowerShell parameters:

  • FilterStartTime
  • FilterEndTime

PowerShell command syntax example:

Restore-RecoverableItems "Jeff" -FilterStartTime "9/1/2018 12:00:00 AM" -FilterEndTime "9/1/2018 12:00:00 AM"

Restore Deleted mail items | Filter by – E-mail message subject

To restore deleted mail items that have a specific text string in their subject, we can use the parameter -SubjectContains

PowerShell command syntax example:

Restore-RecoverableItems "Jeff" -SubjectContains "test"

Restore Deleted mail items | Filter by – E-mail message type

Exchange mailbox serves as a container for various types of “mail items”. For example, standard E-mail message, calendar meeting, task items, and mail contact item.

When we ask to restore deleted mail items, the PowerShell cmdlet Restore-RecoverableItems will automatically restore all the type of mail items, that’s considered as “deleted mail items.”

In case we need to define a search filter that looks for a specific type of deleted mail items, we can use the parameter “FilterItemType”.

The following table displays the 4 types of “mail item”:

E-mail messageIPM.Note
ContactIPM.Contact
Calendar itemIPM.Appointment
Task itemIPM.Task

For example, in case that we want to restore only deleted mail items that considered as “calendar mail items”, we can use the following syntax:

Restore-RecoverableItems "Jeff" -FilterItemType IPM.Appointment

Restore Deleted mail items | Filter by – Number of deleted mail items

By default, the PowerShell cmdlet Restore-RecoverableItems will restore all the deleted mail items.
In case we want to ask to restore only a specific amount of deleted mail items, we can use the parameter -ResultSize.

For example, we want to restore only the last 5 mail items that classified as “Deleted mail items.”

Restore-RecoverableItems "Jeff" -ResultSize 5

Restore Deleted mail items | Filter by – Last parent folder id

The term “Last parent folder identity,” define the identity of the Exchange mailbox folder that hosts the mail items before the mail items were deleted.

The “Last parent folder identity” appears as a property named -LastParentFolderID.

In case we need to define a scenario in which we want to restore only specific deleted mail items, which were located in a specific folder, we can use the parameter -LastParentFolderID.

For example:

Restore-RecoverableItems "Jeff" -LastParentFolderID 9B52034A478A6141B401DF3BF7851B460000000015E0

Restore mail items | Additional options

Measure the estimated time that is needed to restore mail items.

Measure-command {Restore-RecoverableItems jeff}
The o365info Team

The o365info Team

This article was written by our team of experienced IT architects, consultants, and engineers.

This Post Has One Comment

  1. I think your article is very helpful.

    I think the one thing that needs to be added (by PowerShell developers) is:
    The ability to use the attribute “Deleted On” to target what needs to be restored.

    My example is:
    The user deleted thousands of email. They then emptied the Deleted Items folder.
    The Dumpster has the attribute of the Time that the items were deleted.
    I need to recover only items that were from that purge of the Deleted Items

Leave a Reply

Your email address will not be published. Required fields are marked *