Restore lost emails using new PowerShell command Restore-RecoverableItemsMicrosoft has introduced two new CMD in Exchange Online, which admins can utilize and restore the emails from Deleted Items and Recoverable Items Folders.
For demonstration purpose, I have created a folder name “TestFolder” in my mailbox and have placed some test email message.
Now Let’s (Shift + Del) Permanently them, permanently deleted emails skip the Deleted Items Folder and directly goes to Recoverable Items.
Search using the Subject keywordsWe can use the below CMD to search the emails with the subject containing the “test”
Get-RecoverableItems -Identity USerID -SubjectContains "Test"
This will bring us the list of all the emails contains “test” in the subject line, we can also use the complete subject of the deleted emails to find the specific email.
Example: CMD can be run without using the parameter (-SourceFolder RecoverableItems) to include search from the Deleted Items Folder, I am using the parameter to restrict the search within Recoverable Items Folders only.
Get-RecoverableItems userid -SourceFolder RecoverableItems -SubjectContains "Test Email 1"
RunspaceId : 054cf13e-2854-4a87-8bc9-421e7d5cfbfd Identity : FsNmDYNFjMRMsjyKUX78tvYAAcPBXLhGAAAAABTTPIv2KjBOhSke7IKz6G8HAMNmDYNFjMRMsjyKUX78tvYAAAAAARQA MailboxIdentity : userid ItemClass : IPM.Note Subject : Test Email 1 EntryID : 0000000014D33C8BF62A304E85291EEC82B3E86F0700C3660D83458CC44CB23C8A517EFCB6F60000000001140000 SourceFolder : Recoverable Items\Deletions LastParentFolderID : C3660D83458CC44CB23C8A517EFCB6F60001C30A1A92 LastModifiedTime : 02/28/2018 19:23:58 LastParentPath : TestFolder OriginalFolderExists : True IsValid : True
As we can see that the “OriginalFolderExists” is true this means the folder from where the emails were deleted is still exist and hence the email can be restored back to the original folder.
Search Deleted emails using Source Folder:If the user is not aware of the subject like keywords, admins to do the dump of all the emails available in the Deleted and Recoverable items folder, and can share the same with the end user, where the user can identify the emails and then those items can be restored.
Get-RecoverableItems -Identity USERID -SourceFolder RecoverableItems
Or for Deleted Items use.
Get-RecoverableItems -Identity USERID -SourceFolder DeletedItems
OR just run with any parameter to do the search in both the folders.
Get-RecoverableItems -Identity USERID
Search Deleted emails using Last Parent Path:We can also find the items based on the “Last Parent Path”, it’s the folder from where the emails were permanently deleted.
To do the same first find the one of email from the folder and then get its “LastParentFolderID”, same as shown below.
SourceFolder : Recoverable Items\Deletions LastParentFolderID : C3660D83458CC44CB23C8A517EFCB6F60001C30A1A92 LastModifiedTime : 02/28/2018 19:23:58 LastParentPath : TestFolder
Now that we have the “LastParenFolderID” run the command like below to get all the items that were deleted from the “TestFolder”.Get-RecoverableItems -Identity USERID LastParentFolderID C3660D83458CC44CB23C8A517EFCB6F600000000010F
Restore Deleted emails:
Now that we have Identified the emails which we need to restore, so let’s restore the emails.
There are multiple ways to restore the emails, lets first use the subject keyword method.
Restore Based on Subject-Keyword:
Restore-RecoverableItems -Identity userid -SubjectContains "test" -SourceFolder RecoverableItems
Restore the emails using the Last Parent FolderID:To restore the emails using the last parent folder id we need to first fetch it using the steps showing in the picture below.
Now that we have the “LastParentFolderID” we can run the below CMD to restore all the message which were deleted from the folder Named “TestFolder”
Restore-RecoverableItems USERID -LastParentFolderID 49E10BC037762B48BD1CB1EA9415EACD0000C2C76B69
This completes my post on restoring emails using PowerShell, I hope you will find it informative.