Applies to: Exchange Server 2010 SP2

Topic Last Modified: 2012-12-11

Single item recovery provides an additional layer of protection so that you can recover items that were accidentally deleted by a user or by automated processes such as the Managed Folder Assistant. Single item recovery simplifies recovery and reduces recovery time because you can recover items without recovering an entire mailbox or mailbox database from backup media. To learn more, see “Single item recovery” in Recoverable Items Folder.

Note:
In addition to using this procedure to search for and recover deleted items (which are moved to the Recoverable Items\Purges folder if either single item recovery or litigation hold is enabled), you can also use this procedure to search for items residing in other folders in the mailbox and to delete items from the source mailbox (also known as search and destroy).

This topic shows you how to use the Search-Mailbox cmdlet in the Shell to search for and recover missing items. If the mailbox has a standard CAL, this is the only method you can use. If you use this cmdlet, you can search only one mailbox at a time. If you want to search multiple mailboxes simultaneously, you can use the In-Place eDiscovery feature in the Exchange Administration Center (EAC) or the New-MailboxSearch cmdlet in the Shell.

What you need to know before you begin?

  • Estimated time to complete: 15-30 minutes.

  • Procedures in this topic require specific permissions. See each procedure for its permissions information.

  • Single item recovery must be enabled for a mailbox before the item you want to recover is deleted.

  • To search for and recover items, you must have the following information:

    • Source mailbox   This is the mailbox being searched.

    • Target mailbox   This is the discovery mailbox in which messages will be recovered. Exchange Setup creates a default discovery mailbox. If required, you can create additional discovery mailboxes. For details, see Create a Discovery Mailbox.

      Note:
      When using the Search-Mailbox cmdlet, you can also specify a target mailbox that isn't a discovery mailbox. However, you can't specify the same mailbox as the source and target mailbox.
    • Search criteria   Criteria include sender or recipient, or keywords (words or phrases) in the message.

  • For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard Shortcuts in the Exchange Admin Center.

Tip:
Having problems? Ask for help in the Exchange forums. Visit the forums at: Exchange Server, Exchange Online, or Exchange Online Protection

Step 1: Search for and recover missing items

You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "In-Place eDiscovery" entry in the Messaging Policy and Compliance Permissions topic.

Note:
You can use In-Place eDiscovery in the EAC to search for missing items. However, when using the EAC, you can’t restrict the search to the Recoverable Items folder. Messages matching your search parameters will be returned even if they’re not deleted. After they’re recovered to the specified discovery mailbox, you may need to review the search results and remove unnecessary messages before recovering the remaining messages to the user’s mailbox or exporting them to a .pst file.

The first step in the recovery process is to search for messages in the source mailbox. Use one of the following methods to search a user mailbox and copy messages to a discovery mailbox.

Use the Shell

This example searches for messages in April Stewart's mailbox that meet the following criteria:

  • Sender: Ken Kwok

  • Keyword: Seattle

Copy Code 
Search-Mailbox "April Stewart" -SearchQuery "from:'Ken Kwok' AND seattle" -TargetMailbox "Discovery Search Mailbox" -TargetFolder "April Stewart Recovery" -LogLevel Full
Note:
When using the Search-Mailbox cmdlet, you can scope the search by using the SearchQuery parameter to specify a query formatted using Keyword Query Language (KQL). You can also use the SearchDumpsterOnly switch to search only items in the Recoverable Items folder.

For detailed syntax and parameter information, see Search-Mailbox.

Use the EAC to perform an In-Place eDiscovery search

For details about how to use the EAC to perform an In-Place eDiscovery search, see Create an In-Place eDiscovery Search.

How do you know this worked?

To verify that you have successfully searched the messages you want to recover, log on to the discovery mailbox you selected as the target mailbox and review the search results.

Step 2: Restore recovered items

You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "In-Place eDiscovery" entry in the Messaging Policy and Compliance Permissions topic.

Note:
You can't use the EAC to restore recovered items.

After messages have been recovered to a discovery mailbox, you can restore them to the user's mailbox by using the Search-Mailbox cmdlet. You can also use the New-MailboxExportRequest and New-MailboxImportRequest cmdlets to export the messages to or import the messages from a .pst file.

Use the Shell to restore messages

This example restores messages to April Stewart's mailbox and deletes them from the Discovery Search Mailbox.

Copy Code 
Search-Mailbox "Discovery Search Mailbox" -SearchQuery "from:'Ken Kwok' AND seattle" -TargetMailbox "April Stewart" -TargetFolder "Recovered Messages" -LogLevel Full -DeleteContent

For detailed syntax and parameter information, see Search-Mailbox.

How do you know this worked?

To verify that you have successfully recovered messages to the user’s mailbox, have the user review messages in the target folder you specified in the above command.

Use the Shell to export and import messages from a .pst file

You can export contents from a mailbox to a .pst file and import the contents of a .pst file to a mailbox. To learn more about mailbox import and export, see Mailbox Import and Export Requests.

This example uses the following settings to export messages from the folder April Stewart Recovery in the Discovery Search Mailbox to a .pst file:

  • Mailbox   Discovery Search Mailbox

  • Source folder   April Stewart Recovery

  • ContentFilter   April travel plans

  • PST file path   \\MYSERVER\HelpDeskPst\AprilStewartRecovery.pst

Copy Code 
New-MailboxExportRequest -Mailbox "Discovery Search Mailbox" -SourceRootFolder "April Stewart Recovery" -ContentFilter {Subject -eq "April travel plans"} -FilePath \\MYSERVER\HelpDeskPst\AprilStewartRecovery.pst

For detailed syntax and parameter information, see New-MailboxExportRequest.

This example uses the following settings to import messages from a .pst file to the folder Recovered By Helpdesk in April Stewart's mailbox:

  • Mailbox   April Stewart

  • Target folder   Recovered By Helpdesk

  • PST file path   \\MYSERVER\HelpDeskPst\AprilStewartRecovery.pst

Copy Code 
New-MailboxImportRequest -Mailbox "April Stewart" -TargetRootFolder "Recovered By Helpdesk" -FilePath \\MYSERVER\HelpDeskPst\AprilStewartRecovery.pst

For detailed syntax and parameter information, see New-MailboxImportRequest.

How do you know this worked?

To verify that you have successfully exported messages to a .pst file, use Outlook to open the .pst file and inspect its contents. To verify that you have successfully imported messages from the .pst file, have the user inspect the contents of the target folder you specified in the above command.