Introduction
There could be instances where a user might have deleted his or her email messages from the mailbox, or the email messages would have been automatically deleted and would want to recover the email messages later. In such scenarios, users may not be able to recover the messages. However, administrators can recover deleted messages in a user's mailbox in Exchange Online, if the message's retention period has not expired. Before trying to recover the deleted messages, there are certain prerequisites that you must know. Let's take a look at the prerequisites, and then how to recover the deleted messages from Exchange Online.
Prerequisites:
- In order to be able to recover deleted messages, single item recovery must have been enabled. In Exchange Online, it is enabled by default, while it is disabled by default in Exchange Server.
- You must know the following information in order to search and recover the deleted messages:
- The source mailbox from which the messages were deleted.
- The target mailbox where the messages will be recovered.
- Some search filters such as words or phrases in the messages, the sender, and the recipient.
How to recover deleted messages in a user's mailbox in Exchange Online?
There are two ways by which the administrator can recover the deleted messages, and they are as follows:
- Using the new Exchange Administrative Center (EAC)
- Using PowerShell
Recovering deleted messages using EAC
In order to perform this task, the administrator account must have the RBAC mailbox import/export role assigned to them. If they have this permission, they can perform the following steps:
- In the EAC console, navigate to Recipients -> Mailboxes.
- Select the mailbox from which you want to recover the deleted messages, and then click on its display name.
- In the More actions section, click Recover deleted items.
- Enter the filter values such as Time, Subject line search, Item type, and Folder type, and then click Apply filter.
- In the search result, select the messages you want to recover, and then click Recover deleted items.
The messages will reappear in the mailbox after a short delay.
Recovering deleted messages using PowerShell
In case you want to use PowerShell, you can recover deleted messages using the tool too. You would need the In-Place eDiscovery permission in order to perform this process. If you have the permission, you can perform the following steps:
- Connect to Exchange PowerShell Online.
- Use the following code to search for the deleted messages:
- Get-RecoverableItems -<mailbox name> -SubjectContains "<words or phrases in subject line>" -FilterItemType IPM.Note -FilterStartTime "<Start date & time>" -FilterEndTime "<End date & time>"
- Once the result has been returned, you can restore the messages with the following script:
- Restore-RecoverableItems -Identity "<target mailbox 1>","<target mailbox 2>" -FilterItemType IPM.Note -SubjectContains "<words or phrases in subject line>" -FilterStartTime "<Start date & time>" -FilterEndTime "<End date & time>" -MaxParallelSize <number of mailboxes to be recovered in>
This will recover the deleted messages in the specified mailboxes.