- Article
Important
Effective from December 2022, the classic Exchange Admin Center will be deprecated forworldwide customers. Microsoft recommends using the new Exchange Admin Center, if notalready doing so.
While most of the features have been migrated to new EAC, some have been migrated toother admin centers and remaining ones will soon be migrated to New EAC. Find featuresthat are not yet there in new EAC at Other Features or use Global Search that will help younavigate across new EAC.
Important
Check out the new Exchange admin center! The experience is modern, intelligent, accessible, and better. Personalize your dashboard, manage cross tenant migration, experience the improved Groups feature, and more. Try it now!
(This article is intended for Exchange administrators.)
Administrators can search for and recover deleted email messages in a user's mailbox. This includes items that are permanently deleted (purged) by a person (by using the Recover Deleted Items feature in Outlook or Outlook on the web (formerly known as Outlook Web App)), or items deleted by an automated process, such as the retention policy assigned to user mailboxes. In these situations, the purged items can't be recovered by a user. But administrators can recover purged messages if the deleted item retention period for the item hasn't expired.
Note
In addition to using this procedure to search for and recover deleted items (which are moved to the Recoverable Items\Purges folder if either single item recovery or litigation hold is enabled), you can also use this procedure to search for items residing in other folders in the mailbox and to delete items from the source mailbox (also known as search and destroy).
What you need to know before you begin?
Estimated time to complete: 15-30 minutes.
Procedures in this article require specific permissions. See each procedure for its permissions information.
Single item recovery must be enabled for a mailbox before the item you want to recover is deleted. In Exchange Online, single item recovery is enabled by default when a new mailbox is created. In Exchange Server, single item recovery is disabled when a mailbox is created. For more information, see Enable or disable single item recovery for a mailbox.
To search for and recover items, you must have the following information:
Source mailbox: This is the mailbox being searched.
Target mailbox: This is the discovery mailbox in which messages will be recovered. Exchange Setup creates a default discovery mailbox. In Exchange Online, a discovery mailbox is also created by default. If necessary, you can create additional discovery mailboxes. For details, see Create a discovery mailbox.
Search criteria: Criteria include sender or recipient, or keywords (words or phrases) in the message.
This article focuses on using PowerShell to recover deleted items in a user's mailbox. You can also use the GUI-based In-Place eDiscovery tool to find and export deleted items to a PST file. The user will use this PST file to restore the deleted messages to their mailbox. For detailed instructions, see Recover deleted items in a user's mailbox - Admin Help.
Use new EAC for recovering deleted messages
In the new EAC, navigate to Recipients > Mailboxes.
Select the mailbox for which you want to recover deleted messages, and click on the display name.
Under More actions, click Recover deleted items.
Enter values for each or either of the filter criteria from the drop-down lists.
Click Apply filter.
Using PowerShell to manage deleted items
Step 1: Connect to Exchange Online PowerShell
For instructions, see Connect to Exchange Online PowerShell.
Step 2: Search for and recover missing items
You need the Mailbox Import Export RBAC role before you can do this procedure or procedures.
Note
You can use In-Place eDiscovery in the Exchange admin center (EAC) to search for missing items. However, when using the EAC, you can't restrict the search to the Recoverable Items folder. Messages matching your search parameters will be returned even if they're not deleted. After they're recovered to the specified discovery mailbox, you may need to review the search results and remove unnecessary messages before recovering the remaining messages to the user's mailbox or exporting them to a .pst file. For details about how to use the EAC to perform an In-Place eDiscovery search, see Create an In-Place eDiscovery search.
Use the Exchange Online PowerShell to search for messages
Get-RecoverableItems -Identity [email protected] -SubjectContains "FY17 Accounting" -FilterItemType IPM.Note -FilterStartTime "2/1/2018 12:00:00 AM" -FilterEndTime "2/5/2018 11:59:59 PM"This example returns all of the available recoverable deleted messages with the specified subject in the mailbox [email protected] for the specified date/time range.
Tip
Use the Get-RecoverableItems cmdlet to create a search query to find an Outlook item. Once you have a list of results you can use properties like last modified date, item type, etc. to narrow the amount of items restored or to restore a specific item.
For detailed syntax and parameter information, see Get-RecoverableItems.
How do you know this worked?
To verify that you have successfully searched the messages you want to recover, log on to the discovery mailbox you selected as the target mailbox and review the search results.
Step 3: Restore recovered items
You need the Mailbox Import Export RBAC role before you can do this procedure or procedures.
Note
You can't use the EAC to restore recovered items.
After messages have been recovered to a discovery mailbox, you can restore them to the user's mailbox by using the Restore-RecoverableItems cmdlet.
Use Exchange Online PowerShell to restore messages
Restore-RecoverableItems -Identity "[email protected]","[email protected]" -FilterItemType IPM.Note -SubjectContains "COGS FY17 Review" -FilterStartTime "3/15/2019 12:00:00 AM" -FilterEndTime "3/25/2019 11:59:59 PM" -MaxParallelSize 2After using the Get-RecoverableItems cmdlet to verify the existence of the item, this example restores the specified deleted items in the specified mailboxes:
Mailboxes: [email protected], [email protected]
Item type: Email message
Message subject: COGS FY17 Review
Location: Recoverable Items\Deletions
Date range: 3/15/2019 to 3/25/2019
Number of mailboxes processed simultaneously: 2
For detailed syntax and parameter information, see Restore-RecoverableItems.
How do you know this worked?
To verify that you have successfully recovered messages to the user's mailbox, have the user review messages in the target folder you specified in the above command.
More information
The ability to recover deleted items is enabled by single item recovery, which lets an administrator recover a message that's been purged by a user or by retention policy as long as the deleted item retention period hasn't expired for that item. To learn more about single item recovery, see Recoverable Items folder in Exchange Online.
An Exchange Online mailbox is configured to retain deleted items for 14 days, by default. You can change this setting to a maximum of 30 days. For more information, see Change how long permanently deleted items are kept for an Exchange Online mailbox.
As previously explained, you can also use the In-Place eDiscovery tool to find and export deleted items to a PST file. The user will use this PST file to restore the deleted messages to their mailbox. For detailed instructions, see Recover deleted items in a user's mailbox - Admin Help.
Users can recover a deleted item if it hasn't been purged and if the deleted item retention period for that item hasn't expired. If users need to recover deleted items from the Recoverable Items folder, point them to the following articles:
Recover deleted items in Outlook for Windows
Recover deleted email messages in Outlook on the web
In addition to using this procedure to search for and recover deleted items, you can also use a similar procedure to search for items in user mailboxes and then delete those items from the source mailbox. For more information, see Search for and delete email messages.
Related article
Are you using Exchange Server? See Recover deleted messages in a user's mailbox in Exchange Server.
