Accidentally deleted emails? Don’t panic! This guide explains how to recover them from Exchange Server within the retention period. Plus, learn 5 tips to avoid future email loss!
Users, sometimes, delete important emails and other data by mistake or intentionally. The Exchange Server stores deleted emails for a certain period, known as the Retention Period, before purging them. This period is usually 14 days but can also be changed/extended by the administrator.
As an Exchange administrator, you can recover deleted emails from the Exchange Server before the retention period is over. If the retention period on the server has expired, the emails can only be retrieved from the backup. This article will explain the stepwise process to recover deleted emails from the Exchange Server.
Steps to Recover Deleted Emails from the Exchange Server
Here is the stepwise process to recover deleted emails from Exchange Server within the retention period.
Step 1: Check and Assign Required Permissions
For the process, you need to do a content search and then save the recovered emails to a PST file. For this, you must have permission to run the following commands.
- Search-Mailbox
- New-MailboxExportRequest
To identify the roles and permissions needed, you can execute the following command in the Exchange Management Shell (EMS):
Get-ManagementRole -Cmdlet
This will list all the management roles needed. Next, you need to see the permissions to run the command. To know these permissions, run the following command:
$Permissions = Get-ManagementRole -Cmdlet
$Permissions | foreach {Get-ManagementRoleAssignment -Role $_.Name -Delegating $false | Format-Table -Auto Role,RoleAssigneeType,RoleAssigneeName}
Once you know the permissions and roles needed, you can set them for the user who will be used to recover the deleted emails.
Step 2: Search for the Deleted Data
You can use the Search-Mailbox command to run a search query against the database where the specified mailbox resides. If the user has exhausted the search in the mailbox using Outlook or Outlook Web Access (OWA), you can run the following query:
Search-Mailbox “
The above command will search the specified mailbox and retrieve the results in the Discovery Search Mailbox in the specified target folder. If you want to only search items in the Recoverable Items folder, you can use the SearchDumpsterOnly switch (see the below example).
Search-Mailbox “
Step 3: Recover the Data
The recovered data will be stored in the Discovery Search Mailbox. You can export the recovered data from the Discovery Search Mailbox to a PST file. For this, you can use the New-MailboxExportRequest command (see the below example).
New-MailboxExportRequest -Mailbox “Discovery Search Mailbox” -SourceRootFolder “RecoveryFolderName” -FilePath
If you want to filter the export, you can use the content filter switches.
New-MailboxExportRequest -Mailbox “Discovery Search Mailbox” -SourceRootFolder “RecoveryFolderName” -ContentFilter {Subject -eq “‘Email Subject’”} -FilePath
Once the export is completed, simply copy the PST file to the user’s computer/device and open/import it into Outlook to access the desired emails.
Limitations of the Above Process
Below are some limitations of the above manual process.
- You can only search in one mailbox at a time.
- You need specific permissions to search and extract the data.
- You can only search through mailboxes or databases which are active.
- You cannot restore the deleted emails if the retention period has passed.
- You need scripting skills when it comes to the search by using the KQL language.
An Easy and Quick Way to Recover Deleted Emails from Exchange Server
To overcome the limitations of the above process, you can use a third-party Exchange server recovery tool, such as Stellar Repair for Exchange to recover deleted emails from the Exchange Server database. With this application, you can open databases with or without a live Exchange Server and search through the databases with minimal effort and a fully functional and simple interface.
To recover the deleted items, you simply need to click on the Recoverable Items Folder button and select from the various options – versions, purges, deletions, audit logging, eDiscovery holds, and others.
Once selected, the data will be loaded in an Outlook-like interface. After this, you can export the data to PST and other file formats. You can also export the data directly to a live Exchange Server database or Exchange Online (Office 365) with automatic mailbox matching. The application can also be used to recover user mailboxes, user archives, shared mailboxes, disabled mailboxes, and even public folders.
Conclusion
Above, we have discussed the native method to search and recover deleted emails from an Exchange Server. However, you can recover the deleted emails from Exchange Server within the retention period only. In addition, there are some limitations to this method.
Nevertheless, make sure you don’t put yourself or your organisation in a situation in which important data is intentionally or unintentionally lost. Here are 5 steps to avoid deletion of emails from your Exchange server:
- Leave copies of messages on the server: This ensures a copy of your emails remains on the server even after deletion from your Outlook client.
- Disable “Empty Deleted Items when Exiting Outlook”: This prevents Outlook from automatically deleting emails from your Deleted Items folder when you close the program.
- Configure folder AutoArchive settings: You can exclude specific folders from automatic archiving, which can sometimes delete emails based on pre-set rules.
- Increase mailbox storage quota (if applicable): If your mailbox reaches its storage limit, Exchange might automatically start deleting emails. Requesting a higher quota from your IT admin can prevent this.
- Understand and adjust automatic deletion policies: Some organizations have server-side policies for deleting old emails. Talk to your IT administrator to understand these policies and see if any adjustments can be made to your mailbox.