We ran across a problem a week or so ago with a user who had accidentally deleted the majority of her inbox, twice. Ignoring the obvious problem of the user deleting content twice it was a perfect time to exercise the Mailbox Search capabilities of Office 365 to attempt to recover e-mail.
A Little Background
Office 365 (a.k.a. Exchange 2010) provides a special folder called “Recoverable Items” folder. This folder in older versions of Exchange was known as the dumpster and worked a bit differently. Ross Smith with the Exchange team provides a lot of detailed information about the Dumpster/Recoverable Items function over at the TechNet Blog http://brntpb.st/HGxBaA. In my scenario the user had just deleted the content they needed recovered. Office 365 and Exchange 2010 by default keep deleted items for 14 days before permanently purging them from the system.
The Process
The recovery process I used requires Powershell access to Office 365. In addition, my user account is setup as a Global Admin in Office 365 so you may also have to review the permissions for your account to ensure you have enough permission to perform the recovery operation.
The process starts by defining a Mailbox Search in the system. You can read more about the command here http://brntpb.st/HbPxWD. The PowerShell command below assumes you have already connected to Office 365 with PowerShell if you do not know how to do that Mike Pfeiffer has a great post here: http://brntpb.st/Hkn53b.
The Solutions
PS C:\> New-MailboxSearch -Name “Recovery” -SourceMailboxes myuser@brentpabst.com -TargetMailbox me@brentpabst.com -StatusMailRecipients me@brentpabst.com -SearchDumpster -LogLevel Full -ExcludeDuplicateMessages $true
The command does a couple of things. First, it creates a new “Mailbox Search” and gives it a name called Recovery. This is important as it allows us to search for the item and manage it later. The rest of the command defines the mailbox to recover from, the mailbox to recover to and then some additional parameters that should make sense. The main problem I found was that you had to recover to a different mailbox. My guess is this is because it could create a circular reference. The other important part to this command was where the Search Dumpster option is set. This tells the mailbox search to search the Recoverable Items folder.
Once you run the command the system will chug away and create a new unique folder in your mailbox that, you can then export to PST and re-import into the original mailbox. You will also get an e-mail when the process has completed or if it fails. As I said before you can get a status of the search by running the following command:
PS C:\> Get-MailboxSearch “Recovery”
This command will display the status of the Recovery mailbox search job. You can explore other verbs against the MailboxSearch commands to get additional information and even control the job itself.
Hope that helps!
-Brent