Restoring Deleted Emails Using PowerShell 3#3

Restoring Deleted Emails Using PowerShell 3#3

In this article, we examine the use of the PowerShell cmdlet – Restore-RecoverableItems.

The purpose of the PowerShell cmdlet – Restore-RecoverableItems is to help us restore deleted emails to their original folder. The unique feature of Restore-RecoverableItems is the ability to restore deleted email items to their original folder.

A quick reminder and reference

In the previous article, we looked at using Get-RecoverableItems to display information about items deleted from a mailbox.

In the context of the PowerShell cmdlets Get-RecoverableItems and Restore-RecoverableItems
the term “deleted mail items” refers to two types of deleted mail items:

1. Standard Deleted Items – The term “standard deleted mail items” is not a formal technical term, but rather a term I use to refer to regulated mail items that are stored in the mailbox folder – “Deleted Items” (the mailbox trash).
2. Soft Deleted Mail Items – Mail items that have been deleted from the mailbox trash and classified as “Soft Deleted Mail Items.” These mail items are stored in the “Deletions” folder, a special hidden system folder that is part of the “Recoverable Items Folder” area and stores “Soft Deleted” mail items.

Restore Deleted Mail Items | Filter By – Folder Scope

If we use the Restore-RecoverableItems PowerShell cmdlet as is, without any folder scope parameters, the Restore-RecoverableItems cmdlet will automatically restore all the following types of deleted mail items:

• Standard Deleted Items
• Softly deleted items

If we use the PowerShell cmdlet Restore-RecoverableItems without folder parameters, the cmdlet will automatically restore both types of deleted mail items.

PowerShell Command Example

Restore-RecoverableItems Jeff

Using “Folder scope” to restore a specific type of deleted mail items.

To be able to perform a restore procedure that only concerns specific types of “deleted mail”, we use the “SourceFolder” parameter.

The structure of the PowerShell command is written as follows:

Restore-RecoverableItems <mailbox> -SourceFolder <Le dossier de la boîte aux lettres>.

Restore only standard deleted mail items (deleted items stored in the Recycle Bin)

To restore only “standard deleted mail items”, i.e., mail items stored in the “Deleted Items” folder, we need to use the following PowerShell command syntax:

Restore-RecoverableItems Jeff -SourceFolder DeletedItems

Restore only deleted mail items

To restore only “Soft Deleted mail items”, i.e. mail items stored in the “Deletion” folder (a subfolder in the “Recoverable item folder” space), we need to use the following PowerShell command syntax:

Restore-RecoverableItems Jeff -SourceFolder RecoverableItems

Restore Deleted Mail Items | Filter by – Date

To restore deleted mail items from a specific date range, we use the following 2 PowerShell parameters:

• FilterStartTime
• FilterEndTime

Example PowerShell command syntax:

Restore-RecoverableItems Jeff -FilterStartTime "9/1/2018 12:00:00 AM" -FilterEndTime "9/1/2018 12:00:00 AM"

Restore Deleted Mail Items | Filter by – Email Subject

To restore deleted mail items whose subject contains a specific text string, we can use the SubjectContains parameter.

Example PowerShell command syntax:

Restore-RecoverableItems Jeff -SubjectContains "test"

Restore Deleted Mail Items | Filter by – Email Message Type

The Exchange mailbox serves as a container for different types of “mail items.”
For example, a standard email message, a calendar meeting, task items, and a mail contact item.

When we request to restore deleted mail items, the PowerShell cmdlet Restore-RecoverableItems will automatically restore all types of mail items considered “deleted mail items.”
If we need to define a search filter that looks for a specific type of deleted mail item, we can use the “FilterItemType” parameter.
The following table shows the 4 types of “mail items”:

For example, in case we want to restore only deleted mail items that are considered “calendar items”, we can use the following syntax:

Restore-RecoverableItems Jeff -FilterItemType IPM.Appointment

Restore Deleted Mail Items | Filter by – Number of Mail Items Deleted

By default, the Restore-RecoverableItems PowerShell cmdlet will restore all deleted mail items.
If we want to request the restoration of a specific number of deleted items, we can use the –ResultSize parameter.

For example, we want to restore only the last 5 mail items categorized as “deleted mail items”.

Restore-RecoverableItems Jeff -ResultSize 5

Restore Deleted Mail Items | Filter By – Last Parent Folder ID

The term “Last parent folder identity” defines the identity of the mailbox folder that hosts the emails before deletion.

The identity of the last parent folder is a property named LastParentFolderID.
In case we want to restore only deleted items in a specific folder, we can use the parameter – LastParentFolderID.

For example

Restore-RecoverableItems Jeff -LastParentFolderID 9B52034A478A6141B401DF3BF7851B460000000015E0

Restore Mail Items | Additional Options

Measure the estimated time required to restore mail items

Measure-command {Restore-RecoverableItems jeff}