Admins can search for emails deleted when assigning a retention policy to user mailboxes or any other automated process. Since a user cannot recover the deleted emails, only the admin can do it.
If the admin has a backup of the deleted emails, it becomes easier to recover a specific email message. However, if there is no backup, the deleted item should be under its retention period of 14 days.
Here is the method to search deleted emails and restore it to a target mailbox using the Exchange Management Shell cmdlet. Prior to that, you should have information about several basic aspects of the Exchange Server 2019 and the deleted email.
What do you need to know before recovering deleted emails?
Before you start searching for the deleted email messages in Exchange Server 2019 and go on to recover them, you need to get information about several important aspects:
- Source mailbox: That you want to search for messages
- Target mailbox: Where you can store the recovered messages. Also called discovery mailbox, Exchange Server 2019 creates it by default.
- Search Criteria: Should include information about the sender, recipient, keywords, etc. in the message
Do you have the required permission?
Before you look out for the deleted email messages in the Exchange Server 2019 mailbox, you need to have relevant Mailbox Import / Export permission in the Exchange Admin Center. Here are the steps:
- Login to your EAC account with your Exchange Server 2019 credentials
- Navigate to Permissions -> Admin Roles
- From here, you can assign the mailbox Import / Export role to an existing Role Group
- Alternatively, you can also create a new role group
- After creating the role group, wait for an hour before the permissions come into effect
For detailed information on seeking the right permission, click the eDiscovery permissions page on the Microsoft website.
Step 1: Search for missing items and recover them
With relevant permissions, you can now go on to search and recover deleted emails. The first step in the Exchange email recovery process will be to look out for the email messages in the source mailbox.
The EMS cmdlet Get-RecoverableItems will be helpful to perform the search. Here is an example:
Get-RecoverableItems -Identity search@Olympics.com -SubjectContains "Paris Olympics" -FilterItemType IPM.Note -FilterStartTime "8/8/2024 12:00:00 AM" -FilterEndTime "10/10/2024 11:59:59 PM"
This example will fetch all the deleted messages with the mentioned subject in the mailbox search@Olympics.com for the provided date and time range.
To verify a successful search for the deleted email, sign in to the discovery mailbox that you chose as the target mailbox and go through the search results.
Step 2: Restore recovered items
Just like in the case of email search, you will need to have the requisite permission to restore the recovered emails from Exchange Server 2019 as well. To find out the relevant permission, go through the Assign eDiscovery permissions in Exchange Server page on the Microsoft Website.
You can use the Search-Mailbox cmdlet to restore the recovered message from the discovery mailbox to the user’s mailbox.
Here is the EMS cmdlet to restore the recovered emails.
$mailboxes = Import-CSV "C:\My Documents\RestoreMessage.csv"; $mailboxes | foreach { Restore-RecoverableItems -Identity $_.SMTPAddress -SubjectContains "Project" -SourceFolder DeletedItems -FilterItemType IPM.Note }
As you can see, this example attempts to restore the deleted email message “Project” for the mailbox included in the specified CSV file (RestoreMessage.csv)
Limitations of the manual method
The EMS cmdlets can help to perform Exchange emails recovery and restore the deleted emails but this manual method accompanies several restrictions:
- You will need to possess admin permissions to perform the recovery task
- You must do the email recovery before its default retention period of 14 days expires
- Exchange Server 2019 disables single-item recovery by default when you create a mailbox. For email recovery, you need to enable this option by configuring mailbox settings in the EAC or by PowerShell commands.
To get away with these limitations, admins can confide in a reliable third-party Exchange recovery tool such as Stellar Repair for Exchange.
Stellar Repair for Exchange for Email Recovery
A prominent software for Exchange email recovery, it leverages advanced scanning algorithms to look out for deleted emails in the mailboxes and restores them without hassles. It is popular among small and big organizations for its capability to restore offline and dismounted EDB files with precision. Here are more reasons to confide in this tool.
- Recommended by MVPs to repair EDB files
- Restores mailbox contents including email messages, contacts, notes, etc.
- Repairs the EDB files with zero risk of data loss
- Can restore multiple mailboxes at once
- Does need to seek permission for email recovery
- Sets you free from the hassles of command lines, as in the case of EMS cmdlets
- Can locate and recover deleted emails easily
- Can perform single email recovery without making changes to mailbox settings
- Log report generation of Exchange Recover to help you analyze the repair process
- Any person without a technical background can also use it for email recovery
Steps for email recovery via Stellar Repair for Exchange
Here are the easy steps to recover the deleted emails and restore them in the Microsoft Exchange Server 2019 by using Stellar Repair for Exchange.
Stellar Repair for Exchange can recover deleted emails from the Recover Deleted items Folders.
- In the main menu, Home ribbon, click Recoverable Items Folders
- A Recoverable Items Folders dialog box appears on the screen. Click Yes to rescan the added files and identify the recoverable emails.
- In the resulting Recoverable Item Folders dialog box, click Yes to rescan the selected EDB files.
- This will open Select Recoverable Items Folders dialog box. It will ask you to choose the folders that you want to recover along with their mailboxes. Here are the options:
- Recovery Items: Includes all the deleted emails
- Purges: Includes emails purged by using Purge selected Items.
- Calendar Logging: Consists of the purged calendars
- Versions: Includes the modified and the original copies of the purged emails
- Deletions: Contains deleted emails whose retention period is yet to expire
- Audit Logging: Consists of audit log entries of the updated file.
- Substrate Hold: comprises the original copy of the updated EDB file
- eDiscovery E Hold: Contains emails that you want to protect from deletion
- Next, click Apply to get a tree view on the screen
- Click the unknown folder, and expand it to find the recovered emails
Download the free trial version to scan and preview your deleted emails. You may also choose to buy the paid version of this Exchange Server recovery tool. Depending on your specific requirements, you can subscribe for Corporate, Technician, or Toolkit editions.
Conclusion
You may have deleted your important emails from Exchange Server 2019 only to realize their importance later on. In any case, recovering and restoring those emails becomes indispensable.
You may use Exchange Management Shell (EMS) cmdlets for this purpose. However, it is important to do the recovery task within the 14-day retention period beyond which the deleted email will become inaccessible. It is hence always good to have a backup of your EDB file, as it will make it easier to restore the deleted email.
Since the manual method accompanies certain limitations, such as the need to have permissions, configure the disabled single email recovery option to enable it, etc. To avoid these hassles, Stellar Repair for Exchange will be the ideal software.
Recommended by MVPs and used by renowned corporate hubs, this Exchange Recovery tool recovers and restores deleted emails from the mailboxes in a breeze. You can use its trial version to start with. To benefit from its entire features, you may proceed to buy any of its paid editions.
