Recover deleted items from Exchange Dumpster

Read time 4 minutes

Accidental deletion of Exchange server mailbox items is an unwanted situation which Exchange Administrators will have to face sometimes. A user may delete a message which was useful, and later he/she get to know that something bad has happened. Microsoft has taken care of every possibility, and that’s why there are some remarkable features for recovering deleted items. There is a Recoverable Items folder previously known as Dumpster which is the place where you need to look for accidentally deleted items.

Recoverable items folder post deletion

When we see a mailbox, then we can understand that it is arranged in a tree structure. But the Exchange Server organizes the user mailbox in two subtrees – First one is IPM (interpersonal messaging) sub-tree, and another one is Non-IPM Subtree. In IPM subtree, all the visible folders like Inbox, Outbox, Contacts, Sent items, etc are placed. The other Non-IPM subtree is used to save the hidden internal data, user information, preferences, etc. The Dumpster (Recoverable Items folder) is saved in the Non-IPM subtree of the mailboxes. It is invisible to the user, and you cannot manage it from the Exchange Admin Center.

There are several features which use the dumpster folder:

• Single item recovery
• deleted item recovery
• In-place hold
• Litigation hold
• Mailbox audit logging
• Calendar logging

All these features use the dumpster folder to save the following types of subfolders –

• Deletions: The folder is used to save the items removed from the Deleted Items folder.
• Versions: This folder saves the original and copies of the deleted items. It is applicable when In-Place Hold or Litigation Hold is enabled.
• Purges: It saves all the hard-deleted items. It is applicable when Litigation Hold or Single item recovery is enabled.
• Audits: As the name suggests, the Audits subfolder saves the audit log entries when the mailbox audit logging is enabled.
• DiscoveryHolds: This folder works when the In-Place Hold is enabled, and the item is hard deleted.
• Calendar logging: As the name suggests, the subfolder saves the calendar changes present in the mailbox.

Here, we will learn that how you can retrieve a hard-deleted item form a user mailbox. Because the hard-deleted items are not visible to the user, so you need to use the Exchange Management Shell to complete the recovery procedure. Here are some prerequisites which you should take care of before starting the method:

• Only the administrator who has complete rights over the mailbox can complete the procedure.
• The administrator should search the deleted item within the retention period set in the Exchange Server.
• Single item recovery feature should be in enable state for the mailbox which data you want to restore. By default; the individual item recovery option is disabled in the Exchange Server when the mailbox is created.

After fulfilling the prerequisites, apply the following steps:

1. Search for deleted items: The first step is to search the item and save it at a target mailbox. After a successful search, you can restore the item to its original mailbox.
   Run the command based on the following example:
   Search-Mailbox “MailboxName” -SearchQuery “from:’Sender’ AND keyword” -TargetMailbox “TargetMailbox” -TargetFolder “FolderName” -LogLevel Full

   After running the command, you can go to the target folder and see the item there. If the command runs perfectly, then the item would be there.

2. Restore the searched item: After searching the item, you can easily restore the item using the following command –
   Search-Mailbox “MailboxName” -SearchQuery “from:’Sender’ AND keyword” -TargetMailbox “TargetMailboxName” -TargetFolder “FolderName” -LogLevel Full -DeleteContent

   After running the command, the item will be saved to the destination folder and deleted from the source mailbox.

Conclusion

After getting the complete information about the process of recovering the deleted items from Exchange dumpster, you would know that the Exchange Admin Center is not capable of recovering the items. You can only use the Exchange Management Shell to search and retrieve the object. You should know the specific mailbox, the name of the item, and a particular keyword to find the item. It is not always easy to recover the item using the method, and so you should use a third-party application.

Kernel for Exchange Server is a highly efficient Exchange Recovery software created to retrieve the deleted and inaccessible items from the Exchange database. It can repair corrupt exchange database and lets you access the data from the hidden folders like a dumpster and allows you to save it.