Recover deleted items from Exchange Dumpster

Read time 4 minutes

Accidental deletion of Exchange server mailbox items can be an unfortunate situation that Exchange Administrators may encounter from time to time. Users may inadvertently delete important messages, only to realize the gravity of the situation later on. Fortunately, Microsoft has anticipated such scenarios and has implemented a range of robust features for recovering deleted items. One such feature is the Recoverable Items folder, formerly referred to as the Dumpster, which serves as the designated location for retrieving accidentally deleted items.

Recoverable items folder post deletion

When observing a mailbox, it becomes evident that it follows a hierarchical tree structure. However, the Exchange Server employs a more nuanced organization for user mailboxes, consisting of two distinct subtrees: the IPM (Interpersonal Messaging) subtree and the Non-IPM Subtree.

Within the IPM subtree, you will find all the readily visible folders, including Inbox, Outbox, Contacts, Sent Items, and more. These folders serve as familiar access points for users.

In contrast, the Non-IPM subtree serves as a discreet repository for hidden internal data, user-specific information, preferences, and various system-related items. Among the concealed elements stored in this subtree is the Dumpster, also known as the Recoverable Items folder. It remains unseen by the user and cannot be managed through the Exchange Admin Center, making it a vital component of behind-the-scenes mailbox maintenance.

Numerous features make use of the dumpster folder, including:

• Single item recovery
• deleted item recovery
• In-place hold
• Litigation hold
• Mailbox audit logging
• Calendar logging

All of these functionalities rely on the ‘dumpster’ folder to store various types of subfolders, including:

• Deletions: The folder is used to save the items removed from the Deleted Items folder.
• Versions: This folder saves the original and copies of the deleted items. It is applicable when In-Place Hold or Litigation Hold is enabled.
• Purges: It saves all the hard-deleted items. It is applicable when Litigation Hold or Single item recovery is enabled.
• Audits: As the name suggests, the Audits subfolder saves the audit log entries when the mailbox audit logging is enabled.
• DiscoveryHolds: This folder works when the In-Place Hold is enabled, and the item is hard deleted.
• Calendar logging: As the name suggests, the subfolder saves the calendar changes present in the mailbox.

In this section, we will explore the process of recovering a hard-deleted item from a user’s mailbox. Since hard-deleted items remain hidden from the user, you will need to employ the Exchange Management Shell to execute the recovery procedure effectively. Before initiating the method, it is essential to address the following prerequisites:

• Only the administrator who has complete rights over the mailbox can complete the procedure.
• The administrator should search the deleted item within the retention period set in the Exchange Server.
• Single item recovery feature should be in enable state for the mailbox which data you want to restore. By default; the individual item recovery option is disabled in the Exchange Server when the mailbox is created.

After fulfilling the prerequisites, apply the following steps:

1. Search for deleted items: The first step is to search the item and save it at a target mailbox. After a successful search, you can restore the item to its original mailbox.
   Run the command based on the following example:
   Search-Mailbox “MailboxName” -SearchQuery “from:’Sender’ AND keyword” -TargetMailbox “TargetMailbox” -TargetFolder “FolderName” -LogLevel Full

   After running the command, you can go to the target folder and see the item there. If the command runs perfectly, then the item would be there.

2. Restore the searched item: After searching the item, you can easily restore the item using the following command:
   Search-Mailbox “MailboxName” -SearchQuery “from:’Sender’ AND keyword” -TargetMailbox “TargetMailboxName” -TargetFolder “FolderName” -LogLevel Full -DeleteContent

   After running the command, the item will be saved to the destination folder and deleted from the source mailbox.

Conclusion

Once you’ve gained a thorough understanding of the retrieval process for deleted items from the Exchange dumpster, you’ll discover that the Exchange Admin Center lacks the capability to recover these items. Instead, your recourse is to employ the Exchange Management Shell, where you’ll need to possess specific details such as the mailbox in question, the item’s name, and a particular keyword to successfully locate the desired item. However, it’s important to note that this method may not always yield effortless results, making it advisable to consider utilizing a third-party application for more reliable and efficient item recovery.

Kernel for Exchange Server is an exceptionally efficient Exchange recovery software meticulously designed to recover deleted and previously inaccessible items from your Exchange database. This powerful tool not only repairs corrupt exchange database but also grants you access to data concealed within obscure folders, such as the dumpster, and empowers you to securely save it.