A user was scrolling up in Outlook yesterday and instead of grabbing the slider grabbed a subfolder (2500 emails in it) of the inbox and dragged it into the Outbox. She then panicked and cancelled the move operation. Afterwards both the outbox and the subfolder were empty. A search in ECP revealed the emails were still there however there was now no way I could find to determine which emails were in that folder and restore just those emails.
So I restored the database from yesterdays backup and mounted it as a restoreDB. I have now issued several New-MailboxRestoreRequest commands in an attempt to restore just that one folder:
New-MailboxRestoreRequest -SourceDatabase recoverdb -SourceStoreMailbox 'user' -TargetMailbox 'usertemp' -IncludeFolders '#inbox#\2010\' -ExcludeDumpster -TargetRootFolder '#inbox#' -AllowLegacyDNMismatch
I have tried various variations for the -includeFolders parameter (2010,#inbox\2010#) but it just runs and ends up restoring nothing or throws errors. I have tried just #inbox# itself and it restored the inbox but no subfolders.
I am now restoring the entire mailbox (it's big) and will manually move the folder over in Outlook but there simply has to be a better way to do this. The syntax explanation from Microsoft is not helpful as it does not give an example for a subfolder.
Any help would be appreciated with either a method to extract the folder from the backup or to restore the contents of the folder which disappeared during the copy/move operation cancellation.