Solved

Accidental Delete of Messages Exchange 2010 using Search-Mailbox

Posted on 2014-01-29
6
817 Views
Last Modified: 2014-01-30
One of our techs was doing message archiving and got confused on a greater than and less than sign. and deleted an entire years worth of messages from our HR managers mailbox. Unfortunately the exchange database had not been backed up for a week. Before I go through the restore process I have been trying to recover those messages using the following two commands.

Search-Mailbox hrmanager -SearchDumpsterOnly -TargetMailbox "RecoveryMailbox" -TargetFolder "HRManager" -LogLevel Full

I also tried:

Search-Mailbox hrmanager -TargetMailbox "RecoveryMailbox" -TargetFolder "HRManager" -LogLevel Full

Each one gives me a bunch of history from the mailbox but does not give me the 2013 year I am looking for. I also did it with specifying messages only received in 2013 and did not produce any results.

Our retention policy on the server is set to 180 days on deleted items. Can I recover these messages without going to the backups? I always though you could but now have not been able to do it so am perplexed.

It is Exchange 2010 SP3 Standard.

Thank you!
0
Comment
Question by:knoots
  • 3
  • 2
6 Comments
 
LVL 15

Expert Comment

by:achaldave
ID: 39818181
0
 

Author Comment

by:knoots
ID: 39818812
Under "normal delete conditions" such as the user deleting from their inbox they could be recovered in this manner but they were deleted using the search-mailbox command. In any case they do not show up in the Recover Deleted Items from OWA or Outlook.
0
 
LVL 15

Accepted Solution

by:
achaldave earned 500 total points
ID: 39819532
Unfortunately the mails deleted by search-mailbox command are permanently deleted, your best option is to restore from backup. Didn't the command exported deleted emails to target mailbox or the admin didn't specify target mailbox in search? Other option if any profile has that mailbox in cache mode, try opening that profile on user machine without connecting to network and you should be able to export emails from there. Or OST recovery software like this if OST file is available, http://www.recoveroutlookpst.com/recover-deleted-emails-from-ost-file.html
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:knoots
ID: 39819864
As I feared but was looking for confirmation achaldave is correct. I thought of the OST too late to prevent the deletion but am going to try the OST delete recovery you suggested tomorrow. Keep you posted.
0
 
LVL 4

Expert Comment

by:michaelalphi
ID: 39820120
Hi Knoots,
As you have mentioned that your retention period is 180 days, then you can reconnect the deleted mailbox at any point during this time. Deleted mailbox stores in the information store database, (only if you do not flagged it for permanent deletion). At the end of the mailbox retention period, the mailbox is permanently deleted from the database.
So, if someone has mistakenly deleted a mail-enabled user account, you can recreate that user object, and then reconnect that mailbox during the mailbox retention period.
You can follow below steps to recover the deleted mailbox :

1) In Exchange System Manager, locate the mailbox store that contains the disconnected mailbox.
2) Click the Mailboxes object under the mailbox store.
3) If the mailbox is not already marked as disconnected (the mailbox icon appears with a red X), right-click the Mailboxes object, and then click Cleanup Agent.
4) Right-click the disconnected mailbox, click Reconnect, and then select the appropriate user from the dialog box that appears.
5) Click OK.
You can also check this automated option to restore deleted mailbox even the backup is not available : http://www.exchangemailboxrecovery.co.uk/
0
 

Author Closing Comment

by:knoots
ID: 39821932
achaldave was correct. Also his suggestion for the recovery software worked perfectly. I retrieved all the lost email from the .ost file as he suggested! Thanks!
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
powershell add exchange property to a report 12 52
Office 365 cutover migration questions 2 35
Exchange Reports 4 26
archive enable with Remote mailbox 7 19
Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data‚Ķ
how to add IIS SMTP to handle application/Scanner relays into office 365.

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question