Link to home
Start Free TrialLog in
Avatar of knoots
knoots

asked on

Accidental Delete of Messages Exchange 2010 using Search-Mailbox

One of our techs was doing message archiving and got confused on a greater than and less than sign. and deleted an entire years worth of messages from our HR managers mailbox. Unfortunately the exchange database had not been backed up for a week. Before I go through the restore process I have been trying to recover those messages using the following two commands.

Search-Mailbox hrmanager -SearchDumpsterOnly -TargetMailbox "RecoveryMailbox" -TargetFolder "HRManager" -LogLevel Full

I also tried:

Search-Mailbox hrmanager -TargetMailbox "RecoveryMailbox" -TargetFolder "HRManager" -LogLevel Full

Each one gives me a bunch of history from the mailbox but does not give me the 2013 year I am looking for. I also did it with specifying messages only received in 2013 and did not produce any results.

Our retention policy on the server is set to 180 days on deleted items. Can I recover these messages without going to the backups? I always though you could but now have not been able to do it so am perplexed.

It is Exchange 2010 SP3 Standard.

Thank you!
Avatar of achaldave
achaldave
Flag of United States of America image

Avatar of knoots
knoots

ASKER

Under "normal delete conditions" such as the user deleting from their inbox they could be recovered in this manner but they were deleted using the search-mailbox command. In any case they do not show up in the Recover Deleted Items from OWA or Outlook.
ASKER CERTIFIED SOLUTION
Avatar of achaldave
achaldave
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of knoots

ASKER

As I feared but was looking for confirmation achaldave is correct. I thought of the OST too late to prevent the deletion but am going to try the OST delete recovery you suggested tomorrow. Keep you posted.
Hi Knoots,
As you have mentioned that your retention period is 180 days, then you can reconnect the deleted mailbox at any point during this time. Deleted mailbox stores in the information store database, (only if you do not flagged it for permanent deletion). At the end of the mailbox retention period, the mailbox is permanently deleted from the database.
So, if someone has mistakenly deleted a mail-enabled user account, you can recreate that user object, and then reconnect that mailbox during the mailbox retention period.
You can follow below steps to recover the deleted mailbox :

1) In Exchange System Manager, locate the mailbox store that contains the disconnected mailbox.
2) Click the Mailboxes object under the mailbox store.
3) If the mailbox is not already marked as disconnected (the mailbox icon appears with a red X), right-click the Mailboxes object, and then click Cleanup Agent.
4) Right-click the disconnected mailbox, click Reconnect, and then select the appropriate user from the dialog box that appears.
5) Click OK.
You can also check this automated option to restore deleted mailbox even the backup is not available : http://www.exchangemailboxrecovery.co.uk/
Avatar of knoots

ASKER

achaldave was correct. Also his suggestion for the recovery software worked perfectly. I retrieved all the lost email from the .ost file as he suggested! Thanks!