Restore emails deleted using search-mailbox and -deletecontent with invalid search criteria

One of our sys admins deleted emails out of all of our mailboxes in our exchange environment by using invalid search criteria. He used full logging so we have a copy of all the emails and where they go in each users mailbox. Hoping someone has a script we can use to restore the messages. Any help?
LVL 1
vpetersenAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Will SzymkowskiSenior Solution ArchitectCommented:
The Messaging Team Blog has written a script RecoverDeletedItems.PS1 script which will allow you to recover deleted content and restore items back into the original mailbox. Take a look at the link below for further details.
http://blogs.msdn.com/b/emeamsgdev/archive/2012/04/27/powershell-script-to-recover-all-deleted-items-in-a-mailbox.aspx

Will.
0
vpetersenAuthor Commented:
That works if the user deleted them, thanks for that script.

The mail had been deleted using the mailboxsearch commandlet so it was no longer in the dumpster of the original mailboxes, and we were not able to recover by the usual means.  However, we had a search mailbox that had all of the mail we needed divided by search, and which was still neatly in folder trees showing where it belonged.  We just had to get it back to the original location.

In its simplest form all we did was export the mail into PSTs by user and imported the PST's back in to the original user mailboxes.  
Since each of the mail searches contained the root folder for the given mailbox we were able to parse the folder structure to get what we needed.

First we got a list of the mail folders for each of the mailbox searches.  For this we used a script that someone else had already created to export the folder structure for each of the bad searches.   http://www.msoutlook.info/question/515

That gave us output data like this:

"SearchMailbox@domain.com\Search1\Test User-3%2F31%2F2015 5:24:20 PM"
"SearchMailbox@domain.com\Search1\Test User-3%2F31%2F2015 5:24:20 PM\Primary Mailbox"
"SearchMailbox@domain.com\Search1\Test User-3%2F31%2F2015 5:24:20 PM\Primary Mailbox\Deleted Items"
"SearchMailbox@domain.com\Search1\Test User-3%2F31%2F2015 5:24:20 PM\Primary Mailbox\Inbox"
"SearchMailbox@domain.com\Search1\Test User-3%2F31%2F2015 5:24:20 PM\Primary Mailbox\Sent Items"

Next we parsed that out into some usable variables.  I'm not going to go into any great detail, but we used various text operations in Excel to accomplish that. (text to columns, concatenation, etc..)  

In our case we parsed that into columns using Excel so that we had the following:

2015-04-07-14-51-27.jpg                  

Be aware that you need to replace %2F with / for the dates to work correctly, you further have to escape the / with \ to use it in a PowerShell script.

We were only interested in the full user mailbox so we disregarded the other rows.

Those values were then inserted into export and import scripts like these:
--The mailbox Export script:  Note we're setting the -sourcerootfolder to the "primary mailbox" under the searchfolder.  That's key to getting mail back to its proper location in the PST.
New-MailboxExportRequest -Mailbox SearchMailbox@domain.com -FilePath "\\FileServer\Path\Test User.pst" -SourceRootFolder "Search1\Test User-3\/31\/2015 5:24:20 PM\Primary Mailbox/" -name  "Test User"

Open in new window


--The re-import script is similar.
New-MailboximportRequest -Mailbox "Test User" -FilePath "\\FileServer\Path\Test User.pst" -Name "Test User"

Open in new window


We used excel to make the scripts, but the CSV with the values as columns can be used in PowerShell to script this as well.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
vpetersenAuthor Commented:
self resolved
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.