Restore emails deleted using search-mailbox and -deletecontent with invalid search criteria

One of our sys admins deleted emails out of all of our mailboxes in our exchange environment by using invalid search criteria. He used full logging so we have a copy of all the emails and where they go in each users mailbox. Hoping someone has a script we can use to restore the messages. Any help?
Who is Participating?
vpetersenAuthor Commented:
That works if the user deleted them, thanks for that script.

The mail had been deleted using the mailboxsearch commandlet so it was no longer in the dumpster of the original mailboxes, and we were not able to recover by the usual means.  However, we had a search mailbox that had all of the mail we needed divided by search, and which was still neatly in folder trees showing where it belonged.  We just had to get it back to the original location.

In its simplest form all we did was export the mail into PSTs by user and imported the PST's back in to the original user mailboxes.  
Since each of the mail searches contained the root folder for the given mailbox we were able to parse the folder structure to get what we needed.

First we got a list of the mail folders for each of the mailbox searches.  For this we used a script that someone else had already created to export the folder structure for each of the bad searches.

That gave us output data like this:

"\Search1\Test User-3%2F31%2F2015 5:24:20 PM"
"\Search1\Test User-3%2F31%2F2015 5:24:20 PM\Primary Mailbox"
"\Search1\Test User-3%2F31%2F2015 5:24:20 PM\Primary Mailbox\Deleted Items"
"\Search1\Test User-3%2F31%2F2015 5:24:20 PM\Primary Mailbox\Inbox"
"\Search1\Test User-3%2F31%2F2015 5:24:20 PM\Primary Mailbox\Sent Items"

Next we parsed that out into some usable variables.  I'm not going to go into any great detail, but we used various text operations in Excel to accomplish that. (text to columns, concatenation, etc..)  

In our case we parsed that into columns using Excel so that we had the following:


Be aware that you need to replace %2F with / for the dates to work correctly, you further have to escape the / with \ to use it in a PowerShell script.

We were only interested in the full user mailbox so we disregarded the other rows.

Those values were then inserted into export and import scripts like these:
--The mailbox Export script:  Note we're setting the -sourcerootfolder to the "primary mailbox" under the searchfolder.  That's key to getting mail back to its proper location in the PST.
New-MailboxExportRequest -Mailbox -FilePath "\\FileServer\Path\Test User.pst" -SourceRootFolder "Search1\Test User-3\/31\/2015 5:24:20 PM\Primary Mailbox/" -name  "Test User"

Open in new window

--The re-import script is similar.
New-MailboximportRequest -Mailbox "Test User" -FilePath "\\FileServer\Path\Test User.pst" -Name "Test User"

Open in new window

We used excel to make the scripts, but the CSV with the values as columns can be used in PowerShell to script this as well.
Will SzymkowskiSenior Solution ArchitectCommented:
The Messaging Team Blog has written a script RecoverDeletedItems.PS1 script which will allow you to recover deleted content and restore items back into the original mailbox. Take a look at the link below for further details.

vpetersenAuthor Commented:
self resolved
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.