troubleshooting Question

Restore Exchange 2013 items deleted with the Search-Mailbox command

Avatar of Bradley Fox
Bradley FoxFlag for United States of America asked on
3 Comments2 Solutions146 ViewsLast Modified:
I had a phishing email come in this morning and ran the following command against Exchange like I always do in this situation.
Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery 'From""' -DeleteContent

Unfortunately, I missed a colon after From and it deleted way more than just this one email from everyone's mailbox.  I know I should have used the -TargetMailbox command with this as not to lose data but I didn't.

Does anyone know of a way to recover the messages that were deleted with this command?  We do have a Barracuda message archiver that people can look in for their messages, but I'd really like to restore them to their mailbox.
Jason Crawford
Transport Ninja

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 2 Answers and 3 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 2 Answers and 3 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros