Click here to monitor SSC
  • Av rating:
  • Total votes: 27
  • Total comments: 2
Elie Bou Issa

Single Item Recovery

22 January 2010

 One of the more obscure parts of Exchange Server is the Dumpster. This allows the recovery of one or more deleted emails, in much the same way as the recycle bin in Windows, even if the user has purged them. Although it is seen as an alternative to backup, or as a means to document retention, it really provides a separate function, undoing an accidental deletion. Elie Bou Issa explains how to configure deleted retention items and how to recover a purged item.

One of the daily tasks for an Exchange administrator is typically to recover deleted email. The recovery process used to be different depending on how the item was deleted. If the item is soft deleted or hard deleted, that would be an easy task to accomplish as long as the item is within the deleted item retention period. If the item is expired, the administrator would need to recover the item by restoring the appropriate backup.

In this article, we will discuss the Dumpster architecture, check how to configure single item recovery and show the needed steps to recover an item in Exchange 2010.

Dumpster architecture:

In Exchange 2003, the dumpster was simply a view which displayed the soft deleted and hard deleted items.

Users working on Microsoft Outlook 97 were limited to recovering soft deleted items for mail folders. Other folders would require at least Microsoft Outlook 2000. It was possible to recover hard deleted items as well but would require inserting in the registry, under the following path HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\ a DWORD key DumpsterAlwaysOn and setting the value data to 1.

This would allow the Recover Deleted Items folder to appear on any selected folder from Microsoft Outlook.

In Outlook Web Access, you could only easily view soft deleted items. A workaround to restore hard deleted items through OWA was to manually locate the folder and enter the required URL. The URL would look like:

http://exchangeserver/exchange/folder/?cmd=ShowDeleted

where folder is referring to the folder name the item was deleted from.

Exchange 2007 didn’t change much in the dumpster architecture. An improvement to the Outlook Web Access came with the release of the Exchange 2007 service pack 1 which allows the view of the Recover Deleted Items for all folders.

On the other hand, Microsoft Outlook 2007 will automatically provide the “Recover Deleted Items” functionality in mail folders

Taking a close look at the new architecture of the dumpster, we find that unlike previous versions, the dumpster in Exchange 2010 is displayed as a folder named Recoverable Items.

The new design gives the Recoverable Items folder the following benefits:

  • All items in the folder are indexed and can be searched using the Mailbox search feature from OWA or through discovery cmdlets.
  • Quota management for better security and size management.
  • All items in the folder can be moved through move requests.
  • The recoverable items folder has three sub-folders:
  • Deletions folder holds the items that have been soft deleted or hard deleted. Items residing in this folder are visible to the user through the “Recover Deleted Items” features in Microsoft Outlook or OWA. This folder architecture is mainly inherited from the previous version of dumpster; major changes remain in the creation of the versions and purges folder.
  • Versions folder holds the original and modified copy of an item. Different versions of a specific item can be found in this folder. This folder is hidden and not visible to the end user.
  • Purges folder holds the items that have been purged by the user. Items are removed from this folder when the retention period for the mailbox is exceeded.  This folder is hidden and not visible to the end user.

When performing a search against a mailbox, the Recoverable Items folder and the three sub-folders will be visable from the Discovery Search Mailbox as shown in the figure below:

Figure1.0: Recoverable Items folder

To view the folders through the Management Shell, run Get-MailboxFolderStatistics cmdlet as shown below:

Figure 1.1: Recoverable Items folder and its sub-folders

Configuring Item Recovery

In previous versions of Exchange, Deleted Item retention is configured either on the mailbox database level (or the Information Store in Exchange 2003) or on the Mailbox level.

By default, the retention period is set to 7 days in Exchange 2003 and to 14 days in Exchange 2007/2010. These values can be changed either through the Management Console or the Management Shell.

To change the default deleted item retention through EMC, go to Mailbox under Recipient Configuration, highlight the user mailbox, and click on Properties. Go to Mailbox Settings, highlight Storage Quotas and click on Properties.

Figure 1.2: Configure Deleted Item retention on the mailbox level

Uncheck the Use Mailbox database defaults and modify the number of days.

To perform the same operation in the Management Shell, run the below cmdlet:

Set-mailbox Mailbox –RetainDeletedItemsFor NbOfDays.00:00:00 –UseDatabaseRetentionDefaults $false

Note: An item will be un-recoverable if the retention period exceeds the defined retention period and if the “do not permanently delete items until you back up the database” is not set.

In Exchange 2010, additional settings were added that allow setting limits for the Recoverable Items folder.

Because the Dumpster quota is not related to the Mailbox quota, this feature will help limit the folder size for users with extended retention time.

Two mechanisms can be used to configure Single Item Recovery in Exchange 2010:

  • Time limited safeguarding of data where the items are stored in the Recoverable Items folder based on a predefined retention period. In this case, the retention period is set as described in Figure 1.2 (or the mailbox database defaults will apply if a specific value is not set for the mailbox).
  • Unlimited safeguarding of data - which is called legal hold - where Items in the recovery folder will never be purged. Retention period and quota limitation set on a “litigation hold” mailbox will be ignored. This would ensure that deleted mailbox items and record changes won’t be purged.

This feature can be enabled for users working with sensitive and confidential data and where the organization policy would require never deleting any item or allowing the end user to do so. A drawback of this is the increase in mailbox size which could result in performance issues related to mailbox searches.

To set a mailbox on a litigation hold, execute the below cmdlet:

Set-Mailbox EmailAccount – LitigationHoldEnabled $true

In both mechanisms, Single Item Recovery must be enabled. This must be performed using the Exchange Management Shell.

To enable Single Item Recovery for a mailbox, run the cmdlet shown in Figure 1.3

Figure 1.3: Enable Single Item Recovery

If you are running with a single site with no AD replication than the above warning can be ignored; otherwise single item recovery can take up to 60 minutes depending on Active Directory replication in your environment

To check if a mailbox has Single Item Recovery enabled, run the below cmdlet:

Figure 1.4: Get Mailbox status on Single Item Recovery

Dumpster v1.0 is still applicable in Exchange 2010, and enabling Single Item Recovery will fire the dumpster v2.0 functionality.

Recoverable Items folder limit:

The mailbox is not configured with any values; hence the mailbox database limit will be applied. Size limits can be changed through Management Shell as below:

Figure 1.5: Set and Check Recoverable Items Quota values

If the value set for the RecoverableItemsWarningQuota is exceeded, a warning event is entered in the event viewer.

The values for the recoverable items quotas are stored in Active Directory and can be seen in ADSIEDIT under the user properties. The values are:

msExchDumpsterQuota = Recoverable Item Quota

msExchDumspterWarningQuota = Recoverable Item Warning Quota

Recovering single item:

As in Exchange 2007, the end user has the option to recover a single item if it was soft deleted or hard deleted. That can be achieved from the end user’s Outlook as shown in the below figure:

Figure 1.6: Recover Soft/Hard Deleted Items

However, if an item is purged by the user, that item can still be recovered if Single Item Recovery has been properly configured on the users’ mailbox.

To perform a recovery for a specific item from the Purges folder, the below steps need to be followed:

  1. Locate and extract the targeted item to the Discovery Mailbox:
    1. Open the Exchange Control Panel, select Reporting and click on Mailbox Searches
    2. Click on New to create a new search
    3. Fill in criteria as it will help you narrow your search and make it simpler
      1. Under Keywords, write any keyword that can be included in the item you want to search
      2. Under Messages To and From Specific E-mail Addresses, add the email address the message was sent to.
      3. Under Mailboxes to Search, select All Mailboxes
      4. Under Search Name and Storage Location, type the name of your search, and browse to select the Discovery Search Mailbox

Figure 1.7: Perform Recovery on purged item

In order to perform a mailbox search, the user performing this task must be a member of the Discovery Management role.

  1. Browse to the Discovery Mailbox to validate the item to be recovered:

    Note: In order to proceed with this step, you need to have access to the Discovery mailbox

    1. From the Exchange control panel, click to open other mailbox
    2. In the select mailbox area, type Discovery Mailbox, and click to open
    3. As you can see in the figure 1.8, the item to be recovered has been expanded to the Discovery mailbox inbox and specifically, to a folder holding the user’s mailbox name, followed by a folder named Primary Mailbox as the item exist in the Primary Mailbox of the user.

As you notice in Figure 1.8, only Purges folder is appearing from the Recoverable Items folder; which means that the item is in its original state and doesn’t have versions.

Figure 1.8: Validating the item from the purges folder

Single Item Recovery is applicable on Personal Archive and when leveraging a search against an item purged by user, the recovery folders will look as the below figure:

Figure1.9: Archive Mailbox

It is worth mentioning that the archive mailbox is considered a second mailbox integrated with the primary mailbox, hence it has a separate “Recoverable Items” folder.

Now that we have validated the item to recover, we can either forward the item to the specific recipient or run an export mailbox cmdlet.

  1. Export the recovered item:

    1. You can drag and drop the recovered item into a higher level folder in order to make the export cmdlet shorter.
    2. The item is dragged to the Recovered folder.
    3. Run the below cmdlet to export the item to the user’s mailbox:

      Export-Mailbox –Identity “Discovery Search Mailbox” –IncludeFolders \Recovered –TargetMailbox Elie –TargetFolder targetedfolder

Summary:

Single Item Recovery covers many aspects. From the compliance perspective, single item recovery guarantees that no item can be deleted or completely removed from the end user’s side. From a security perspective, Single Item Recovery increase data security and data protection from any misuse of data. Operation wise, single item recovery will lower the effort and time spent on backup from the exchange administrator and will facilitates the restore or recovery of a single or multiple items.

In this article, we looked at the dumpster architecture in Exchange 2003 and its subsequent versions. Then, we spoke on how to configure deleted retention items and finally, we’ve showed the required steps to recover a purged item.

A question to consider is whether Single Item Recovery in an organization can be a replacement for the Exchange backup.

The Exchange team came up with a small formula where they calculate the needed quota per mailbox for a single item recovery enabled mailbox. The result appeared to be an addition of 350MB for an approximate user who send/receive around 100 emails per regular working day and for the period of three months. Definitely, the proper size will differ based on the organization backup policy and the retention period for the backup. That might not be a good backup solution for organization that retain offsite backup.

Finally, it is worth trying Single Item Recovery even if you are highly satisfied with your current Exchange backup. You can still enable this feature for selective mailboxes.

References:

http://msexchangeteam.com/archive/2009/09/25/452632.aspx

Elie Bou Issa

Author profile:

Following his graduate studies in Computer Science, Elie has garnered more than six years of experience in this field. His experience encompasses various facets of the IT industry, and the handling of a wide range of software solutions, including Exchange/Active Directory and other Microsoft platforms, such as Windows Server, SCCM, and SCOM (to name just a few). In addition to this extensive experience, He is an MCT, and MCITP in Enterprise Messaging Administrator, Enterprise Administrator and Server Administrator, as well as a MCTS in Exchange Server 2010, SCCM/SCOM, Business Desktop Deployment and Microsoft Forefront Client and Server, Configuration.

You should follow him on twitter here

Search for other articles by Elie Bou Issa

Rate this article:   Avg rating: from a total of 27 votes.


Poor

OK

Good

Great

Must read
Have Your Say
Do you have an opinion on this article? Then add your comment below:
You must be logged in to post to this forum

Click here to log in.


Subject: Re: Single Item Recovery
Posted by: luisbob (view profile)
Posted on: Tuesday, August 09, 2011 at 10:41 PM
Message: Thanks for this excellent article. The Export_Mailbox CmdLet is really a great utility to handle many issues in Exchange Server. There are also some good third party tools available in the market to recover data from Exchange server. One of such tool is Stellar Phoenix Exchange Server Recovery software which is able to recover data from all instances of corruption.For more information, please visit here: http://www.stellarinfo.com/edb-exchange-server-recovery.htm

Subject: recover deleted maibox in exchange 2010
Posted by: tawazzile (view profile)
Posted on: Sunday, October 13, 2013 at 4:11 AM
Message: How do I recover deleted mailbox in exchange 2010

 

Top Rated

Migrating to Microsoft BPOS - Part II
 In his last article, Johan gave us a crystal clear guide to preparing to migrate from an on-premises... Read more...

Emulating the Exchange 2003 RUS for Out-of-Band Mailbox Provisioning in Exchange 2007
 Exchange's Recipient Update Service was important in Exchange 2000 or 2003 in order to complete the... Read more...

The Postmasters
 The Exchange Team introduces themselves, and keeps you up-to-date Read more...

For this Exchange Server Archiver, “Transparency” Fits
 Sometimes, it is a great relief when a user of your software gives it a tough test and then reports... Read more...

Hunting in Packs, Seamless-ness and Happy Holidays
 I attended DevConnections (Exchange) last month and was blown away by the technical talks. Speakers... Read more...

Most Viewed

Upgrade Exchange 2003 to Exchange 2010
  In this article, the first of two in which Jaap describes how to move from Exchange Server 2003... Read more...

Upgrade Exchange 2003 to Exchange 2010 - Part II
 In Jaap's second article on upgrading straight from Exchange Server 2003 to 2010, he explains how to... Read more...

Goodbye Exchange ExMerge, Hello Export-Mailbox
 ExMerge was a great way of exporting a mailbox to an Exchange PST file, or for removing all occurences... Read more...

Exchange E-mail Addresses and the Outlook Address Cache
 Because Exchange auto-complete cache uses X.500 addresses for e-mail sent to addresses within the... Read more...

Using Exchange 2007 for Resource Booking
 The process of booking various resources to go with a meeting room just got a whole lot easier with... Read more...

Why Join

Over 400,000 Microsoft professionals subscribe to the Simple-Talk technical journal. Join today, it's fast, simple, free and secure.