This article providers step by step instruction on how to restore individual mail items back to user mailboxes in Exchange 2010.
Similar articles are available for other versions of Exchange.
Before restoring user mailboxes, verify if Exchange native tools can be used to restore the items.
When a user deletes items from the Deleted Items default folder by using the Delete, Shift+Delete, or Empty Deleted Items Folder actions, the items are moved to the Recoverable Items\Deletions folder. The duration that deleted items remain in this folder is based on the deleted item retention settings configured for the mailbox database or the mailbox.
By default, deleted items are kept for the period of 14 days, and deleted mailboxes for 30 days.
Here is a list of Microsoft articles that will help you restore items if they are not purged from your mailbox database.
Exchange 2010 / 2013
Scenario: a user deleted a folder in his mailbox
User Billy has accidentally deleted his IMPORTANT folder, and by the time he discovered that folder is missing, the item had already been purged from the Recoverable Items storage container.
Here is screenshot of his original folder:
Steps to recover
1. Determine which database hosts user mailbox
We need to find out which mailbox database hosts Billy's mailbox. If your environment uses a single mailbox for all users, skip this step.
Run the following command in the Exchange Management Shell (Powershell)
Get-MailboxStatistics -identity billy | fl
2. Create a "Recovery Database" using the Exchange Management Shell (Powershell)
Create a Recovery Storage Group to use as temporary storage for our restored mailbox.
The disk where you create the Recovery Storage Group must have enough free space to accommodate the entire mailbox database.
For example, if your production database is 500GB, you must have at least 500GB of free space to restore the mailbox database to the Recovery Storage Group.
Create folders where the recovery database will reside. In our example, we will use "C:\EXCH-DATA\RDB1-DB\" and "C:\EXCH-DATA\RDB1-LOG".
Run the New-MailboxDatabase cmdlet with the following parameters:
- -EdbFilePath (the path to the restored mailbox database file)
- -LogFolderPath (the path to be used for transaction log files, which must be an empty folder)
- -Server (the server that the recovery is being performed on)
The full command for our example is:
New-MailboxDatabase -Recovery -Name RDB1 -Server EXCH2010 -EdbFilePath "C:\EXCH-DATA\RDB1-DB\RDB1.EDB" -LogFolderPath "C:\EXCH-DATA\RDB1-LOG"
3. Use ZCB/ESB to restore the mailbox database to the Recovery Database
Launch ZCB, and visit the Restore page. Select the backup run containing your mailbox database. Restore to the Recovery Database and enter the appropriate information.
Once restore begins, you will be taken to the Monitor page where you can track the progress of your restore.
4. Mount the Recovery Database
The Recovery Database can be mounted via the Exchange Management Console or via powershell.
To mount via the EMC:
To Mount via Powershell
Run this command. Be sure to use the name of your database. Our example database is RDB1.
5. Restoring Mailbox Items from a Recovery Database
Proceed with mailbox item restores once the mailbox database has been mounted. Use Powershell to see the available mailboxes to restore with this command:
Get-MailboxStatistics -Database RDB1
Restore Items into sub-folder of user Mailbox
It is possible to use the Restore-Mailbox cmdlet to restore items into a sub-folder.
If you want to perform more granular restore, such as restoring messages with a specific subject, please refer to the Restore-Mailbox cmdlet documentation here: Restore-Mailbox cmdlet - Exchange 2010.
The following command will restore the user's entire Inbox\Important folder to a sub-folder named "Restored".
Restore-Mailbox -Identity "Billy Gates" -RecoveryDatabase RDB1 -RecoveryMailbox "Billy Gates" -TargetFolder Restore -IncludeFolders \Inbox
6. Verify and move restored items to appropriate location
Use Outlook to view or move restored items to their Original Location. As you can see from the picture below, we can move "IMPORTANT" folder back to its original location under Inbox.
Alternative restore destinations
Outlook PST file
In some scenarios, you might want to get restored items in the form of PST file, rather then recover them directly to user mailbox. For example you need to recover emails of an employee who is not longer with your organization.
Create a temporary user with its own mailbox, recover email items to it, and then extract recovered content to PST file.
Create temporary User Mailbox
In our example, we call the temporary user "Billy Recovery", and give it the user name billyrec. You can choose any mailbox database.
Restore and mount a recovery database
Use steps 1 - 4 in the Steps to Recover section above to restore and mount a recovery database.
Recover mailbox items with Restore-Mailbox cmdlet
In this example, we use Restore-Mailbox cmdlet to restore the Inbox folder into the Restore folder of our temporary user "Billy Recovery". For more detail about performing more granular restore follow this link: Restore-Mailbox cmdlet - Exchange 2010.
Restore-Mailbox -Identity "Billy Recovery" -RecoveryDatabase RDB1 -RecoveryMailbox "Billy Gates" -TargetFolder Restore -IncludeFolders \Inbox
Extract the contents of the recovery mailbox to a PST folder
Create a network share where you planning to place extracted PST file. Make sure that "Exchange Trusted Subsystem" group has full permissions on the share.
You might need to assign Mailbox Import Export role to Exchange administrator's account, if that has not been done previously.
If the Exchange administrator does not have the Mailbox Import Export role, run the below command, and log on/off of the exchange server so that the role will be applied.
In this example, user is specified using domain name convention, where domain name is WQA1.local
New-ManagementRoleAssignment –Role “Mailbox Import Export” –User wqa1\Administrator
Run New-MailboxExportRequest cmdlet. More information about this cmdlet can be found here http://technet.microsoft.com/en-us/library/ff607299(v=exchg.141).aspx
New-MailboxExportRequest -Mailbox billyrec -FilePath \\exch2010\Recovered.PST\Billy.Recovered.pst
The export process can take some time if the database is large. You can check the progress of export task by piping to two cmdlets: Get-MailboxExportRequest and Get-MailboxExportRequestStatistics
Get-MailboxExportRequest | Get-MailboxExportRequestStatistics
Verify recovered content.
Once you get PST file, you can open it in Outlook to verify recovered content
Perform Cleanup Operations
Once the mailboxes have been recovered, it is a good idea to clean up any unnecessary databases, user accounts, and files.
- Dismount the recovery database and storage group. Delete files from database folders.
- If you used a temporary user for recovery, delete its mailbox and account in Active Directory, along with any associated files, like PSTs.