Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Next »


This article providers step by step instruction on how to restore individual mail items back to user mailboxes in Exchange 2013.


Before restoring user mailboxes, verify if Exchange native tools can be used to restore the items.

When a user deletes items from the Deleted Items default folder by using the Delete, Shift+Delete, or Empty Deleted Items Folder actions, the items are moved to the Recoverable Items\Deletions folder. The duration that deleted items remain in this folder is based on the deleted item retention settings configured for the mailbox database or the mailbox.

By default, deleted items are kept for the period of 14 days, and deleted mailboxes for 30 days.

Here is a list of Microsoft articles that will help you restore items if they are not purged from your mailbox database.

Exchange 2010 / 2013

Scenario: user deleted folder in his mailbox

Let's use for our example following scenario: 

User Billy has accidentally deleted his IMPORTANT folder, and by the time he discovered that folder is missing, item has been already purged from Recoverable Items storage container. Here is screenshot of his original folder

In this scenario, we deleted "IMPORTANT" folder and purged "Deleted Items"

Steps to recover

1. Determine which database hosts user mailbox

We need to find out which mailbox database hosts Billy's mailbox. If your environment uses a single mailbox for all users, skip this step.

Exchange Management Shell (Poweshell)


Get-MailboxStatistics -identity billy | fl



2. Create "Recovery Database" using Exchange Management Shell (Powershell)

In this step, we need to create recovery database, which serves a purpose of temporary storage for our restored mailbox. 

(warning)  Make sure, that disk where you create recovery database, has enough free space to accommodate entire mailbox database. If you production database is 500Gb, you need same amount of space to restore a copy mailbox copy to recovery database 

 Create folders where recovery database will reside, in our case these are "C:\EXCH-DATA\RDB1-DB\" and "C:\EXCH-DATA\RDB1-LOG"

 Run the New-MailboxDatabase cmdlet with the following parameters:

  • -EdbFilePath (the path to the restored mailbox database file)
  • -LogFolderPath (the path to be used for transaction log files, which must be an empty folder)
  • -Server (the server that the recovery is being performed on)


 You also will need to restart Information store after adding recovery database



New-MailboxDatabase -Recovery -Name RDB1 -Server EXCH2013 -EdbFilePath "C:\EXCH-DATA\RDB1-DB\RDB1.EDB" -LogFolderPath "C:\EXCH-DATA\RDB1-LOG"

net stop "Microsoft Exchange Information Store"
net start "Microsoft Exchange Information Store"




3. Use ZCB/ESB to restore mailbox to Recovery Database

Lunch ZCB/ESB, select backup run containing your mailbox database, set appropriate options on Restore Tab. 

4. Mount Recovery Database



Mount-Database RDB1

5. Restoring Mailbox Items from a Recovery Database

Now, when recovery database is mounted we can now proceed with mailbox item restores.  You can use Get-MailboxStatistics see the available mailboxes to restore


Get-MailboxStatistics -Database RDB1


Restore Items into sub-folder of user Mailbox 

We will use New-MailboxRestoreRequest cmdlet to restore mailbox into Restore folder. If you want perform more granular restore, like specifying subject of the message for example, see more detailed information about New-MailboxRestoreRequest


New-MailboxRestoreRequest -SourceDatabase RDB1 -SourceStoreMailbox "Billy Gates" -TargetMailbox billy -TargetRootFolder Restore

You can pipe 2 cmdlets below to get status of you restore request


Get-MailboxRestoreRequest | Get-MailboxRestoreRequestStatistics

6. Verify restored items and move them to appropriate location

Use Outlook to view or move restored items to their Original Location. As you can see from the picture below, now we can move "IMPORTANT" folder back to its original location under Inbox. 

7. Alternative restore destination - Outlook PST file

In some scenarios, you might want to get restored items in the form of PST file, rather then recover them directly to user mailbox. For example you need to retract emails of the employee who is not longer with organization. In such case, you would want to create temporary user with exchange mailbox, recover email items to it, and then extract recovered content to PST file. Below is an example of how it can be achieved

A. Create temporary new User Mailbox for temp New User

In our example, we call new user "Billy Recovery", with user name billyrec. You can choose any mailbox database (in case you have multiple)

B. Use procedures described in Steps 1 - 4 to have recovery database mounted

C. Recover mailbox items with Restore-Mailbox cmdlet 

In this example we use New-MailboxRestoreRequest cmdlet to restore entire mailbox to our temporary user "Billy Recovery". For more detail about performing more granular restore follow this link: New-MailboxRestoreRequest



New-MailboxRestoreRequest -SourceDatabase RDB1 -SourceStoreMailbox "Billy Gates" -TargetMailbox billyrec@wqa5.local -AllowLegacyDNMismatch

D. Extract the contents of the recovery mailbox to a PST folder 

Create a network share where you planning to place extracted PST file. Make sure that "Exchange Trusted Subsystem" group has full permissions on the share. 



You might need to assign Mailbox Import Export role to Exchange administrator's account, unless it is done already. See more info here: Error message when you run the New-MailboxExportRequest cmdlet in Exchange Server 2010 SP1 or Exchange Server 2010 SP2: "Couldn't find the Enterprise Organization container" Therefore we run command below and log on/off to exchange server for the new role assignment to get applied to exchange administrator account. 

In this example, user is specified using domain name convention, where domain name is WQA5.local


New-ManagementRoleAssignment –Role “Mailbox Import Export” –User wqa5\Administrator


Run New-MailboxExportRequest cmdlet. More information about this cmdlet can be found here


New-MailboxExportRequest -Mailbox billyrec -FilePath \\exch2013\Recovered.PST\Billy.Recovered.pst

If mailbox is large, export process can take some time. Hence, you can check the progress of export task by piping to 2 cmdlets: Get-MailboxExportRequest and the Get-MailboxExportRequestStatistics


Get-MailboxExportRequest | Get-MailboxExportRequestStatistics


E. Verify recovered content.

Once you get PST file, you can open it in Outlook to verify recovered content

8. Perform cleanup operations

  • dismount recovery database and delete files from database folders
  • if you used temporary user for recovery, delete its mailbox and account in AD and associated files, like PST. 


  • No labels