This article providers step by step instruction on how to restore individual mail items back to user mailbox in Exchange 2013
When a user deletes items from the Deleted Items default folder by using the Delete, Shift+Delete, or Empty Deleted Items Folder actions, the items are moved to the Recoverable Items\Deletions folder. The duration that deleted items remain in this folder is based on the deleted item retention settings configured for the mailbox database or the mailbox. By default, deleted items are kept for the period of 14 days, and deleted mailboxes for 30 days. Therefore, before proceeding with mailbox database restores, verify if items can be recovered by Exchange native tools.
Here is a list of Microsoft articles, that will help you restore items if they are not purged from your mailbox database
Exchange 2007 :
Exchange 2010 / 2013
Let's use for our example following scenario:
User Billy has accidentally deleted his IMPORTANT folder, and by the time he discovered that folder is missing, item has been already purged from Recoverable Items storage container. Here is screenshot of his original folder
In this scenario, we deleted "IMPORTANT" folder and purged "Deleted Items"
We need to find out which mailbox database hosts Billy's mailbox. If your environment uses a single mailbox for all users, skip this step.
Exchange Management Shell (Poweshell)
Get-MailboxStatistics -identity billy | fl
In this step, we need to create recovery database, which serves a purpose of temporary storage for our restored mailbox.
Make sure, that disk where you create recovery database, has enough free space to accommodate entire mailbox database. If you production database is 500Gb, you need same amount of space to restore a copy mailbox copy to recovery database
Run the New-MailboxDatabase cmdlet with the following parameters:
New-MailboxDatabase -Recovery -Name RDB1 -Server EXCH2010 -EdbFilePath "C:\EXCH-DATA\RDB1-DB\RDB1.EDB" -LogFolderPath "C:\EXCH-DATA\RDB1-LOG"
Lunch ZCB/ESB, select backup run containing your mailbox database, set appropriate options on Restore Tab.
Exchange Management Console
Now, when recovery database is mounted we can now proceed with mailbox item restores. You can use Get-MailboxStatistics see the available mailboxes to restore
Get-MailboxStatistics -Database RDB1
We will use Restore-Mailbox cmdlet to restore entire folder Inbox into Restore folder. If you want perform more granular restore, like specifying subject of the message for example, see more detailed information about Restore-Mailbox cmdlet - Exchange 2010
Restore-Mailbox -Identity "Billy Gates" -RecoveryDatabase RDB1 -RecoveryMailbox "Billy Gates" -TargetFolder Restore -IncludeFolders \Inbox
Use Outlook to view or move restored items to their Original Location. As you can see from the picture below, now we can move "IMPORTANT" folder back to its original location under Inbox.
In some scenarios, you might want to get restored items in the form of PST file, rather then recover them directly to user mailbox. For example you need to retract emails of the employee who is not longer with organization. In such case, you would want to create temporary user with exchange mailbox, recover email items to it, and then extract recovered content to PST file. Below is an example of how it can be achieved
In our example, we call new user "Billy Recovery", with user name billyrec. You can choose any mailbox database (in case you have multiple)
In this example we use Restore-Mailbox cmdlet to restore entire folder Inbox into Restore folder of our temporary user "Billy Recovery". For more detail about performing more granular restore follow this link: Restore-Mailbox cmdlet - Exchange 2010
Restore-Mailbox -Identity "Billy Recovery" -RecoveryDatabase RDB1 -RecoveryMailbox "Billy Gates" -TargetFolder Restore -IncludeFolders \Inbox
Create a network share where you planning to place extracted PST file. Make sure that "Exchange Trusted Subsystem" group has full permissions on the share.
You might need to assign Mailbox Import Export role to Exchange administrator's account, unless it is done already. See more info here: Error message when you run the New-MailboxExportRequest cmdlet in Exchange Server 2010 SP1 or Exchange Server 2010 SP2: "Couldn't find the Enterprise Organization container" . Therefore we run command below and log on/off to exchange server for the new role assignment to get applied to exchange administrator account.
In this example, user is specified using domain name convention, where domain name is WQA1.local
New-ManagementRoleAssignment –Role “Mailbox Import Export” –User wqa1\Administrator
Run New-MailboxExportRequest cmdlet. More information about this cmdlet can be found here http://technet.microsoft.com/en-us/library/ff607299(v=exchg.141).aspx
New-MailboxExportRequest -Mailbox billyrec -FilePath \\exch2010\Recovered.PST\Billy.Recovered.pst
If mailbox is large, export process can take some time. Hence, you can check the progress of export task by piping to 2 cmdlets: Get-MailboxExportRequest and the Get-MailboxExportRequestStatistics
Get-MailboxExportRequest | Get-MailboxExportRequestStatistics
Once you get PST file, you can open it in Outlook to verify recovered content