This article providers step by step instruction on how to restore individual mail items back to user mailboxes in Exchange 2007.
Similar articles are available for other versions of Exchange.
Before restoring user mailboxes, verify if Exchange native tools can be used to restore the items.
When a user deletes items from the Deleted Items default folder by using the Delete, Shift+Delete, or Empty Deleted Items Folder actions, the items are moved to the Recoverable Items\Deletions folder. The duration that deleted items remain in this folder is based on the deleted item retention settings configured for the mailbox database or the mailbox.
By default, deleted items are kept for the period of 14 days, and deleted mailboxes for 30 days.
Here is a list of Microsoft articles that will help you restore items if they are not purged from your mailbox database.
User Billy has accidentally deleted his IMPORTANT folder, and by the time he discovered that folder is missing, the item had already been purged from the Recoverable Items storage container.
Here is screenshot of his original folder:
We need to find out which mailbox database hosts Billy's mailbox. If your environment uses a single mailbox for all users, skip this step.
Run the following command in the Exchange Management Shell (Powershell)
Get-MailboxStatistics -identity billy | fl
A Recovery Storage Group will be used as temporary storage for our restored mailbox.
The disk where you create the Recovery Storage Group must have enough free space to accommodate the entire mailbox database.
For example, if your production database is 500GB, you must have at least 500GB of free space to restore the mailbox database to the Recovery Storage Group.
Open the Exchange Management Console (EMC). In the Toolbox node, click on Database Recovery Management.
Type the names of your Exchange server and Domain Controller.
In Manage Recovery Storage Group, click on Create a Recovery Storage Group
Select the Storage Group that you want to restore from.
Choose the location of the original Storage Group.
Launch ZCB, and visit the Restore page. Select the backup run containing your mailbox database. Restore to the Recovery Storage group and enter the appropriate information.
Once restore begins, you will be taken to the Monitor page where you can track the progress of your restore.
In the EMC, select "Mount or dismount databases in the recovery storage group".
Select your mailbox database and mount it.
In Manager Recovery Storage group, select "Merge or copy mailbox content".
Select the restored mailbox database, and click "Gather merge information".
A list of available mailboxes will be displayed. Make sure you have only selected the mailbox that you wish to recover items for, then click on “Perform merge actions”.
The items will be visible in the end user’s mailbox after the merge has completed!
It is possible to use the Restore-Mailbox cmdlet to restore items into a sub-folder.
If you want perform more granular restores, like specifying subject of the message for example, see more detailed information about Restore-Mailbox cmdlet.
The following command will restore the user's entire Inbox\Important folder to a sub-folder named "Restored".
restore-mailbox -RSGMailBox "Billy Gates" -RSGDatabase "RSG1\2NDMailbox" -id "billy" -TargetFolder "Restored" -IncludeFolders \Inbox\Important
Verify results in Outlook
In some scenarios, you might want to get restored items in the form of PST file, rather then recover them directly to user mailbox. For example you need to recover emails of an employee who is not longer with your organization.
Create a temporary user with its own mailbox, recover email items to it, and then extract recovered content to PST file.
The following Microsoft article will help you to export a mailbox to a PST file: How to Export and Import mailboxes to PST files in Exchange 2007 SP1
Once the mailboxes have been recovered, it is a good idea to clean up any unnecessary databases, user accounts, and files.