PowerShell – How to recover deleted emails and items using Windows PowerShell

Occasionally accidents happen and important emails or things like calendar events get deleted. If you are unlucky you won’t be able to recover the deleted items the easy way over Microsoft Exchange server and will have to use PowerShell. Below are the steps to take to do this:

1. Make Sure you are a member of the Discover Management Role Group Before you can recover the deleted item, you need to be a member of the Discover Management Role Group (DMRG). This will allow you to search for messages across multiple mailboxes in your organization. If you are not a member of the DMRG then follow this link that will show you steps to assign yourself that role:

 

1. Startup PowerShell and put in your credentials, where you’re getting the sessions from and importing The next thing to do is start up PowerShell. Type in the code below:

 

$cred = Get-Credential This get the credentials for the exchange server.$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $cred -Authentication Basic –AllowRedirection 

 

This sets up a connections with the exchange server Import-PSSession $session This will import the sessions.

 

1. Search for and recover the email Now that PowerShell is setup we can move onto recovering the deleted item. Note: items in square brackets [example] are to be replaced by your requirements.To retrieve a single item follow these steps: First you need to search for the email:

 

search-Mailbox [user] -SearchDumpsterOnly -SearchQuery [search query] -TargetMailbox “Discovery Search Mailbox” -TargetFolder [search name] -LogLevel Full 

 

Once you’ve found the item you can recover it:

 

Search-Mailbox “Discovery Search Mailbox” -SearchQuery [search query] -TargetMailbox [user] -TargetFolder inbox  

 

If you wish to recover all permantely deleted items from the purged items folder run this line of code:

 

Search-Mailbox user@domain.com -SearchDumpsterOnly -TargetMailbox “Discovery Search Mailbox” -TargetFolder RecoveredItems -LogLevel Full