Perform Single Item Recovery

Applies to: Exchange Server 2010 SP2

Topic Last Modified: 2012-07-23

Single item recovery provides an additional layer of protection so that you can recover items accidentally deleted by a user or by automated processes such as the Managed Folder Assistant. Single item recovery simplifies recovery and reduces recovery time because you can recover items without recovering an entire mailbox or mailbox database from backup media.

Note:

In addition to using this procedure to search for and recover deleted items (which are moved to the Recoverable Items\Purges folder if either single item recovery or litigation hold is enabled), you can also use this procedure to search for items residing in other folders in the mailbox and to delete items from the source mailbox (also known assearch and destroy). For details, see Use Mailbox Search to Delete Messages.

The method you use to search for and recover missing items depends on the client access license (CAL) for the mailbox you're searching. If the mailbox has an enterprise CAL, you can use the Multi-Mailbox Search feature in the Exchange Control Panel (ECP) or the New-MailboxSearch cmdlet in the Shell. These features also allow you to search multiple mailboxes simultaneously.

You can also use the Search-Mailbox cmdlet in the Shell to search for and recover missing items. If the mailbox has a standard CAL, this is the only method you can use. If you use this cmdlet, you can search only one mailbox at a time.

The following flowchart illustrates the different methods available for performing single item recovery.

To search for and recover items, you must have the following information:

• Source mailbox   This is the mailbox being searched.
• Target mailbox   This is the discovery mailbox in which messages will be recovered. Exchange Setup creates a default discovery mailbox. If required, you can create additional discovery mailboxes. For details, see Create a Discovery Mailbox.
  

  Note:
  When using the Search-Mailbox cmdlet, you can also specify a target mailbox that isn't a discovery mailbox. However, you can't specify the same mailbox as the source and target mailbox.

• Search criteria   Criteria include sender or recipient, or keywords (words or phrases) in the message.

The process consists of two steps:

1. Search   Searching for the missing items and recovering them to a discovery mailbox. 
2. Restore   Restoring the items to the user's mailbox or a .pst file.

Looking for other management tasks related to recoverable items? Check out Managing Recoverable Items.

Prerequisites

---

Before the item you want to recover is deleted, single item recovery must be enabled for a mailbox. For details, see Enable Single Item Recovery for a Mailbox.

Step 1: Search for and recover missing items

---

You need to be assigned permissions before you can perform this procedure. To see what permissions you need, see the "Multi-Mailbox Search" entry in the Messaging Policy and Compliance Permissions topic.

Note:
You can't use the EMC to search for and recover missing items.

The first step in the recovery process is to search for messages in the source mailbox. Use one of the following methods to search a user mailbox and copy messages to a discovery mailbox.

Use the Shell

---

This example searches for messages in April Stewart's mailbox that meet the following criteria:

• Sender: Ken Kwok
• Keyword: Seattle

Search-Mailbox "April Stewart" -SearchQuery "from:'Ken Kwok' AND seattle" -TargetMailbox "Discovery Search Mailbox" -TargetFolder "April Stewart Recovery" -LogLevel Full

Note:
When using the Search-Mailbox cmdlet, you can scope the search by using the SearchQuery parameter to specify a query formatted using Advanced Query Syntax (AQS). You can also use the  SearchDumpsterOnly switch to search only items in the dumpster.

For detailed syntax and parameter information, see Search-Mailbox.

Use Multi-Mailbox Search in the ECP

---

For details about how to perform a Multi-Mailbox Search in the ECP, see Multi-Mailbox Searches.

Step 2: Restore recovered items

---

You need to be assigned permissions before you can perform this procedure. To see what permissions you need, see the "Multi-Mailbox Search" entry in the Messaging Policy and Compliance Permissions topic.

Note:
You can't use the EMC to restore recovered items.

After messages have been recovered to a discovery mailbox, you can restore them to the user's mailbox by using the Search-Mailbox cmdlet. You can also use the New-MailboxExportRequest and New-MailboxImportRequest cmdlets to export the messages to or import the messages from a .pst file.

Use the Shell to restore messages

---

This example restores messages to April Stewart's mailbox and deletes them from the Discovery Search Mailbox.

Search-Mailbox "Discovery Search Mailbox" -SearchQuery "from:'Ken Kwok' AND seattle" -TargetMailbox "April Stewart" -TargetFolder "Recovered Messages" -LogLevel Full -DeleteContent

For detailed syntax and parameter information, see Search-Mailbox.

Use the Shell to export and import messages from a .pst file

---

In Microsoft Exchange Server 2010 Service Pack 1 (SP1), you can export messages from and import messages to .pst files without requiring the installation of Microsoft Outlook. To learn more about mailbox import and export, see Understanding Mailbox Import and Export Requests.

This example uses the following settings to export messages from the folder April Stewart Recovery in the Discovery Search Mailbox to a .pst file:

• Mailbox   Discovery Search Mailbox
• Source folder   April Stewart Recovery
• ContentFilter   april travel plans
• PST file path   \\MYSERVER\HelpDeskPst\AprilStewartRecovery.pst

New-MailboxExportRequest -Mailbox "Discovery Search Mailbox" -SourceRootFolder "April Stewart Recovery" -ContentFilter {Subject -eq "april travel plans"} -FilePath \\MYSERVER\HelpDeskPst\AprilStewartRecovery.pst

For detailed syntax and parameter information, see New-MailboxExportRequest.

This example uses the following settings to import messages from a .pst file to the folder Recovered By Helpdesk in April Stewart's mailbox:

• Mailbox   April Stewart
• Target folder   Recovered By Helpdesk
• PST file path   \\MYSERVER\HelpDeskPst\AprilStewartRecovery.pst

New-MailboxImportRequest -Mailbox "April Stewart" -TargetRootFolder "Recovered By Helpdesk" -FilePath \\MYSERVER\HelpDeskPst\AprilStewartRecovery.pst