Recover deleted items from Exchange Dumpster

Read time 4 minutes

Accidental deletion of Exchange server mailbox items is an unwanted situation which Exchange Administrators have to face very often. A user may intentionally or unintentionally delete a message that was useful, and later gets to know that something terrible has happened. Microsoft has taken care of every possibility, and that’s why there are some remarkable features for recovering deleted items.

Exchange Server and Exchange Online utilizes the Recoverable Items folder to protect data from accidental or malicious deletion. This Recoverable Items folder, previously known as Dumpster, is the place where you need to look for accidentally deleted items. Dumpster acts as a place where deleted items are placed before they get permanently deleted from the server. Here these items are kept till the retention period (14 days by default) expires.

Recoverable items folder post deletion

Seeing a mailbox, we can understand it is arranged in a tree structure. However, the Exchange Server organizes the user mailbox in two subtrees –the IPM (interpersonal messaging) sub-tree, and the Non-IPM Subtree. IPM subtree consists of all the visible folders such as Inbox, Outbox, Contacts, Sent items, etc. On the other hand, non-IPM subtree is used to save the hidden internal data, user information, preferences, etc. The Dumpster (Recoverable Items folder) is saved in the non-IPM subtree of the mailboxes. It is invisible to the user, and you cannot manage it from the Exchange Admin Center.

There are several features which use the dumpster folder:

• Single item recovery
• deleted item recovery
• In-place hold
• Litigation hold
• Mailbox audit logging
• Calendar logging

All these features use the dumpster folder to save the following types of subfolders –

• Deletions: The folder is used to save the items removed from the Deleted Items folder.
• Versions: This folder saves the original and copies of the deleted items. It is applicable when an In-Place Hold or Litigation Hold is enabled.
• Purges: It saves all the hard-deleted items. It is applicable when Litigation Hold or Single item recovery is enabled.
• Audits: As the name suggests, the Audits subfolder saves the audit log entries when the mailbox audit logging is enabled.
• DiscoveryHolds: This folder works when the In-Place Hold is enabled, and the item is hard deleted.
• Calendar logging: As the name suggests, the subfolder saves the calendar changes present in the mailbox.

The hard-deleted items are not visible to the user, so you need to use the Exchange Management Shell to complete the recovery procedure. Here are some prerequisites which you should take care of before starting the method:

• Only the administrator with complete rights over the mailbox can finish the procedure.
• The administrator should search for the deleted items within the retention period set in the Exchange Server.
• Single item recovery feature should be in enable state for the mailbox whose data you want to restore. By default; the individual item recovery option is disabled in the Exchange Server when the mailbox is created.

How to access the Exchange Recoverable Items folder?

Make sure you have the necessary permissions to get access to the Exchange Dumpster. Here are the steps that guides you how to get access to the Dumpster in Exchange Server:

1. Open Outlook and go to the folder where deleted items are placed.
2. Right-click the folder and select Recover Deleted Items.
3. You can see all the deleted items from the folder in a new window.
4. Select the items you want to recover.
5. Click “Recover Selected Items” to recover items.
6. This will recover the deleted items back to the original location.

Steps to recover deleted items from Exchange Dumpster

Here is a comprehensive process to help you recover deleted items from Exchange dumpster or Recoverable Items folder:

1. Search for deleted items: The first step is to search for the items and save it at a target mailbox. After a successful search, you can restore the items to their original mailbox.
   Run the command based on the following example:
   Search-Mailbox “MailboxName” -SearchQuery “from:’Sender’ AND keyword” -TargetMailbox “TargetMailbox” -TargetFolder “FolderName” -LogLevel Full

   After running the command, you can go to the target folder and see the item there. If the command runs perfectly, then the item would be there.

2. Restore the searched item: After searching the item, you can easily restore the item using the following command –
   Search-Mailbox “MailboxName” -SearchQuery “from:’Sender’ AND keyword” -TargetMailbox “TargetMailboxName” -TargetFolder “FolderName” -LogLevel Full -DeleteContent

   After running the command, the item will be saved to the destination folder and deleted from the source mailbox.

Recover deleted items using Exchange Server Recovery tool

You should know the specific mailbox, the name of the item, and a particular keyword to find and recover the deleted item. It is not always easy to recover the item using the manual method, so using a third-party application seems the most reliable solution to look upon.
Kernel for Exchange Server is a highly efficient Exchange Recovery software created to retrieve the deleted and inaccessible items from the Exchange database. It can repair corrupt exchange database and lets you access the data from the hidden folders like a dumpster and allows you to save it.

Conclusion

After getting the complete information about the process of recovering the deleted items from Exchange dumpster, you would know that the Exchange Admin Center is not capable of recovering the items. You can only use the Exchange Management Shell to search and retrieve the object. In such cases, you can choose a suitable alternative like Kernel for Exchange Server, a professional tool that helps to recover deleted or inaccessible items from Exchange mailboxes.