Restore deleted mail items to their original folder using PowerShell| The article series
The article series includes the following articles:
- Restore deleted mail items to their original folder using PowerShell – introduction | 1#3
- Display information about Deleted mail items using the PowerShell cmdlet Get-RecoverableItems |2#3
- Restoring Deleted mail items using the PowerShell cmdlet Restore-RecoverableItems |3#3
The purpose of the PowerShell cmdlet – Get-RecoverableItems is to help us to display (view or even export) information about deleted mail stored in Exchange mailbox.
As mentioned in the former article, the uniqueness of the PowerShell cmdlet – Get-RecoverableItems is, the ability to view info about “standard Deleted mail and in additional, Soft deleted mail items.
Quick reminder and reference
In the next article, we review the use of the PowerShell cmdlet – Restore-RecoverableItems that help us to restore deleted mail items of a specific Exchange mailbox.
In the context of the PowerShell cmdlets Get-RecoverableItems, the term “deleted mail items” refers to two types of deleted mail items:
- Standard Deleted items – the term “standard deleted mail items” is not a formal technical term, but instead, I term which I use for relating to mail items that are stored in the mailbox folder – “Deleted items” (the mailbox recycle bin).
- Soft Deleted mail items – mail items that were deleted from the mailbox recycle bin and classified as “Soft Deleted mail items.” These mail items are stored in the “Deletion” folder, a special hidden system folder, that is part of the “Recoverable item folder” space and store Soft Deleted mail items.
Display Deleted mail items | Filter by – Folder scope
In case that we use the PowerShell cmdlet Get-RecoverableItems as it is, without any parameters, the Restore-RecoverableItems display information about all deleted mail items, that are stored in one of the following mailbox folders:
- Deleted items (recycle bin) folder.
- Deletion folder – the special hidden folder that is part of the “Recoverable item folder” space and store Soft Deleted mail items.
PowerShell command example
Get-RecoverableItems Jeff
Using “Folder scope” for display information on specific types of deleted mail items
To be able to display information only about a specific type of deleted mail items,
we can use the parameter “SourceFolder.”
The structure of the PowerShell command is written as follows:
Get-RecoverableItems <mailbox> -SourceFolder <The mailbox folder >
Display Deleted mail items | Deleted mail items stored in the mailbox recycle bin folder.
To view\display only mail items that are stored in the Deleted items (recycle bin) folder, we can use the following syntax:
Get-RecoverableItems Jeff -SourceFolder DeletedItems
Display Deleted mail items | Soft deleted mail items
To display information only about Soft Deleted mail items, we can use the following syntax:
Get-RecoverableItems Jeff -SourceFolder RecoverableItems
Display Deleted mail items | Filter by – Date
To display Deleted mail items from a specific date range, we use the following 2 parameters:
- FilterStartTime
- FilterEndTime
PowerShell command syntax example:
Get-RecoverableItems Jeff -FilterStartTime "9/1/2018 12:00:00 AM" -FilterEndTime "9/1/2018 12:00:00 AM"
Display Deleted mail items | Filter by – E-mail message subject
To display deleted mail items that have a specific text string in their subject, we can use the parameter – SubjectContains
PowerShell command syntax example:
Get-RecoverableItems Jeff -SubjectContains "test"
Display Deleted mail items | Filter by – E-mail message type
Exchange mailbox serves as a container for various types of “mail items.”
For example, standard E-mail message, calendar meeting, task items and mail contact item.
When we ask to view deleted mail items, the PowerShell cmdlet
Get-RecoverableItems will display all the types of mail items that considered as “deleted mail items.”
In case that we need to define a search filter that looks for a specific type of deleted mail items, we can use the parameter “FilterItemType”.
The following table displays the 4 types of “mail item”:
| E-mail message | IPM.Note |
| Contact | IPM.Contact |
| Calendar item | IPM.Appointment |
| Task item | IPM.Task |
For example, in case that we want to display only deleted mail items that considered as “calendar mail items”, we can use the following syntax:
Get-RecoverableItems Jeff -FilterItemType IPM.Appointment
Display Deleted mail items | Filter by – Number of deleted mail items
By default, the PowerShell cmdlet Get-RecoverableItems display all the deleted mail items.
In case that we want to ask to display only a specific amount of deleted mail items, we can use the parameter – ResultSize
For example, we want to display only the last 5 mail items that classified as “Deleted mail items.”
Get-RecoverableItems Jeff -ResultSize 5
Count the number of deleted mail items
In case that we want to count the number of deleted mail items, we can use the following PowerShell syntax:
(Get-RecoverableItems Jeff).count
Additional PowerShell command syntax that we can use for counting the mail items is:
Get-RecoverableItems jeff | Measure-Object
Display Deleted mail items | Filter by – Last parent folder id
The term “Last parent folder identity” define the identity of the Exchange mailbox folder that hosts the mail items before the mail items were deleted.
The “Last parent folder identity” appears is a property named – LastParentFolderID
In case that we need to define a scenario in which we want to restore only specific deleted mail items which were located in a specific folder, we can use the parameter -LastParentFolderID
For example
Get-RecoverableItems Jeff -LastParentFolderID 9B52034A478A6141B401DF3BF7851B460000000015E0
Additional options for displaying output
Group by
In case that we want to display all the deleted mail items grouped by “mail type” such as – E-mail message mail items, calendar mail items and so on, we can use the following PowerShell syntax:
Get-RecoverableItems jeff | Format-list Subject,SourceFolde -Groupby itemclass
Export information
In case that you want to export information about all the deleted mail items of a specific Exchange mailbox, we can use the following PowerShell command syntax:
Get-RecoverableItems jeff | Export-csv c:\temp\2.csv
The next article in the current article series
It is important for us to know your opinion on this article
The post Display information about Deleted mail items using the PowerShell cmdlet Get-RecoverableItems | 2#3 appeared first on o365info.com.