Table of Contents
Restoring Deleted Emails in Office 365 with PowerShell
“I’ve deleted an important email and need to get it back. Help!” As a Microsoft Office 365 admin, you’ve probably faced this situation often. You’ll start by looking in the usual places – the Deleted Items folder and then the Recoverable Items folder. However, 28 days have passed and the email is permanently deleted. PowerShell to the rescue! Microsoft Office 365 PowerShell is a powerful tool to recover deleted emails, particularly permanently deleted ones that cannot be retrieved from the Deleted Items folder or the Recoverable Items folder. Read on for step-by-step instructions and a video walkthrough to recover deleted emails using M365 (Microsoft Office 365) PowerShell.
Still within the 28-day timeframe? Check out our Ultimate Admin’s Guide to Recover Deleted Emails in Outlook with videos and instructions to recover deleted emails in Outlook using the Deleted Items folder, Recoverable Items folder, and by eDiscovery.
Video: How to Recover Deleted Emails Using M365 PowerShell
Microsoft Office 365 PowerShell Commands to Recover Deleted Emails
When an email is deleted, it first goes to the Deleted Items folder for 14 days and then to the Recoverable Items folder for another 14 days. After these 28 days have passed since the initial deletion, then only you, as the administrator, can restore these items using PowerShell. The administrator needs to run these PowerShell commands to restore deleted items from the “Recoverable Items”. Note that this is only valid within 14 days.
Step 1: Open Microsoft Office 365 PowerShell
Step 2: Connect to Exchange Online using cmdlet and enter your credentials
connect-ExchangeOnline
Step 3: Run the PowerShell Query
Run the cmdlet below whereby all deleted emails which contain “excited” in the subject line from the slava@demoppm4.onmicrosoft.com mailbox will be recovered to “One2 New Employee” user’s mailbox to the “MySearch” folder
Search-Mailbox "slava@demoppm4.onmicrosoft.com" -SearchDumpsterOnly -TargetMailbox "One2 New Employee" -TargetFolder "MySearch" -SearchQuery 'Subject:"excited"'
Where,
- Search-Mailbox: The email ID of the mailbox to be searched. Note that it is available only in the Mailbox Search or Mailbox Import Export roles, and these roles aren’t assigned to any role groups. To use this cmdlet, you need to add one or both of the roles to a role group.
- SearchDumpsterOnly: The SearchDumpsterOnly switch specifies that only the Recoverable Items folder of the specified mailbox is to be searched. You don’t need to specify a value with this switch.
- TargetMailbox: Enter the target mailbox email ID.
- TargetFolder: The TargetFolder is followed by the folder name in which search results are saved in the target mailbox.
Step 4: Check if the Command is Successful
As the result of the command, you will see the summary in PowerShell. In our case, it says that 1 email has been restored.
Go to destination mailbox/folder to check the recovered data
Something More Powerful Than PowerShell? Unlimited Point-in-time Recovery
Your organization pivots around Microsoft Outlook. Losing a critical email due to accidental deletion, loss of access because of a ransomware attack, bulk malicious deletion, or a mobile sync error that wipes out emails can be devastating. Unlimited point-in-time or granular recovery is critical to ensure seamless business continuity. Something only possible with third-party backup. Ensure guaranteed recoverability of your valuable Microsoft Office 365 data with CloudAlly Backup. CloudAlly’s enterprise-grade Microsoft Office 365 backup, automates backup and easy restore of Mail, Calendar, Contacts and Tasks, OneDrive/SharePoint, and Groups/Teams. From any point in time, at any granular level, and across any user – backup and recover Microsoft Outlook Email the easy way. Recover your deleted emails in Outlook without being constrained by time-bound limits and tedious native options.
Watch how easy it is to recover deleted Outlook emails with CloudAlly