Blog

Script to search through Recoverable and Purged items and restore those

The purpose of this script is to find deleted messages in a specified user’s mailbox.

There are 3 levels (when configured) of Trash in a mailbox:

  • Level 1 – Deleted Items (e.g. 30 days)
  • Level 2 – Recoverable items (e.g. 15 days)
  • Level 3 – Purged items (e.g. 15 days)

Users usually know about the first two. Moreover, they can only work with the first two from both Outlook and OWA. Only admins have access to Purged items.

It makes sense to use this script in at least 2 cases:

  • A user is being terminated on bad terms, decided to permanently delete everything from both Deleted and Recoverable items.
  • A user deleted an email at some point, missed the first 30-day period, then missed the second 15-day period, and then wants to recover that email. If it’s less than 60 days (30+15+15) overall then that email can be restored.

The script finds and copies messages into IT HelpDesk mailbox – SearchForDeleted folder.

Don’t forget to replace helpdesk@contoso.com with an email address of your Help Desk or any other mailbox (!)

$email = Read-Host "Please provide the email address of the user to search through"

$answer = Read-Host "Are you looking to recover all deleted messages or a single one ( All / Some / N to cancel )"

While ("all","some","n" -notcontains $answer) {$answer = Read-Host "Are you looking to recover all deleted messages or a single one ( All / Some / N to cancel )"}

If ($answer -eq 'all') {
    Write-Host "Recovering all deleted messages to IT Help Desk - SearchForDeleted folder" 
    Search-Mailbox -Identity $email -TargetMailbox helpdesk@contoso.com -TargetFolder SearchForDeleted -LogLevel Full -SearchDumpsterOnly
}

If ($answer -eq 'some') {
    Write-Host "Either Sender's email or a Keyword must be provided"
    $sender = Read-Host "Sender's email"
    $keyword = Read-Host "Any keyword, please add an Asterisk if searching for a part of the word"
    
    If ($sender -eq '') {
        $search = $keyword
        $results = Search-Mailbox -Identity $email -SearchQuery $search -EstimateResultOnly -SearchDumpsterOnly
        $results
    }
    
    If ($keyword -eq '') {
        $search = "from:$sender"
        $results = Search-Mailbox -Identity $email -SearchQuery $search -EstimateResultOnly -SearchDumpsterOnly
        $results
    }

    ElseIf ($keyword -ne '' -and $sender -ne '') {
        $search = "from:$sender $keyword"
        $results = Search-Mailbox -Identity $email -SearchQuery $search -EstimateResultOnly -SearchDumpsterOnly
        $results
    }
    
    $answer1 = Read-Host "Given the estimate results, would you like to recover those messages to Help Desk - SearchForDeleted folder ( y / n )"

    While ("y","n" -notcontains $answer1) {$answer1 = Read-Host "Given the estimate results, would you like to recorer those messages to Help Desk - SearchForDeleted folder ( y / n )"}

    If ($answer1 -eq 'y') {
        Search-Mailbox -Identity $email -SearchQuery $search -TargetMailbox helpdesk@contoso.com -TargetFolder SearchForDeleted -LogLevel Full -SearchDumpsterOnly
    }
    ElseIf ($answer1 -eq 'n') {
	Remove-Variable * -ErrorAction SilentlyContinue
    }
}

ElseIf ($answer -eq 'n') {
    Remove-Variable * -ErrorAction SilentlyContinue
}
Tags: , , , , , ,

This Post Has One Comment

Leave a Reply