If you would like to read the other parts in this article series please go to:
Introduction
Single Item Recovery is a powerful feature in Exchange 2010 that essentially allows you to recover individual items without having to restore from a point-in-time backup. Additionally, Single Item Recovery is part of Exchange 2010’s Native Data Protection concept, whereby you can use features found within Exchange to protect mailbox data without the need to rely on Volume Shadow Copy Service (VSS) backups. This article will be focusing solely on Single Item Recovery; it is important to point out that there are other additional features of Exchange 2010 that must be considered when looking to implement Exchange Native Data Protection and these are not going to be covered in this article. However, by the end of this article you will hopefully have a deeper understanding of the Single Item Recovery feature and begin to appreciate this useful feature.
Why Single Item Recovery?
Let’s first discuss why there is a need for Single Item Recovery. Take the simple case where a user has mistakenly deleted an item from their mailbox and requires it to be restored. Single Item Recovery allows for this item restoration without the need to restore from a point-in-time backup. If you have been using Exchange for a while and have administered previous versions, you might well be thinking at the moment that the feature known as deleted item recovery, or the dumpster, found in previous versions of Exchange has already allowed this form of recovery to happen in the past. While this is true, Single Item Recovery in Exchange 2010 improves on the deleted item recovery feature and this will become apparent as this article unfolds.
The dumpster in earlier versions of Exchange was simple to understand. For example, consider a user who deleted a message from the Inbox folder of their mailbox. Assuming that user did not press the shift key while deleting the message, that message was then placed into the Deleted Items folder and from there, when the user purged the Deleted Items folder, the message was placed into the dumpster. Therefore, although the message was effectively gone from that user’s mailbox, it could still be recovered by the user as a self-service option as long as the user did this within a certain number of days. The administrator controlled how long items remained within the dumpster, with the specific number of days depending on the business requirements. To view and recover one or more items from the dumpster, the user could simply choose the Recover Deleted Items option within Outlook resulting in the window shown in Figure 1-1. Since the message was effectively no longer a part of the user’s mailbox, the dumpster contents did not count towards the overall mailbox quota which naturally had benefits for the user.
Figure 1-1: The Recover Deleted Items Window
Despite its usefulness, the dumpster also had a number of limitations. For example, one of the limitations of deleted item recovery was that the contents of the dumpster did not move with the mailbox during a mailbox move. It was therefore quite common on migration projects for a recently migrated user to attempt the recovery of an individual item that they knew existed in the dumpster before the mailbox move, only to find the entire contents of the dumpster window empty after the move. This was frustrating for the end-user and therefore it was important to communicate this limitation to the users during the project, before their mailboxes were moved. Additionally, a user had to ensure that the recovery operation was tried within the administrator-defined number of days, otherwise those items older than this number of days were purged from the dumpster. The only way to retrieve those items at that point was by restoring from a point-in-time backup.
Also, you can see from Figure 1-1 the ‘X’ button on the toolbar. This allows the user to purge the selected items from the dumpster, again resulting in the need to restore from a point-in-time backup if those items were then needed. Since the user had full control of their mailbox, it was possible to delete items maliciously as well as in error.
You may see the term dumpster 2.0 in relation to Single Item Recovery. This is because with the introduction of Single Item Recovery, we now consider the original version of the dumpster to be dumpster 1.0, with the new version known as dumpster 2.0.
The Recoverable Items Folder
The main component to Single Item Recovery is the Recoverable Items folder that exists within a mailbox. The Recoverable Items folder is a special folder that is not visible from within Outlook, since it resides in the non-IPM subtree of the mailbox and the non-IPM subtree is not exposed within Outlook. The Recoverable Items folder contains three sub-folders called Deletions, Versions and Purges. Figure 1-2 shows these folders as seen from the MFCMapi tool. We will be looking at this tool in more depth and further understanding these folders later in this article, covering topics such as how you can examine the contents of the Recoverable Items folder. For now, note how the Recoverable Items folder appears at a different level (the non-IPM subtree) to the user’s standard folders, such as the Inbox, Sent Items, and so on. The standard folders are present in the IPM subtree (Top of Information Store).
Figure 1-2: MFCMapi Showing the Recoverable Items Folder
How Single Item Recovery Works
Let’s start our look at how Single Item Recovery works and to do that we need to look at the flow of messages through a mailbox. In a typical scenario, a new message is delivered to the Inbox folder of a mailbox and at some point it’s quite possible that the mailbox owner will simply delete that message as normal. When this occurs, the message is moved to the Deleted Items folder based on the assumption that the shift key was not used at the time the message was deleted. If the user then empties the Deleted Items folder, they receive the familiar message shown in Figure 1-3, informing them that they are about to permanently delete the message.
Figure 1-3: Deleted Items Folder Warning Message
Assuming the user clicks the Yes button shown in Figure 1-3, the message is moved to the Recoverable Items folder in the mailbox. Specifically, the message is moved to the Deletions sub-folder of the Recoverable Items folder. Since this folder is part of the non-IPM subtree, the message is no longer visible in Outlook as far as the user is concerned and additionally the message no longer counts towards the mailbox quota. Having said this, the message is effectively still in the user’s mailbox and therefore will be moved if the mailbox is moved.
With items now stored in the Recoverable Items\Deletions folder, the mailbox owner can select the Recover Deleted Items option from within Outlook and be presented with the same window you saw earlier in Figure 1-1; in Exchange 2010, this window represents the contents of the Recoverable Items\Deletions folder. Therefore, the user can recover the items back into the mailbox as normal. Equally, the user can choose to purge the contents of the Recoverable Items\Deletions folder by selecting the required messages and clicking the ‘X’ button. However, this is where things change with Single Item Recovery and dumpster 2.0 in Exchange 2010 compared with dumpster 1.0 in previous versions of Exchange and that’s where we’ll start part two of this article series.
Summary
So far in this article series we’ve covered the need for Single Item Recovery in Exchange 2010 and then gone onto start the discussion on how the feature works. We have learnt what the Recoverable Items folder of the user mailbox is and how messages can end up in the Deletions sub-folder. We’ll continue our look at this feature in part two.
If you would like to read the other parts in this article series please go to:
