Recovering Deleted Items in Exchange Server 2003 (Part 1)

If you would like to read the next part of this article series please go to Recovering Deleted Items in Exchange Server 2003 (Part 2).

 

Introduction

 

This article is divided in two parts; in the first, we will explain how to recover deleted items at the mailbox store level. In the second part, we will discuss recovery of deleted items in Public Folders. In each article we will show the two kinds of settings to be configured: server side and client side.

 

In this article we will talk about a subject that was discussed on the Exchange Server forums, Disaster Recovery scenarios. The most important actions to take when you have a disaster is to identify what situation your environment is in, and get to know the product in order to take the appropriate actions to restore the environment/users as soon as possible and without any problems.

 

Before we start, you have to be sure that the backup is reliable and you can successfully restore it on your test environment.

 

We are going to discuss some ways of how to recover items before restoring the complete environment, which may generate more work for the administrator, or where the user can restore deleted messages without administrator intervention.

 

Note:
This article is not intended to be used as the only way to recover messages. It should be used as a process of recovery, decreasing restore time for deleted items, not as a complete backup solution. This process can be used together with another Exchange Server backup solution or product feature (Recovery Storage Groups, Restore online and offline).

 

Understanding soft delete and hard delete in an Exchange Server environment

 

There are two types of deletion in an Exchange Server environment: hard delete and soft delete.

 

Soft Delete Type: Happens when a message is deleted by pressing the DELETE key and goes to Deleted Items folder.

 

Hard Delete Type: Happens when a message is deleted by pressing the SHIFT and DELETE keys and it is automatically removed.

 

Messages are hard deleted in the following scenarios:

 

 

  • Using Microsoft Outlook you press SHIFT+DELETE to delete a message.
  • Working on an Internet Message Access Protocol 4 (IMAP4) client or another type of client that does not first move the message to the Deleted Items folder.
  • Moving your message to a PST file.

 

Configuring the Exchange Server

 

Before you think about data recovery, it is very important to plan how you will maintain this data. By default, Exchange server allows us to keep all deleted messages for 7 (seven) days and all deleted accounts for 30 (thirty) days. This limit can be customized and we can adjust this setting depending on our needs. It is very important to ensure that you have enough hard disk space in order to be able to increase the number of days for keeping deleted items.

 

All these settings are at mailbox store level, so you should follow these steps:

 

 

  1. Open Exchange System Manager
  2. Expand Administrative Groups
  3. Expand <Administrative Group>
  4. Expand Servers
  5. Expand <Your Server>
  6. Expand <Storage Group>
  7. Right click on <Mailbox store>, click Properties and then click on tab Limits (Figure 1)

 


Figure 1: Mailbox Store properties, you have to define how many days a message stays in the mailbox store

 

This setting is located at mailbox store level. In other words, all the users will have 7 (seven) days to recover a hard deleted message. But in some cases there might be special users such as Presidents, Managers, CIOs and so on… For these cases, we can use different values.

 

To do this, we can follow these steps: open Active Directory Users and Computers, double-click on the user, click the Exchange General tab and then click on Storage Limits. In the Storage Limits page (Figure 2) we can define a different number of days than the other users. (For the purpose of this example, the number is higher)

 


Figure 2: Changing default settings for a specific user

 

Recovering Deleted Messages from Outlook

 

By default, all of the messages that we have deleted through the Deleted items folders can be recovered in the Outlook client. To do that, click on Tools, and then select Recover Deleted Items (Figure 3), this process is called soft delete.

 


Figure 3: Click on Deleted Items and then Tools / Recover Deleted Items

 

Figure 4 shows all of the deleted items within the Deleted Items folder. In this screen, you will have two choices: delete the selected messages permanently (third button) or recover the specified messages (second button) to its original folder (Deleted Items folder).

 


Figure 4: All of the messages in the Deleted Items folder

 

By default, the feature above works only with the Deleted Items folder (soft delete), but if a message is deleted using Shift + Delete (hard delete) from another folder, it will not appear in the Recover Deleted Items of the Deleted Items folder, or in another common case: when an user moves messages from his/her mailbox (Inbox, Sent Items) to a .pst file.

 

You can roll back this situation by modifying the registry. You will have to add an entry called DumpsterAlwaysOn in the registry of the computer that lets the Recover Deleted Items work in all of the Outlook folders.

 

To modify the registry, follow these steps:

 

 

  1. Go to Start, select Run, type regedit and then click OK.
  2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options
  3. Right click on right side frame, then go to New, select DWord Value, type DumpsterAlwaysOn and then complete the value field with a 1 (Figure 5)
  4. Restart Outlook

 


Figure 5: Adding the value DumpsterAlwaysOn

 

After that registry modification, you will be able to use the Recover Deleted Items feature for all Outlook folders.

 

Note:
When you export messages from your Inbox to a *.pst file, all the messages moved in this process will be considered as hard deleted from the Inbox.

 

Recovering Deleted Items through OWA

 

You can also recover deleted items when using Outlook Web Access. We can see the Recover Deleted Items icon in the Deleted Items folder (Figure 6).

 


Figure 6: The Recovery Deleted Item on Deleted Items folder

 

This button does not appear in other folders, so, when we do a hard delete using Outlook Web Access, we cannot see the deleted message.

 

Testing the recovery process with Outlook Web Access

 

To test the OWA recovery process, you can access any user mailbox and then do a hard delete of two messages located on his/her Inbox folder (Figure 7). After pressing Shift + Delete, you will see a dialog box, click OK to continue.

 


Figure 7: Deleting two messages from inbox with Shift + Del (hard delete)

 

In order to recover the messages that were accidentally deleted from the Inbox folder, we will have to use the following syntax in Internet Explorer to get access to the deleted items:

 

http://<server>/exchange/<user>/<folder>/?cmd=ShowDeleted
Where:
<server> : Server name
<user> : user who has deleted some important messages
<folder> : Folder that the important messages were deleted

 

We can now see a new page with all the messages that were hard deleted in the Inbox folder. (Figure 8).

 


Figure 8: Recovering Deleted Items

 

In the Recover Deleted Items page, you will have two options for each message: Recover the selected message or permanently delete it from the Exchange database.

 

Tips for the Recover Deleted Items feature

 

Here are answers to some frequently asked questions about Recover Deleted Items:

 

Tip #1: How can I recover hard deleted items in folders that have spaces?

 

It’s easy. You should use %20 between words. Here are some examples:

 

 

  • I’m Brazilian and my Inbox is called “Caixa de Entrada”, so to recover deleted items, I use this syntax:
    http://<server>/exchange/<user>/Caixa%20de%20Entrada/?cmd=ShowDeleted

 

Tip #2: Which versions of Microsoft Outlook can use the Recover Deleted Items feature?

 

The Microsoft KB Article 246153 mentions the following versions:

 

 

  • Microsoft Outlook 97
  • Microsoft Outlook 98
  • Microsoft Outlook 2000
  • Microsoft Outlook 2002
  • Microsoft Outlook 2003

 

Tip #3: Can I recover Notes and Contacts with the Recover Deleted Items feature?

 

Yes, but you will have to use Outlook 2000 or higher to do this. If you are using an older version (Outlook 97 and 98) you will only be able to recover mail items.

 

Messages deleted out of the defined period of Keep deleted Items for

 

When deleted messages are older than the Keep deleted Items for value, you should use Recovery Storage Group to restore the data. My fellow MVP Henrik Walther has written an article about this feature. This article can be found at http://www.msexchange.org/tutorials/Exchange-Dial-tone-Restore-Method-Part1.html

 

 

 

Conclusion

 

In this article we verified how a user can recover deleted items in their mailbox. This article should not be used as the only recovery method. In the next article, we will see how to recover deleted items in Public Folder stores.

 

More Information:

 

How to recover items that have been hard deleted in Outlook

 

If you would like to read the next part of this article series please go to Recovering Deleted Items in Exchange Server 2003 (Part 2).

About The Author

Leave a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top