recover deleted mail items in the exchange online environment | deleted mail flow | 3#7

Download Recover deleted mail items in the Exchange Online environment | Deleted mail flow | 3#7

Post on 18-Aug-2015

9 views

Category:

Technology

1 download

Embed Size (px)

TRANSCRIPT

  1. 1. Page 1 of 26 | Recover deleted mail items in the Exchange Online environment | Deleted mail flow | 3#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 Recover deleted mail items in the Exchange Online environment | Deleted mail flow | 3#7 In the current article, we will review the following subjects: The flow of a deleted mail item in an Exchange base environment for a standard mailbox and for Litigation Hold or In-Place Hold enabled mailbox. The subject of Deleted Item retention policy, the Exchange server policy that removes deleted mail items after a specific time period and the ability to extend the default value. The meaning of the terms Soft delete versus Hard delete.
  2. 2. Page 2 of 26 | Recover deleted mail items in the Exchange Online environment | Deleted mail flow | 3#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 As Exchange Online administrator, we will need to understand the deleted mail flow for two major reasons: 1. To be able to prepare in advance, for a business need in which we need to provide the ability for recovering mail items for a longer period than the standard 14 days period. 2. To be able to provide the right answer for our users, in a scenario in which our user asks us to recover for then deleted mail items. For example, in case that the user report that the mail item was deleted two months ago and, we did not use the option of Litigation Hold or In-Place Hold, the answer is that the mail item cannot be recovered! The Recoverable Items folder and deleted mail item life cycle Before we start with the detailed description of the deleted mail item life cycle its important that we understand the logic of the Recoverable Items folder. As mention, In Exchange Online environment mail items that were deleted from the Exchange inbox Recycle bin (the Deleted items folder) will be moved to the Recoverable Items folder or, if we want to be more specific, to the Deletion folder. The main question is: for how long this deleted mail items will be kept in the Deletion folder? The answer depends on the specific setting of the Exchange Online mailbox. Case 1 in case that the mailbox considers as standard mailbox the deleted mail items will be considered as recoverable for a period of 14 days. Case 2 in case that the mailbox considers as Exchange Online mailbox with Litigation Hold or In-Place Hold enabled, the deleted mail items will be considered as recoverable for a period that will be defined by the Litigation Hold or In-Place Hold policy (a specific time period longer than 14 days or forever).
  3. 3. Page 3 of 26 | Recover deleted mail items in the Exchange Online environment | Deleted mail flow | 3#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 The Recoverable Items folder purpose and the relevance for the subject of deleted mail items. The Exchange single item recovery architecture and the Recoverable Items folder can be considered as sophisticated architecture and an infrastructure that was created for providing many types of services. In the current article series, we will relate only to the part that relate to the subject of storing and recovering deleted mail items via the Recoverable Items folder. By default, the Recoverable Items folder can help us to deal with a scenario of Soft deleted and Hard delete for a period of 14 days. This limitation is dictated by the Deleted Item retention policy.
  4. 4. Page 4 of 26 | Recover deleted mail items in the Exchange Online environment | Deleted mail flow | 3#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 The Exchange architecture provides a tool that will enable us to bypass the limitation that is imposed by the Deleted Item retention policy for a specific user mailbox or for multiple mailboxes. The name of the Exchange mechanism that enable us to bypass the limitation described as Litigation Hold or In-Place Hold. Recoverable Items folder, Litigation Hold and, In-Place Hold One of the most confusing and unclear subject in the Exchange server architecture is the subject of Litigation Hold and In-Place Hold.
  5. 5. Page 5 of 26 | Recover deleted mail items in the Exchange Online environment | Deleted mail flow | 3#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 In the current article, we will not dive into a detailed description of these components. To simplify the understanding Exchange Litigation Hold and In-Place Hold, we can relate to these components as a tool or mechanism that unable to use to override the values of the Exchange Deleted Item retention policy that is applied on the Exchange mailboxes. For example the default Exchange Online Deleted Item retention value is 14 days. By using the option of Litigation Hold or In-Place Hold, we can set a different Deleted Item retention policy to specific Exchange users. For example, when we apply Litigation Hold and In-Place Hold to a specific mailbox, we can decide what will be the value of the Deleted Item retention policy. We can set the value of the Deleted Item retention policy to months, years or even forever.
  6. 6. Page 6 of 26 | Recover deleted mail items in the Exchange Online environment | Deleted mail flow | 3#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 Litigation Hold versus In-Place Hold The Litigation Hold mechanism is applied for all of the items in a specific mailbox such as calendar items, contact items mail items etc. The option of In-Place Hold enables us to define more refined deleted mail item policy. For example, we can decide to apply the -Place Hold only to calendar items from a specific date, etc. In reality, the difference between Litigation Hold and In-Place Hold is much more comprehensive but for our purpose, we can be satisfied with this simple explanation. Deleted mail item flow and Life Cycle To be able to unveil the mystery of the Recoverable Items folder, lets review the object of Deleted mail item flow and Life Cycle. We can classify the different deleted mail items scenarios in Exchange environment to two major groups: 1. Standard mailbox Exchange mailbox that is subject to the default Deleted Item retention policy. 2. Exchange mailbox with a Litigation Hold or In-Place Hold enabled an Exchange mailbox that is not subject to the default Deleted Item retention policy. Instead, have a special or dedicated Deleted Item retention policy.
  7. 7. Page 7 of 26 | Recover deleted mail items in the Exchange Online environment | Deleted mail flow | 3#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 What is the Exchange Deleted Item retention policy? The term Deleted Item retention policy define an Exchange process that can be described as garbage collection of non-relevant objects (mail items). Technically speaking, when a user decides to delete a specific mail item, the meaning is that the mail item is not relevant or not needed for the user. When a user deletes mail item, the mail item is not acutely deleted but instead, moved or relocated to a new folder the Deleted items folder. Technically speaking, the user doesnt need to empty or clean the Deleted items folder. In case that an Exchange user doesnt bother to empty the Deleted items folder, the deleted mail item will stay in the Deleted items folder forever. The only disadvantage for not emptying the Deleted items folder is that the deleted mail item considers as part of the user mailbox quota and over time, the deleted mail items will consume a significant part from the user mailbox quota.
  8. 8. Page 8 of 26 | Recover deleted mail items in the Exchange Online environment | Deleted mail flow | 3#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 So lets assume that for this reason and for a proper management of mailbox data, the user decides to empty the content of the Deleted items folder. The questions now are: Q1: What happened to the mail items that were deleted from Deleted items folder? Are they lost forever? A1: When the user empties the Deleted items folder (delete mail items that were saved in the Deleted items folder) the mail items are not deleted but instead, moved or re located, to an additional folder named: Deletion (one of the folders that are include in the Recoverable Items folder). Q2: Can the user access the content of the Deletion folder? A2: The answer is yes. For example, Outlook user, can choose the option- recover deleted items. This option will enable him to view the content of the Deletion folder. The user will see a list of the mail items, that was deleted from the Deleted items folder.
  9. 9. Page 9 of 26 | Recover deleted mail items in the Exchange Online environment | Deleted mail flow | 3#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 Q3: Is there any time limitation for the mail items that are saved to the Deletion folder? A3: Yes there is. The Exchange component that dictates for how long the mail items will be saved in the Deletion folder is the Deleted Item retention policy. By default, the Deleted Item retention policy is configured so keep mail items in the Deletion folder for a period of 14 days. In Exchange on-Premises environment, the Exchange administrator can configure the default value of the Deleted Item retention policy to any desired period. In Exchange Online environment, the default value of the Deleted Item retention can be extended over to a maximum period of 30 days. The reason for this time limitation that are being enforced by the Deleted Item retention is the process that I described as: garbage collection. The Exchange server, need to manage the user mailbox data effectively. The meaning verify that the user mailbox will be restricted to a predefined amount of storage and that this storage will be managed in an effective manner. new deleted mail items will be saved and old deleted mail items will be removed (deleted). Q: What is the Exchange D