recover deleted mail items - office 365 | 4#7

Download Recover deleted mail items - Office 365 | 4#7

Post on 18-Aug-2015

8 views

Category:

Technology

1 download

Embed Size (px)

TRANSCRIPT

  1. 1. Page 1 of 30 | Recover deleted mail items - Office 365 | 4#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 Recover deleted mail items Office 365 | 4#7 In the current article, we will review the four options that we can use for recovering mail items in the Exchange Online environment. The available tools for recovering mail items are: 1. Recovering deleted mail items by using Outlook and OWA mail clients. 2. Recovering deleted mail items by using MFCMAPI utility. 3. Recovering deleted mail items by using Exchange In-Place eDiscovery and Hold. 4. Recovering deleted mail items by using the PowerShell cmdlets Search- Mailbox and New-MailboxSearch. The characters of our scenario are as follows:
  2. 2. Page 2 of 30 | Recover deleted mail items - Office 365 | 4#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 An organization user calls us and complain that some of his mail disappeared. We have implemented our due diligence and perform a mailbox search to verify if the mail its still exists in the user mailbox. In the current time, we are entering into the phase in which we assume that the mail item was deleted and we want to check if we the specific mail items are still recoverable. The two main questions that relate to this scenario are: Q1: What are the recovery mail methods that are available for us in the Office 365 and Exchange Online environment? Q2: Does the mail item is still recoverable meaning, can we still save the deleted mail item? The available mail recovery method in Office 365 and Exchange Online environment Before we start to dive into the specific details of the recovery mail methods that we can use its important to define a general classification of the mail recovery methods: 1. Recovery mail method that can be implemented by the user himself (the mailbox owner) 2. Recovery mail methods that can be implemented only by the Exchange Online administrator. For example every user (mailbox owner) has the ability to recover mail items that were deleted form to Exchange inbox Recycle bin (the Deleted items folder) by using the OWA or the Outlook option of Recover Deleted Items. As mention, the user will have a grace period of 14 days in which he can regret and restore mail items that were deleted from the Exchange inbox Recycle bin (the Deleted items folder). In other words recover from a scenario of Hard delete. Note you can read more information about the term Hard Delete in the section Soft delete versus Hard delete
  3. 3. Page 3 of 30 | Recover deleted mail items - Office 365 | 4#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 The scenario in which only the Exchange Administrator can recover mail items are: 1. Hard delete A scenario in which the user deletes also the mail item that was stored in the Deletion folder(hard delete). In this case, the mail will be placed in the Purges folder. The user doesnt have access permission to the Purges folder (only the Exchange Online Administrator can view the content of this folder). 2. Mailbox with Litigation Hold or In-Place Hold In case that the mailbox was configured with Litigation Hold or In-Place Hold, the ability to recover deleted mail items older than 14 days (the default Deleted Item retention policy in Exchange Online is 14 days), only the Exchange Online administrator has the ability to recover this mail items. The available tools for recovering mail items The available tools that we can use for recovering mail items are: 1. In-place eDiscovery
  4. 4. Page 4 of 30 | Recover deleted mail items - Office 365 | 4#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 An Exchange 2013 web-based interface, which enables us to create a query and search for mail items in a specific mailbox or an array of mailboxes. (Exchange Online is based on Exchange 2013 architecture). The in-place eDiscovery Exchange infrastructure is a very powerful tool, that consisting of different components and, can use for searching and recovering data from Exchange Online infrastructure and also from other infrastructures such as SharePoint Online. 2. PowerShell cmdlets Exchange includes two sets of PowerShell cmdlets that was created for searching + recovering mail items from a user mailbox: Search-Mailbox New-MailboxSearch Booth of the PowerShell cmdlets: Search-Mailbox and New-MailboxSearch serve for searching for data (mail items) in Exchange mailbox. The graphic interface of the Exchange Online eDiscovery that is used for searching + recovering mail items from user mailboxes is based on the PowerShell cmdlets New-MailboxSearch In addition, Exchange includes support in older PowerShell cmdlets named Search-Mailbox. To oblivious question that could appear is: why do we need two PowerShell cmdlets that do the same thing? The answer is that despite the common between this two PowerShell cmdlets, each PowerShell has different capabilities that the other PowerShell cmdlets dont have. Theoretically, the newer PowerShell cmdlets New-MailboxSearch was supposed to replace or Inherit the former PowerShell cmdlets (the Search- Mailbox) but, the interesting news is that the PowerShell cmdlets Search- Mailbox still have capabilities that are not provided by the newer New- MailboxSearch PowerShell cmdlets.
  5. 5. Page 5 of 30 | Recover deleted mail items - Office 365 | 4#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 For example, the PowerShell cmdlets Search-Mailbox considers is older than the new PowerShell cmdlets: New-MailboxSearch but, the PowerShell cmdlets Search-Mailbox includes capabilities that the newer PowerShell cmdlets dont have such as the ability to search and recover mail items only from the Recoverable Items folder. If you want to get a detailed review of how to use these PowerShell cmdlets, you can read the article Recovering deleted mail items using PowerShell cmdlets Search-Mailbox | 7#7 3. Mail client (OutlookOWA) The mail clients Outlook and OWA, include a built-in option that enables users to recover mail items. The OutlookOWA recovery mail items interface enables the user (the mailbox owner) to view the content of the Deletion folder + recover mail items. In other words, enable the user to recover mail items from a Soft delete event. 4. MFCMAPI The MFCMAPI is a very powerful GUI tool, that enables users (the mailbox owner or another user that have Full access permission to the mailbox) to have access to the behind the scenes of the mailbox content. The MFCMAPI tools can provide many capabilities for a variety of troubleshooting scenarios but in this article, we will review only a very specific capability of the MFCMAPI -the capability of enabling users to access the hiding partition Recoverable Items folder. In the current article, we will review the following methods for recovering mail items in Exchange Online environment: Recovery using Outlook and OWA mail client MFCMAPI In the article Using Exchange In-place eDiscovery & Hold for recovering deleted mail items | 6#7, we will review how to recover mail items using In- place eDiscovery & Hold
  6. 6. Page 6 of 30 | Recover deleted mail items - Office 365 | 4#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 In the article Recovering deleted mail items using PowerShell cmdlets Search-Mailbox | 7#7, we will review how to recover mail items using the PowerShell cmdlets Search-Mailbox. Best practices and guideline for recovering deleted mail items When a user reports that his E-mail disappeared the recommended troubleshooting flow is: 1. Verify if the mail items still exist in the user mailbox in case that you cannot find the mail item in the user mailbox, move to the next step. 2. Instruct the user to use the OWAOutlook built-in option of recovering deleted items. The ability of the user to recover mail items by themselves, can save precious time and prevent unnecessary resource allocation for implementing an administrative recovery process. In simple words simple is better. If the user manages to recover the mail item by himself, this is a win-win scenario. 3. Use the administrative mail recovery options that exists in an Exchange Online environment, only when the user doesnt mange to recover mail by himself.
  7. 7. Page 7 of 30 | Recover deleted mail items - Office 365 | 4#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 1. Recovering deleted mail items by using Outlook and OWA mail clients. As mentioned, Outlook and OWA mail clients include a built-in interface that enables a user to recover mail items. The Outlook and OWA recovery mail option enable the user to get access to the hidden subfolder the Deletion folder. When we mention the term recover mail items by using OutlookOWA, the meaning is the ability to recover Soft deleted mail items. Note you can read more information about the subject of Soft deleted in the section Soft delete versus Hard delete 1.1 Recovering deleted mail items by using Outlook mail client. To be able to recover mail items using Outlook, implement the following steps:
  8. 8. Page 8 of 30 | Recover deleted mail items - Office 365 | 4#7 Written by Eyal Doron | o365info.com | Copyright 2012-2015 Choose the Folder menu Choose the Recover deleted items icon. In the window that appears, we can see a list of all the deleted items (the mail items that stored in the Deletion folder). When choosing the option of Restore selected items, the mail item will be restored back to the Deleted items folder. When choosing the option of Purge selected items, the mail item will be sent to the Purges folder(Hard delete). One important concept that I would like to emphasize is that, the process of recovering deleted mail items doesnt restore the mail item to the original folder in which the mail item was originally created but instead, to the folder that host the mail item before he was deleted meaning the Dele