recover deleted mail items - office 365 | 4#7

Download Recover deleted mail items - Office 365 | 4#7

Post on 23-Jul-2016

214 views

Category:

Documents

1 download

Embed Size (px)

DESCRIPTION

Recover deleted mail items in the Exchange Online environment | Methods and options | 4#7 http://o365info.com/recover-deleted-mail-items-office-365/ In the current article, we will review the four options that we can use for recovering mail items in the Exchange Online environment. The available tools for recovering mail items are: 1. Recovering deleted mail items by using Outlook and OWA mail clients 2. Recovering deleted mail items by using MFCMAPI utility. 3. Recovering deleted mail items by using Exchange In-Place eDiscovery and Hold. 4. Recovering deleted mail items by using the PowerShell cmdlets search-mailbox and New-MailboxSearch. Eyal Doron | o365info.com

TRANSCRIPT

  • Page 1 of 30 | Recover deleted mail items - Office 365 | 4#7

    Written by Eyal Doron | o365info.com | Copyright 2012-2015

    Recover deleted mail items Office

    365 | 4#7

    In the current article, we will review the four options that we can use for recovering

    mail items in the Exchange Online environment.

    The available tools for recovering mail items are:

    1. Recovering deleted mail items by using Outlook and OWA mail clients.

    2. Recovering deleted mail items by using MFCMAPI utility.

    3. Recovering deleted mail items by using Exchange In-Place eDiscovery and

    Hold.

    4. Recovering deleted mail items by using the PowerShell cmdlets Search-

    Mailbox and New-MailboxSearch.

    The characters of our scenario are as follows:

  • Page 2 of 30 | Recover deleted mail items - Office 365 | 4#7

    Written by Eyal Doron | o365info.com | Copyright 2012-2015

    An organization user calls us and complain that some of his mail disappeared. We

    have implemented our due diligence and perform a mailbox search to verify if the

    mail its still exists in the user mailbox.

    In the current time, we are entering into the phase in which we assume that the

    mail item was deleted and we want to check if we the specific mail items are still

    recoverable.

    The two main questions that relate to this scenario are:

    Q1: What are the recovery mail methods that are available for us in the Office 365

    and Exchange Online environment?

    Q2: Does the mail item is still recoverable meaning, can we still save the deleted

    mail item?

    The available mail recovery method in Office 365 and Exchange

    Online environment

    Before we start to dive into the specific details of the recovery mail methods that

    we can use its important to define a general classification of the mail recovery

    methods:

    1. Recovery mail method that can be implemented by the user himself (the

    mailbox owner)

    2. Recovery mail methods that can be implemented only by the Exchange

    Online administrator.

    For example every user (mailbox owner) has the ability to recover mail items that

    were deleted form to Exchange inbox Recycle bin (the Deleted items folder) by

    using the OWA or the Outlook option of Recover Deleted Items.

    As mention, the user will have a grace period of 14 days in which he can regret

    and restore mail items that were deleted from the Exchange inbox Recycle bin

    (the Deleted items folder). In other words recover from a scenario of Hard

    delete.

    Note you can read more information about the term Hard Delete in the section

    Soft delete versus Hard delete

  • Page 3 of 30 | Recover deleted mail items - Office 365 | 4#7

    Written by Eyal Doron | o365info.com | Copyright 2012-2015

    The scenario in which only the Exchange Administrator can recover mail items are:

    1. Hard delete

    A scenario in which the user deletes also the mail item that was stored in

    the Deletion folder(hard delete). In this case, the mail will be placed in

    the Purges folder.

    The user doesnt have access permission to the Purges folder (only the

    Exchange Online Administrator can view the content of this folder).

    2. Mailbox with Litigation Hold or In-Place Hold

    In case that the mailbox was configured with Litigation Hold or In-Place Hold, the

    ability to recover deleted mail items older than 14 days (the default Deleted

    Item retention policy in Exchange Online is 14 days), only the Exchange Online

    administrator has the ability to recover this mail items.

    The available tools for recovering mail items

    The available tools that we can use for recovering mail items are:

    1. In-place eDiscovery

  • Page 4 of 30 | Recover deleted mail items - Office 365 | 4#7

    Written by Eyal Doron | o365info.com | Copyright 2012-2015

    An Exchange 2013 web-based interface, which enables us to create a query and

    search for mail items in a specific mailbox or an array of mailboxes.

    (Exchange Online is based on Exchange 2013 architecture).

    The in-place eDiscovery Exchange infrastructure is a very powerful tool, that

    consisting of different components and, can use for searching and recovering data

    from Exchange Online infrastructure and also from other infrastructures such as

    SharePoint Online.

    2. PowerShell cmdlets

    Exchange includes two sets of PowerShell cmdlets that was created for searching +

    recovering mail items from a user mailbox:

    Search-Mailbox

    New-MailboxSearch

    Booth of the PowerShell cmdlets: Search-Mailbox and New-MailboxSearch serve

    for searching for data (mail items) in Exchange mailbox.

    The graphic interface of the Exchange Online eDiscovery that is used for searching

    + recovering mail items from user mailboxes is based on the PowerShell cmdlets

    New-MailboxSearch

    In addition, Exchange includes support in older PowerShell cmdlets named

    Search-Mailbox.

    To oblivious question that could appear is: why do we need two PowerShell cmdlets

    that do the same thing?

    The answer is that despite the common between this two PowerShell cmdlets, each

    PowerShell has different capabilities that the other PowerShell cmdlets dont

    have.

    Theoretically, the newer PowerShell cmdlets New-MailboxSearch was

    supposed to replace or Inherit the former PowerShell cmdlets (the Search-

    Mailbox) but, the interesting news is that the PowerShell cmdlets Search-

    Mailbox still have capabilities that are not provided by the newer New-

    MailboxSearch PowerShell cmdlets.

  • Page 5 of 30 | Recover deleted mail items - Office 365 | 4#7

    Written by Eyal Doron | o365info.com | Copyright 2012-2015

    For example, the PowerShell cmdlets Search-Mailbox considers is older than the

    new PowerShell cmdlets: New-MailboxSearch but, the PowerShell cmdlets

    Search-Mailbox includes capabilities that the newer PowerShell cmdlets dont

    have such as the ability to search and recover mail items only from

    the Recoverable Items folder.

    If you want to get a detailed review of how to use these PowerShell cmdlets, you

    can read the article Recovering deleted mail items using PowerShell cmdlets

    Search-Mailbox | 7#7

    3. Mail client (Outlook\OWA)

    The mail clients Outlook and OWA, include a built-in option that enables users to

    recover mail items. The Outlook\OWA recovery mail items interface enables the

    user (the mailbox owner) to view the content of the Deletion folder + recover mail

    items. In other words, enable the user to recover mail items from a Soft delete

    event.

    4. MFCMAPI

    The MFCMAPI is a very powerful GUI tool, that enables users (the mailbox owner or

    another user that have Full access permission to the mailbox) to have access to the

    behind the scenes of the mailbox content.

    The MFCMAPI tools can provide many capabilities for a variety of troubleshooting

    scenarios but in this article, we will review only a very specific capability of

    the MFCMAPI -the capability of enabling users to access the hiding partition

    Recoverable Items folder.

    In the current article, we will review the following methods for recovering mail

    items in Exchange Online environment:

    Recovery using Outlook and OWA mail client

    MFCMAPI

    In the article Using Exchange In-place eDiscovery & Hold for recovering

    deleted mail items | 6#7, we will review how to recover mail items using In-

    place eDiscovery & Hold

  • Page 6 of 30 | Recover deleted mail items - Office 365 | 4#7

    Written by Eyal Doron | o365info.com | Copyright 2012-2015

    In the article Recovering deleted mail items using PowerShell cmdlets

    Search-Mailbox | 7#7, we will review how to recover mail items using the

    PowerShell cmdlets Search-Mailbox.

    Best practices and guideline for recovering deleted mail items

    When a user reports that his E-mail disappeared the recommended

    troubleshooting flow is:

    1. Verify if the mail items still exist in the user mailbox in case that you cannot

    find the mail item in the user mailbox, move to the next step.

    2. Instruct the user to use the OWA\Outlook built-in option of recovering deleted

    items. The ability of the user to recover mail items by themselves, can save

    precious time and prevent unnecessary resource allocation for implementing an

    administrative recovery process.

    In simple words simple is better. If the user manages to recover the mail item

    by himself, this is a win-win scenario.

    3. Use the administrative mail recovery options that exists in an Exchange Online

    environment, only when the user doesnt mange to recover mail by himself.

  • Page 7 of 30 | Recover deleted mail items - Office 365 | 4#7

    Written by Eyal Doron | o365info.com | Copyright 2012-2015

    1. Recovering deleted mail items by using Outlook and

    OWA mail clients.

    As mentioned, Outlook and OWA mail clients include a built-in interface that

    enables a user to recover mail items.

    The Outlook and OWA recovery mail option enable the user to get access to the

    hidden subfolder the Deletion folder.

    When we mention the term recover mail items by using Outlook\OWA, the

    meaning is the ability to recover Soft deleted mail items.

    Note you can read more information about the subject of Soft deleted in the