Exchange 2010 + Recovering Deleted Emails

Question

Hoping someone could help out with this/provide some answers. Basically, our organization got hit with a ton of spam messages all sharing the same subject. To mitigate the damage, one of our admins ran a command in the exchange 2010 shell to search all mailboxes for emails with this subject and delete them.

The issue however is that while the command he ran deleted all the malicious spam emails, it also ended up deleting emails with very similar subjects as well which our users need. We already attempted the recover deleted items feature in the Outlook client for affected users as well as searching the dumpster via Exchange shell - neither has turned up any results that we would be cable to copy to a target mailbox or anything.

Our deleted items retention seems to be set for 30 days across our DB's. Is there any other ways of possibly recovering these messages that were deleted? Please let me know if any additional info/clarification is needed and really appreciate the help in advance!

Answer 1

Assuming the admin used the Search-Mailbox....-DeleteContent command.

When using the Search-Mailbox command

The DeleteContent switch specifies that the messages returned by the search be permanently deleted from the source mailbox.

As such, the items are permanently removed - ie: gone. This is why it's always recommended to use the -LogOnly parameter first to ensure you are only deleting what you want to be deleted.

Your only likely recourse in Exchange 2010 is to recover the items required from a backup.

Answer 2

To recover deleted emails items in Exchange, an administrator can use Powershell commands and Exchange Admin panel according to understanding and working.

If Administrator wants to try Powershell commands to recover back emails files, then use the command:

Get-Mailbox -ResultSize unlimited -Filter {(RecipientTypeDetails -eq ‘UserMailbox’)} | 
  Set-Mailbox -SingleItemRecoveryEnabled $true -RetainDeletedItemsFor 30

Before that Enable the recovery of single items with the help of the following command:

Set-Mailbox -Identity “name of the user” -SingleItemRecoveryEnabled $true

Note: Enable the single item recovery and set the retention period of the deleted item for any single user. The following command activates the recovery of the single item and sets the retention period of 30 days.

Set-Mailbox -Identity “name of the user” -SingleItemRecoveryEnabled $true -RetainDeletedItemsFor 30

Note: While single item recovery user needs to know some points:

Since more commands are used so you can refer below link:

http://www.datarecovery.institute/recover-deleted-email-items-exchange-2003-2007-2010-2013/

Here you find step by step commands and other precautions that need during recovering deleted items.