Recovering email from O365 RecoverableItems



  • So, you change a mail retention policy.
    Then when people call saying where did my mail from January go..

    You realize you accidentally applied it to the entire mailbox of the entire group/company/whatever.

    How do you recover?

    Remote Powershell of course.

    If you are like me, and run Linux, install Powershell on your system first.
    https://docs.microsoft.com/en-us/powershell/scripting/install/installing-powershell-core-on-linux

    Launch Powerhsell

    [jbusch@dt-jared ~]$ pwsh
    PowerShell 6.2.1
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    Type 'help' to get help.
    

    Get the credentials for your session

    PS /home/jbusch> $O365Credential = Get-Credential
    
    PowerShell credential request
    Enter your credentials.
    User: adminuser@domain.com
    Password for user adminuser@domain.com:
    

    Dump it all into a variable

    PS /home/jbusch> $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $O365Credential -Authentication Basic -AllowRedirection
    

    Import it to your current session, this will take a moment

    PS /home/jbusch> Import-PSSession -Session $Session
    WARNING: The names of some imported commands from the module 'tmp_qiigu1uj.0n0' include unapproved verbs that might make them less discoverable. To find the commands with unapproved verbs, run the Import-Module command again with the Verbose parameter. For a list of approved verbs, type Get-Verb.                                                                                             ModuleType Version    Name                                ExportedCommands                                                        ---------- -------    ----                                ----------------                                                        
    Script     1.0        tmp_qiigu1uj.0n0                    {Add-AvailabilityAddressSpace, Add-DistributionGroupMember, Add-Mailbo…
    
    

    Now you can look at a single user to see what is out there.

    PS /home/jbusch> Get-MailboxFolderStatistics -Identity someuser -FolderScope RecoverableItems | Format-Table Name,FolderPath,ItemsInFolder,FolderAndSubfolderSize                                                                                                                                                                                                                                      
    
    Name              FolderPath         ItemsInFolder FolderAndSubfolderSize
    ----              ----------         ------------- ----------------------
    Recoverable Items /Recoverable Items             0 2.29 GB (2,459,158,122 bytes)
    Audits            /Audits                     1793 9.957 MB (10,440,238 bytes)
    Calendar Logging  /Calendar Logging            355 1.383 MB (1,449,949 bytes)
    Deletions         /Deletions                  9122 2.278 GB (2,446,420,366 bytes)
    Purges            /Purges                      247 827.7 KB (847,569 bytes)
    Versions          /Versions                      0 0 B (0 bytes)
    

    I only cared about the Deletions folder, so I made this command to show them all

    PS /home/jbusch> Get-Mailbox -RecipientTypeDetails UserMailbox -Filter {Alias -ne "adminuser"} | Get-MailboxFolderStatistics -FolderScope RecoverableItems | Where-Object -FilterScript {$_.Name -eq 'Deletions'} | Format-Table Identity,ItemsInFolder,FolderAndSubfolderSize
    

    It resulted in this.

    Identity          ItemsInFolder FolderAndSubfolderSize
    --------          ------------- ----------------------
    user_1\Deletions                1 59.01 KB (60,428 bytes)
    user_2\Deletions            9122 2.278 GB (2,446,420,36…
    user_3\Deletions               181 13.05 MB (13,684,452 b…
    user_4\Deletions               36 2.437 MB (2,555,071 by…
    user_5\Deletions             1286 134.8 MB (141,295,674 …
    user_6\Deletions              22 1.333 MB (1,397,244 by…
    user_7Deletions           9477 2.003 GB (2,151,109,20…
    user_8\Deletions            3790 739.7 MB (775,651,062 …
    .....
    etc
    

    Tweak the -Filter as desired.
    bf70e75a-216f-4bfe-b6b0-26362763d620-image.png

    Now you can recover things using whatever filter you need to be comfortable

    Get-Mailbox -RecipientTypeDetails UserMailbox -Filter {Alias -ne "adminuser"} | Restore-RecoverableItems -SourceFolder RecoverableItems -NoOutput -ResultSize unlimited -MaxParallelSize 4
    

    Fun Fact: I had to do this on Monday.