Restore-RecoverableItems

This cmdlet is available in on-premises Exchange and in the cloud-based service. Some parameters and settings may be exclusive to one environment or the other.

Use the Restore-RecoverableItems items cmdlet to restore deleted items in mailboxes. You use the Get-RecoverableItems cmdlet to find the deleted items to recover.

This cmdlet is available only in the Mailbox Import Export role, and by default, the role isn't assigned to any role groups. To use this cmdlet, you need to add the Mailbox Import Export role to a role group (for example, to the Organization Management role group). For more information, see Add a role to a role group (https://docs.microsoft.com/Exchange/permissions/role-groups#add-a-role-to-a-role-group).

For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax (https://docs.microsoft.com/powershell/exchange/exchange-server/exchange-cmdlet-syntax).

Syntax

Restore-RecoverableItems
       -Identity <GeneralMailboxOrMailUserIdParameter>
       [-EntryID <String>]
       [-FilterEndTime <DateTime>]
       [-FilterItemType <String>]
       [-FilterStartTime <DateTime>]
       [-LastParentFolderID <String>]
       [-ResultSize <Unlimited>]
       [-SourceFolder <RecoverableItemsFolderType>]
       [-SubjectContains <String>]
       [<CommonParameters>]
Restore-RecoverableItems
       -Identity <GeneralMailboxOrMailUserIdParameter[]>
       [-EntryID <String>]
       [-FilterEndTime <DateTime>]
       [-FilterItemType <String>]
       [-FilterStartTime <DateTime>]
       [-LastParentFolderID <String>]
       [-MaxParallelSize <Int32>]
       [-NoOutput]
       [-ResultSize <Unlimited>]
       [-SourceFolder <RecoverableItemsFolderType>]
       [-SubjectContains <String>]
       [<CommonParameters>]

Description

Items are restored to the original folder location if the information is available for the item. If the information can't be found, the item is restored to the default folder for the item type (Inbox for messages, Calendar for meetings and appointments, etc.).

You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see Find the permissions required to run any Exchange cmdlet.

Examples

Example 1

Restore-RecoverableItems -Identity laura@contoso.com -FilterItemType IPM.Note -SubjectContains "FY18 Accounting" -FilterStartTime "2/1/2018 12:00:00 AM" -FilterEndTime "2/5/2018 11:59:59 PM"

After using the Get-RecoverableItems cmdlet to verify the existence of the item, this example restores the specified deleted item from the specified mailbox:

  • Mailbox: laura@contoso.com

  • Item type: Email message

  • Message subject: FY18 Accounting

  • Location: Recoverable Items\Deletions

  • Date range: 2/1/2018 to 2/5/2018

Example 2

$mailboxes = Import-CSV "C:\My Documents\RestoreMessage.csv"; $mailboxes | foreach {Restore-RecoverableItems -Identity $_.SMTPAddress -SubjectContains Project X" -SourceFolder DeletedItems -FilterItemType IPM.Note}

In Exchange Server, this example restores the deleted email message "Project X" for the mailboxes that are specified in the comma-separated value (CSV) file C:\My Documents\RestoreMessage.csv. The CSV file uses the header value SMTPAddress, and contains the email address of each mailbox on a separate line like this:

SMTPAddress

chris@contoso.com

michelle@contoso.com

laura@contoso.com

julia@contoso.com

The first command reads the CSV file to the variable named $mailboxes. The second command restores the specified message from the Deleted Items folder in those mailboxes.

Example 3

Restore-RecoverableItems -Identity "malik@contoso.com","lillian@contoso.com" -FilterItemType IPM.Note -SubjectContains "COGS FY17 Review" -FilterStartTime "3/15/2019 12:00:00 AM" -FilterEndTime "3/25/2019 11:59:59 PM" -MaxParallelSize 2

In Exchange Online, after using the Get-RecoverableItems cmdlet to verify the existence of the item, this example restores the specified deleted items in the specified mailboxes:

  • Mailboxes: malik@contoso.com, lillian@contoso.com

  • Item type: Email message

  • Message subject: COGS FY17 Review

  • Location: Recoverable Items\Deletions

  • Date range: 3/15/2019 to 3/25/2019

  • Number of mailboxes processed simultaneously: 2

Parameters

-EntryID

The EntryID parameter specifies the deleted item that you want to restore. The EntryID value for the deleted item is unique in the mailbox.

You can find the EntryID for specific items by using other search filters on the Get-RecoverableItems cmdlet (subject, date range, etc.).

Type:String
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Server 2016, Exchange Server 2019, Exchange Online
-FilterEndTime

The FilterEndTime specifies the end date/time of the date range.

Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018. You can enter the date only, or you can enter the date and time of day. If you enter the date and time of day, enclose the value in quotation marks ("), for example, "09/01/2018 5:00 PM".

Type:DateTime
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Server 2016, Exchange Server 2019, Exchange Online
-FilterItemType

The FilterItemType parameter filters the results by the specified MessageClass (ItemClass) property value of the deleted item. For example:

  • IPM.Appointment (Meetings and appointments)

  • IPM.Contact

  • IPM.File

  • IPM.Note

  • IPM.Task

Type:String
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online
-FilterStartTime

The FilterStartTime specifies the start date/time of the date range.

Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018. You can enter the date only, or you can enter the date and time of day. If you enter the date and time of day, enclose the value in quotation marks ("), for example, "09/01/2018 5:00 PM".

Type:DateTime
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Server 2016, Exchange Server 2019, Exchange Online
-Identity

The Identity parameter specifies the mailbox that contains the deleted items that you want to restore. You can use any value that uniquely identifies the mailbox. For example:

  • Name

  • Alias

  • Distinguished name (DN)

  • Canonical DN

  • <domain name><account name>

  • Email address

  • GUID

  • LegacyExchangeDN

  • SamAccountName

  • User ID or user principal name (UPN)

In Exchange Online, you can specify multiple mailboxes separated by commas. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<Value1>","<Value2>",..."<ValueX>".

Type:GeneralMailboxOrMailUserIdParameter
Position:1
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Server 2016, Exchange Server 2019
-LastParentFolderID

The LastParentFolderID parameter specifies the FolderID value of the item before it was deleted. For example, 53B93149989CA54DBC9702AE619B9CCA000062CE9397.

Type:String
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Server 2016, Exchange Server 2019, Exchange Online
-MaxParallelSize

This parameter is available only in the cloud-based service.

The MaxParallelSize parameter specifies the maximum number of mailboxes that are processed by the command in parallel. A valid value is an integer from 1 to 10. Typically, a higher value decreases the amount of time it takes to complete the command on multiple mailboxes.

The value of this parameter has no effect when the Identity parameter specifies only one mailbox.

Type:Int32
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online
-NoOutput

This parameter is available only in the cloud-based service.

The NoOutput switch specifies whether to restore the deleted items directly without any command output in the console. You don't need to specify a value with this switch.

Type:SwitchParameter
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online
-ResultSize

The ResultSize parameter specifies the maximum number of results to return. If you want to return all requests that match the query, use unlimited for the value of this parameter. The default value is 1000.

Type:Unlimited
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Server 2016, Exchange Server 2019, Exchange Online
-SourceFolder

The SourceFolder parameter specifies where to search for deleted items in the mailbox. Valid values are:

  • DeletedItems: The Deleted Items folder.

  • RecoverableItems: The Recoverable Items\Deletions folder. This folder contains items that have been deleted from the Deleted Items folder (soft-deleted items).

  • PurgedItems: (Cloud only) The Recoverable Items\Purges folder. This folder contains items that have been purged from the Recoverable Items folder (hard-deleted items).

If you don't use this parameter, the command will search all of these folders.

Type:RecoverableItemsFolderType
Accepted values:DeletedItems | RecoverableItems, DeletedItems | RecoverableItems | PurgedItems
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Server 2016, Exchange Server 2019
-SubjectContains

The SubjectContains parameter filters the deleted items by the specified text value in the Subject field. If the value contains spaces, enclose the value in quotation marks (").

Type:String
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Server 2016, Exchange Server 2019, Exchange Online

Inputs

Outputs