Recovering email from O365 RecoverableItems
-
So, you change a mail retention policy.
Then when people call saying where did my mail from January go..You realize you accidentally applied it to the entire mailbox of the entire group/company/whatever.
How do you recover?
Remote Powershell of course.
If you are like me, and run Linux, install Powershell on your system first.
https://docs.microsoft.com/en-us/powershell/scripting/install/installing-powershell-core-on-linuxLaunch Powerhsell
[jbusch@dt-jared ~]$ pwsh PowerShell 6.2.1 Copyright (c) Microsoft Corporation. All rights reserved. Type 'help' to get help.Get the credentials for your session
PS /home/jbusch> $O365Credential = Get-Credential PowerShell credential request Enter your credentials. User: [email protected] Password for user [email protected]:Dump it all into a variable
PS /home/jbusch> $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $O365Credential -Authentication Basic -AllowRedirectionImport it to your current session, this will take a moment
PS /home/jbusch> Import-PSSession -Session $Session WARNING: The names of some imported commands from the module 'tmp_qiigu1uj.0n0' include unapproved verbs that might make them less discoverable. To find the commands with unapproved verbs, run the Import-Module command again with the Verbose parameter. For a list of approved verbs, type Get-Verb. ModuleType Version Name ExportedCommands ---------- ------- ---- ---------------- Script 1.0 tmp_qiigu1uj.0n0 {Add-AvailabilityAddressSpace, Add-DistributionGroupMember, Add-Mailbo…Now you can look at a single user to see what is out there.
PS /home/jbusch> Get-MailboxFolderStatistics -Identity someuser -FolderScope RecoverableItems | Format-Table Name,FolderPath,ItemsInFolder,FolderAndSubfolderSize Name FolderPath ItemsInFolder FolderAndSubfolderSize ---- ---------- ------------- ---------------------- Recoverable Items /Recoverable Items 0 2.29 GB (2,459,158,122 bytes) Audits /Audits 1793 9.957 MB (10,440,238 bytes) Calendar Logging /Calendar Logging 355 1.383 MB (1,449,949 bytes) Deletions /Deletions 9122 2.278 GB (2,446,420,366 bytes) Purges /Purges 247 827.7 KB (847,569 bytes) Versions /Versions 0 0 B (0 bytes)I only cared about the
Deletionsfolder, so I made this command to show them allPS /home/jbusch> Get-Mailbox -RecipientTypeDetails UserMailbox -Filter {Alias -ne "adminuser"} | Get-MailboxFolderStatistics -FolderScope RecoverableItems | Where-Object -FilterScript {$_.Name -eq 'Deletions'} | Format-Table Identity,ItemsInFolder,FolderAndSubfolderSizeIt resulted in this.
Identity ItemsInFolder FolderAndSubfolderSize -------- ------------- ---------------------- user_1\Deletions 1 59.01 KB (60,428 bytes) user_2\Deletions 9122 2.278 GB (2,446,420,36… user_3\Deletions 181 13.05 MB (13,684,452 b… user_4\Deletions 36 2.437 MB (2,555,071 by… user_5\Deletions 1286 134.8 MB (141,295,674 … user_6\Deletions 22 1.333 MB (1,397,244 by… user_7Deletions 9477 2.003 GB (2,151,109,20… user_8\Deletions 3790 739.7 MB (775,651,062 … ..... etcTweak the
-Filteras desired.
Now you can recover things using whatever filter you need to be comfortable
Get-Mailbox -RecipientTypeDetails UserMailbox -Filter {Alias -ne "adminuser"} | Restore-RecoverableItems -SourceFolder RecoverableItems -NoOutput -ResultSize unlimited -MaxParallelSize 4Fun Fact: I had to do this on Monday.
