Exchange Server 2013 Backup and Restore 101 - Recovering individual items (Part 2)

In the previous article, we checked some procedures to restore individual items from the end-user and administrator perspective. In this section, we are going one-step further and we will check what is available for the administrator to manage the restore process when we have Single Item Recovery enabled on the mailboxes.

We will use a test account user05 where the user went to the Recover Deleted Items and removed a message that contained the subject of Message #222, as shown in the Figure 01. After that, we receive a request to restore the message and we have several options available.

Figure 01
We are assuming that we have Single Item Recover feature enable on the user and the purge performed by the end-user has not expired yet.

Restore Option #01 – The shotgun approach…

If you are in a hurry, the end-user has no idea what he is looking for but he knows that he does not have all the messages. If you are in that situation a good solution is the shotgun approach where we dump the entire content of the desired mailbox into a PST and from there the end-user can find the missing messages.
Before starting the export process there are a few items that the administrator must be aware of before using the steps that we will describe in this section:

• The user that is running the cmdlet must have the Mailbox Import Export role assigned
• A Shared Folder with an entry for Exchange Trusted Subsystem on their ACL is required;

In order to export the entire content of any given mailbox to a PST, the following cmdlet can be used, as shown in Figure 02. There are several switches that can be used in this cmdlet to filter the data that will be exported to the PST, the most common are IncludeFolders, ExcludeFolders, ContentFilter and SourceRootFolder and they are self-explanatory.
Get-MailboxExportRequest <Mailbox> -FilePath \\ServerName\SharedFolder\mailbox.pst

Figure 02
As result, a PST file with the entire content of the chosen mailbox will be available. In xfigure 03, we can see that the Message #222 is under Purges folder which indicates that the user deleted that message on purpose.

Figure 03

Restore Option #02 – Using in-pace eDiscovery

In this second method we will take advantage of in-place eDiscovery to find the messages and after that we can either restore the content to a PST from Exchange Admin Center (EAC) or save the items on the Discovery Search Mailbox and from there move to the end-user mailbox.
We will use the same scenario where user05 purged a message with the subject Message #222 from the recover deleted items and now we need to restore that item.
Before starting this section, please make sure that you address the following key points:

• The user performing the eDiscovery must have the Discovery Management role assigned to it

The first step is to open EAC (Exchange Admin Center), then click on compliance management, click on in-place eDiscovery & hold, and click on + (add) and you can follow these steps:

1. In the name and description page. Assign a name for the new eDiscovery that we are about to start, the name chosen here is important because all folders created with any data found will use this name. After filling out the name information, click next.
2. In the mailboxes page. We can search all mailboxes however in our case we want to be specific since we are restoring an item and because of that we will select Specify mailboxes to search and click on + and select the desired mailbox from the list (Figure 04). Click on next.

Figure 04

3. In the search query page. In this area we can use the information provided by the end-user to find the message, we can use keywords, start date, end date, From, To/cc/bcc, and so forth. In our example, we know that the subject of the message was Message #222, so I decided to add only the #222 string. After that, click on next. (Figure 05)

Figure 05

4. In the in-place hold settings page. In this section we can add the content found on hold however we just want to restore a couple of items, so leave default settings and click on new.

So far so good, we have a search request in place (Figure 06) and if we glance at the right side, we will have some information about the search, in our case, we have two items, and they are about 11.29KB in size.

Figure 06
We can use the current request and copy the content found on the request that we have just created to a mailbox and from there manage the information found.
In order to do that, click on the fourth button from left to right in the Toolbox, and then click on Copy search results (Figure 07).

Figure 07
In the new page, click on browse and select the Discovery Search Mailbox available, and click on Copy, as shown in Figure 08.

Figure 08
Wait for the operation to be completed, and when it does, we will see the status as search succeeded. After this point, we can click on the Open link located at the bottom of the detailed info on the right side and that will open the Discovery Search Mailbox (Figure 09).

Figure 09
In the Outlook Web App session of the Discovery Search mailbox, we will have a folder containing the name that we defined during the creation of the eDiscovery request and we can make sure that all required data to be restore is there (Figure 10).

Figure 10
Now that we are aware of the information found on the eDiscovery, we can export straight to a PST using the option eDiscovery PST Export Tool where the content of that search will be exported to a PST. This option is the seventh button from left to right on the toolbox. Click on it and a new window (Figure 11) will be displayed, click on browse and select a location to save the new file, and then click Start.

Figure 11
The result of the operation is shown in Figure 12, the file name will be based on the name that we defined in the wizard during the creation of the new in-place eDiscovery and hold request.

Figure 12
After having the file, we can open it on any existent Outlook and the folder structure where the message(s) were found will be recreated (Figure 13). It is not a surprise for us, but the Message #222 can be seen under Purges folder.

Figure 13
Now that we have a PST file, we always can import the content into the user’s mailbox using the following cmdlet (Figure 14). We will use the switch TargetRootFolder to create a folder containing the restored data on an existent mailbox.
New-MailboxImportRequest <user> -FilePath \\server\shraredfolder\file.pst -TargetRootFolder Restore

Figure 14
Before informing the user that his information is available to the end-user, make sure that the request is listed as completed, and we can check using the Get-MailboxImportRequest cmdlet (Figure 15).

Figure 15
After completing the request, the end-user (in our example here user05) will have a new folder Restore with the content of the PST that we generated in the previous steps (Figure 16).

Figure 16

Conclusion

In this second article of our series, we continued the process of restoring individual items which we started in the first article, and we went over a couple of scenarios where the administrator can use either the PST export or the eDiscovery process to retrieve the required information.