none
recover deleted messages RRS feed

  • Question

  • i used the below commend to delete specific email sent from HR by error to all staff

    Get-Mailbox -server XXXX   -ResultSize 9999 |  Where-Object {$_.HiddenFromAddressListsEnabled  -eq $false} | Search-Mailbox -SearchQuery '{Subject:"* Pay Advice For Period Jul-2019*"} and {from:HR@XXXX} and {Received: 25/07/2019}' –DeleteContent

    the command filer not work properly and deleted 10000 mailboxes from all users which has critical data

    two questions here

    1. how to recover these mails (no old backups available)

    2. what is the error in the query so that it retried items out of its scope


    Mahmoud Sabry IT System Engineer


    Saturday, July 27, 2019 10:39 AM

Answers

  • Hi,

    If you want to recover deleted emails from some users, you should enable hold or recover for this mailbox first. So, in your scene, those email cannot be recovered.

    The correct "-SearchQuery" is in this format:

     -SearchQuery 'Received:07/15/2019 -and from:user@domain.com -and subject:"MessageSub*"'

    Please note: "*" can be only used as suffix cannot be used as suffix: "MessageSub*" is correct,"*ssageSubject" is wrong.

    Next time, I would suggest you test with one mailbox with "-EstimateResultOnly" before using "–DeleteContent" for all mailboxes next time:

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Monday, July 29, 2019 5:59 AM
    Moderator

All replies

  • Hi,

    If you want to recover deleted emails from some users, you should enable hold or recover for this mailbox first. So, in your scene, those email cannot be recovered.

    The correct "-SearchQuery" is in this format:

     -SearchQuery 'Received:07/15/2019 -and from:user@domain.com -and subject:"MessageSub*"'

    Please note: "*" can be only used as suffix cannot be used as suffix: "MessageSub*" is correct,"*ssageSubject" is wrong.

    Next time, I would suggest you test with one mailbox with "-EstimateResultOnly" before using "–DeleteContent" for all mailboxes next time:

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Monday, July 29, 2019 5:59 AM
    Moderator
  • Hi,

    I am writing here to confirm with you how thing going now?

    If the above suggestion helps, please be free to mark it as an answer for helping more people.

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Friday, August 2, 2019 10:39 AM
    Moderator
  • You should have a backup solution in place for you e-mail environment. Refer following thread on same issue:

    https://serverfault.com/questions/846702/exchange-2010-recovering-deleted-emails

    Tuesday, August 20, 2019 6:41 AM