h1

So a user deletes their inbox… now what?

June 21, 2007

Alot of this is taken from Daniel Petri. I’m simply reposting much of it because it’s simply perfect!

A user uses Outlook. They call you and say “I just deleted my entire inbox”. You may ask “how the hell did you do that?” – but more often than not you should start asking the basic questions. Do you have Outlook? And most of the time, you will need to find out if they use Exchange as their mail server, because alot of times, end users simply don’t know.

Well, first things first… if they’re using PST’s… you better hope you have a backup of the PST.

However, this post is strictly about Exchange Server and an Outlook client.

If a user deletes their entire inbox, for example, it may be recoverable.

First, lets see how long an item is kept in the store after a user deletes it:

  1. On your Exchange server open Exchange System Manager (ESM) and navigate to your server object.
  2. Right-click the server object and select Properties.

In the Limits tab notice the value in the “Keep Deleted Items” box.

In our case it’s 7 days. This means that a user has 7 days to recover his or her deleted items. After that – it’s restore from media time!

Note that the higher you make this value, the bigger the store gets, as deleted items take a longer time to be purged from the store.

Note: Purging deleted items from the store does NOT make the store any smaller. For that you need to Defragment Exchange 2000/2003 Server Databases Offline.

Use Outlook to recover deleted items

The good news is that you can recover deleted items both from the regular Outlook client and from OWA.

In order to recover a deleted item via Outlook we need to first open Outlook (Duh). Then, click on the Deleted Items folder.

Click on Tools, and then the Recover Deleted Items icon (which looks like the recycle bin, lookout not to click on the left icon – that’ll empty your deleted items folder).

You’ll get a new window, where you’ll be able to browse to the item(s) you want to recover, and then press the Recover button.

The recovered items will return to the Deleted Items folder, where you can read, reply or move to their original location.

How do I recover hard-deleted items via Outlook?

Hard-deleted items are items that have been deleted by using SHIFT+DEL, thus the item avoided landing in the Deleted Items folder, and because of that, it cannot be simply recovered.

There is a registry hack for this to work on Outlook (MS KB 178630).

To show you the trick we will first hard-delete an item from the user’s Inbox by clicking on the item and pressing SHIFT+DEL on the keyboard. You will be prompted to accept the action. Do so.

Now, lets see if we can normally recover this item.

No, the Recover Deleted Items folder is empty because the item was hard-deleted from the Inbox.

To enable hard-deleted items recovery in Outlook follow these steps:

Open Registry Editor.

In Registry Editor, navigate to the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options

Create the following value (DWORD):

DumpsterAlwaysOn

and give it a value of 1.

Note: As always, before making changes to your registry you should always make sure you have a valid backup. In cases where you’re supposed to delete or modify keys or values from the registry it is possible to first export that key or value(s) to a .REG file before performing the changes.

Close Registry Editor, re-open Outlook for settings to take place.

After you add this value, the Recover Deleted Items option becomes available for the Sent Items folder, the Drafts folder, the Outbox folder, and the Inbox folder. You can recover deleted items from these folders.

As you can clearly see, the Inbox has the Recover Deleted Items option enabled, and so does each and every folder in the user’s mailbox.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: