First, we need to understand how our Exchange 2010 manages deleted items.
In Exchange Management Console, expand Organization Configuration, Click on Mailbox. On the right hand side, you will see this:
Right -click on a Database and choose Properties. Click the Limits tab.
As you can see, deleted items are kept for 14 days. This is true for all inboxes housed under this database. You can override this setting for each user by right-clicking on the user (under Recipient Configuration / Mailbox), then choose Properties, click on Mailbox Settings tab.
Click Storage Quota and choose Properties.
As you can see, this user uses the retention policy at the database level.
If we want to override the settings, let’s say we want to keep this user’s deleted items for 60 days, we need to change this number as follows:
Now you have an idea where to set retention policy. Let’s discuss about where Microsoft Exchange stores deleted mail items. When an Exchange user deletes a message, the deleted item gets moved to the Deleted Items folder. The items will remain on the server for 14 days (assume our default scenario above).
When the user deletes / empties the Deleted Items, the messages get moved to the Deletions Area.
When an Exchange Administrator manually removes items from the Deletions Area, the items will be deposit into the Purges Area.
Both the Deletions and Purges area are located in the Dumpster Pool.
Items in the Dumpster Pool will live for 14 days. Suppose that someone moves items from the Deletions Area into the Purges after 5 days of deletion, the item will live in the Purges for another 9 days before it gets removed forever (14 – 5 = 9 days).
So, how do you recover deleted items? Outlook Users can only recover deleted items from the Deleted Items and the Deletions Area.
If the items are in the Deleted Items, just open the trash and move the deleted items back to Inbox. This is very simple in Microsoft Outlook. Just click the Deleted Items, select the item(s) to be recovered and drag it back to the Inbox.
On the other hand, if the wanted items are in the Deletions Area, we have to use the Recover Deleted Items option to recover the mail.
To demonstrate this part, we are going to delete the email in the trash can.
Confirm the deletion.
Note that there is nothing in the Recycle Bin (Deleted Items).
Open Microsoft Outlook, click Tools, Recover Deleted Items… to recover them.
In Outlook 2010, click Folder, then choose Recover Deleted Items.
In Outlook 2007, choose Tools, then click Recover Deleted Items…
Select the wanted item and click the Recover Selected Items icon.
If mail items are in the Purges Area, the Administrator needs to use MFCMAPI to recover it (https://mfcmapi.codeplex.com/). To demonstrate this part, I am going to delete this mail from the Deletions Area. By deleting the item from the Deletions Area, the item will end up in the Purges Area.
We need the MFCMAPI application to recover items from the Purges Area. Double-click on mfcmapi.exe.
Click the Session menu, then click Logon.
Choose the profile to be recovered.
Then double-click the Mailbox item in the list,
Expand the Root.
If you do NOT see Recoverable Items under the root, click Tools, Options.
Make sure you set options as follows:
Now the Recoverable Items appears. Click it to expand. You will see Deletions, Purges, and Versions.
Double-click Deletions or Purges
You will see all your deleted messages there.
Right-click and Copy Message
Paste in the Inbox
Click Move message instead of copy then click OK.
Now close the MFCMAPI.
The message should now be in your inbox.
When you delete a message from your inbox, the message will end up in the Deleted Items. Usually this Deleted Items area is called the Recycle Bin. Removing items from the Deleted Items area will deposit the deleted mail into the Deletions Area. By deleting the items from the Deletions Area, the items will end up in the Purges Area. If the items are in the Deleted Items area or in the Deletions Area, users can recover them in Microsoft Outlook. If the items are in the Purges Area, the administrator must use MFCMAPI to recover them.
In this lab I showed you how to recover deleted items from the Deleted Items, as well as from the Deletions Area and the Purges Area.