View information about deleted emails 2#3

In this article, we look at how to view information about deleted mail items, using the PowerShell cmdlet – Get-RecoverableItems.

The purpose of the PowerShell cmdlet – Get-RecoverableItems is to help us display (view or even export) information about deleted mail stored in the Exchange mailbox.

As we mentioned in the previous article, the unique feature of the PowerShell cmdlet – Get-RecoverableItems is the ability to display information about “standard deleted” mail and, in addition, about “soft deleted” mail items.

A quick reminder and reference

In the next article, we will look at using the PowerShell cmdlet – Restore-RecoverableItems which helps us to restore deleted mail items from a specific Exchange mailbox.

In the context of the PowerShell Get-RecoverableItems cmdlets, the term “deleted mail items” refers to two types of deleted mail items:

Standard Deleted Items – The term “standard deleted mail items” is not a formal technical term, but rather a term I use to refer to mail items that are stored in the mailbox folder – “Deleted Items” (the mailbox trash).
Soft Deleted Items – Mail items that have been deleted from the mailbox trash and classified as “soft deleted items”. These items are stored in the “Deletion” folder, a special hidden system folder, which is part of the “Recoverable Items Folder” space and stores “Soft Deleted” mail items.

Show Deleted Mail Items | Filter By – Folder Scope

If we use the Get-RecoverableItems PowerShell cmdlet as is, without any parameters, the Restore-RecoverableItems command displays information about all deleted mail items, which are stored in one of the following mailbox folders:

1. Deleted Items folder (Recycle Bin).
2. Delete Folder – the special hidden folder that is part of the “Recoverable Items Folder” space and stores Soft Deleted mail items.

PowerShell Command Example

	
Get-RecoverableItems Jeff

Using “Folder scope” to view information about specific types of deleted mail items

To be able to display information only about a specific type of deleted mail items,
one can use the “SourceFolder” parameter.

The structure of the PowerShell command is written as follows:

Get-RecoverableItems <mailbox> -SourceFolder <The mailbox folder >

View deleted mail items | Deleted mail items stored in the mailbox’s trash folder.

To display only mail items that are stored in the Deleted Items folder (trash), we can use the following syntax:

Get-RecoverableItems Jeff -SourceFolder DeletedItems

View Deleted Mail Items | Soft Deleted Mail Items

To display only information about Soft Deleted mail items, we can use the following syntax:

Get-RecoverableItems Jeff -SourceFolder RecoverableItems

Show deleted mail items | Filter by – Date

To display deleted mail items from a specific date range, we use the following 2 parameters:

• FilterStartTime
• FilterEndTime

Example PowerShell command syntax:

	
Get-RecoverableItems Jeff -FilterStartTime "9/1/2018 12:00:00 AM" -FilterEndTime "9/1/2018 12:00:00 AM"

Show Deleted Mail Items | Filter By – Email Subject

To display deleted mail items whose subject contains a specific text string, we can use the SubjectContains parameter.

Example PowerShell command syntax:

Get-RecoverableItems Jeff -SubjectContains "test"

Show Deleted Mail Items | Filter By – Email Message Type

The Exchange mailbox serves as a container for different types of “mail items.”
For example, a standard email message, a calendar meeting, task items, and a mail contact item.

When we request to see deleted mail items, the PowerShell cmdlet
Get-RecoverableItems will display all types of mail items that are considered “deleted mail items”.

If we need to define a search filter that looks for a specific type of deleted mail items, we can use the “FilterItemType” parameter.

The following table shows the 4 types of “mail item”:

For example, if we want to display only deleted mail items that are considered “calendar items”, we can use the following syntax:

Get-RecoverableItems Jeff -FilterItemType IPM.Appointment

Show Deleted Mail Items | Filter by – Number of Deleted Mail Items

By default, the PowerShell cmdlet Get-RecoverableItems displays all deleted mail items.
If we want to request to display only a specific number of deleted mail items, we can use the ResultSize parameter.

For example, we want to display only the last 5 mail items categorized as “deleted mail items”.

Get-RecoverableItems Jeff -ResultSize 5

Count the number of deleted mail items

If we want to count the number of deleted mail items, we can use the following PowerShell syntax:

(Get-RecoverableItems Jeff).count

The additional PowerShell command syntax we can use to count mail items is:

Get-RecoverableItems jeff | Measure-Object

Show Deleted Mail Items | Filter By – Last Parent Folder ID

The term “Last parent folder identity” defines the identity of the mailbox folder that hosts the emails before deletion.

The identity of the last parent folder appears as a property named LastParentFolderID.

In case we want to restore only deleted items in a specific folder, we use the -LastParentFolderID parameter.

For example

Get-RecoverableItems Jeff -LastParentFolderID 9B52034A478A6141B401DF3BF7851B460000000015E0

Additional options for displaying results

Group by

To display all deleted items grouped by “item type” we can use the following PowerShell syntax:

Get-RecoverableItems jeff | Format-list Subject,SourceFolde -Groupby itemclass

Export Information

To export information about all deleted items from a mailbox, we use the following PowerShell command syntax:

Get-RecoverableItems jeff | Export-csv c:\temp\2.csv