Recover Deleted Items

The VT Exchange team frequently are asked to recover missing email that users have accidentally deleted, intentionally deleted at a prior time but now want back, or just seems to be missing. This process used to require our going to nightly backup tapes and recovering the data that way but it was very time-intensive, a single desired mail message would need an entire Exchange database be recovered and sifted through, literally tens of gigs of data to find a single 1kb message. But with Exchange 2007 and increased server storage allotment we can now offer functionality called Recover Deleted Items that the end-user can quickly and easily use to restore missing email from their own workstation.

Recover Deleted Items (or RDI for short) is a process where mailbox data is never truly deleted at user command but flagged as to-be-deleted then hidden out of the way from the user. For example, if you empty your Deleted Items folder of 10 undesired messages and it now appears to be empty, those 10 messages aren't truly gone but hidden "behind the scenes" of Outlook. The Exchange server then hangs onto that data for X number of days as defined by the Exchange Team at which time it truly is deleted, freeing up space on the user's mailbox.

RDI messages can be recovered by accessing its controls within the Outlook client. In Outlook 2007/2010 it can be found under the Folder ribbon and is simply called Recover Deleted Items, in previous versions its under the Tools section. By default, RDI looks in the Deleted Items folder for recoverable messages as typically all deleted items end up there first. But since items in Outlook can be "hard deleted" without ever hitting the Deleted Items folder (by holding down Shift while pressing Delete, or programmatically by third-party devices like Blackberries) one can also check other folders for items flagged for future deletion. In Outlook 2007-2010 any folder can be checked by highlighting the desired folder then running the Recover Deleted Items tool. Outlook 2003 only looks in Deleted Items but a registry chance can allow it to look anywhere as well. To make the registry change follow the below steps:

1) Close Outlook.
2) Open the Windows registry editor by going to start, run, type in regedit.
3) Navigate to My Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\Client\Options.
4) On the Edit menu, point to New, and then click DWORD Value.
5) Type the name "DumpsterAlwaysOn", no spaces, include the caps.
6) Set the DWORD value to "1".
7) Restart Outlook.

Recover Deleted Items is set by the Exchange Team to last for the same number of days as our nightly tape backup rotation lasts, typically 14 days but this value increases or decreases occasionally depending on our storage capacity. By definition everything that is possibly recoverable from tape is recoverable from RDI, and since RDI is so much simpler, easier, and quicker to use it will always be the data recovery method used to find missing user data. If something is not found in RDI then it will not be findable on tape. This needs to be stressed - RDI is THE user data recovery method, going to tape is for disaster recovery operations where the entire server is lost to catastrophic failure, we do not perform from-tape recoveries for users as there isn't a need since RDI will contain the same data as the tapes.

If a user reports being unable to find missing data via RDI we will ask for permission to access their mailbox with a Exchange Administrator account to perform the RDI search ourselves but they need to perform due diligence and at least attempt to recover their data before asking us to do the work for them, RDI is not a complicated process and if running a current version of Outlook they need not even worry with that DumpsterAlwaysOn change which can be a bit much to expect from the typical user.

Data older than 14 days is likely past both the RDI and tape retention recovery windows of opportunity. Please check with the Exchange Team if missing data happens to be outside the timeframe as we might have extended the retention period, we have been up to 21 days in the past (and down to 7). If the user reports missing data from months ago there is nothing we can do to assist. Note that retention is from *deletion* date, if you possess an email received years ago and delete it today it would still be recoverable up to 14 days from now.

Thats covers it! Deleted email? Use RDI. Missing email? RDI. "But I didn't delete it, it just disappeared"? RDI.