Exchange: Recover Hard Deleted item

Posted on by

The lifecycle of a delete e-mail message in a Microsoft Exchange Environment is similar to most business garbage collection.

  1. Message is deleted (paper is put in the under desk garbage)
  2. Delete items folder is emptied (the janitor collects the garbage and puts it in the dumpster)
  3. Exchange performs maintenance to purge the deleted items (the  dumpster is collected by the garbage company)

At various stages the document may be recoverable, but it becomes increasingly difficult. Also, you can skip to the last step by performing a hard-delete (pressing shift-delete).

Recovery is as follows, respective to the numbers above:

  1. Simply check the deleted items folder, and drag back into the correct location or simply open within the deleted items folder.
  2. Right-click on the deleted items folder and choose recover deleted items. However, if you performed a hard delete from a different folder (shift-delete) they will be stored in a different recovery location – more later.
  3. At this point, you are looking to recover from backups only.

Normally an e-mail is deleted, it is moved to the Deleted Items folder (which is really nothing more than a folder). When you empty this folder it goes into a hidden recovery folder which is cleaned by the Exchange Server’s periodic maintenance (hourly, daily, etc). While most people are aware of the recovery folder, most people are not aware that when you hard delete an item (shift-delete) from a folder, it goes into a specific recovery folder for that folder — in other words, every folder or sub-folder you have (inbox, sent items, subfolder, etc) each has their own recovery folder. However in Outlook 2003 and prior, this is a hidden feature which you must enable via a registry hack:

  • Press “Windows Key+R” to open the “Run” dialog. Type “regedit” and then click “OK”.
  • Navigate to “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options”.
  • Right-click the Options subkey and select “New”. Next select “DWORD Value”.
  • For the DWORD name, type “DumpsterAlwaysOn” (without the quotes), and then press “Enter”.
  • On the right side, double-click “DumpsterAlwaysOn”.
  • In the Value data box, type “1″ (without the quotes), and then click “OK”.
  • Close the registry editor, and close and restart Outlook.

    • Enjoy