恢复在EXCHANGE2003中删除的对象（图文）

先把原版奉上，翻译文将在近期发布！

Recovering Deleted Items in Exchange Server 2003 (Part 1)

This article explains how to recover deleted items at the mailbox store level and in Public Folders

 

Introduction

This article is divided in two parts; in the first, we will explain how to recover deleted items at the mailbox store level. In the second part, we will discuss recovery of deleted items in Public Folders. In each article we will show the two kinds of settings to be configured: server side and client side.

In this article we will talk about a subject that was discussed on the Exchange Server forums, Disaster Recovery scenarios. The most important actions to take when you have a disaster is to identify what situation your environment is in, and get to know the product in order to take the appropriate actions to restore the environment/users as soon as possible and without any problems.

Before we start, you have to be sure that the backup is reliable and you can successfully restore it on your test environment.

We are going to discuss some ways of how to recover items before restoring the complete environment, which may generate more work for the administrator, or where the user can restore deleted messages without administrator intervention.

Note:
This article is not intended to be used as the only way to recover messages. It should be used as a process of recovery, decreasing restore time for deleted items, not as a complete backup solution. This process can be used together with another Exchange Server backup solution or product feature (Recovery Storage Groups, Restore online and offline).

Understanding soft delete and hard delete in an Exchange Server environment

There are two types of deletion in an Exchange Server environment: hard delete and soft delete.

Soft Delete Type: Happens when a message is deleted by pressing the DELETE key and goes to Deleted Items folder.

Hard Delete Type: Happens when a message is deleted by pressing the SHIFT and DELETE keys and it is automatically removed.

Messages are hard deleted in the following scenarios:

• Using Microsoft Outlook you press SHIFT+DELETE to delete a message.
• Working on an Internet Message Access Protocol 4 (IMAP4) client or another type of client that does not first move the message to the Deleted Items folder.
• Moving your message to a PST file.

Configuring the Exchange Server

Before you think about data recovery, it is very important to plan how you will maintain this data. By default, Exchange server allows us to keep all deleted messages for 7 (seven) days and all deleted accounts for 30 (thirty) days. This limit can be customized and we can adjust this setting depending on our needs. It is very important to ensure that you have enough hard disk space in order to be able to increase the number of days for keeping deleted items.

All these settings are at mailbox store level, so you should follow these steps:

1. Open Exchange System Manager
2. Expand Administrative Groups
3. Expand <Administrative Group>
4. Expand Servers
5. Expand <Your Server>
6. Expand <Storage Group>
7. Right click on <Mailbox store>, click Properties and then click on tab Limits (Figure 1)

Figure 1: Mailbox Store properties, you have to define how many days a message stays in the mailbox store

This setting is located at mailbox store level. In other words, all the users will have 7 (seven) days to recover a hard deleted message. But in some cases there might be special users such as Presidents, Managers, CIOs and so on… For these cases, we can use different values.

To do this, we can follow these steps: open Active Directory Users and Computers, double-click on the user, click the Exchange General tab and then click on Storage Limits. In the Storage Limits page (Figure 2) we can define a different number of days than the other users. (For the purpose of this example, the number is higher)

Figure 2: Changing default settings for a specific user

Recovering Deleted Messages from Outlook

By default, all of the messages that we have deleted through the Deleted items folders can be recovered in the Outlook client. To do that, click on Tools, and then select Recover Deleted Items (Figure 3), this process is called soft delete.

Figure 3: Click on Deleted Items and then Tools / Recover Deleted Items

Figure 4 shows all of the deleted items within the Deleted Items folder. In this screen, you will have two choices: delete the selected messages permanently (third button) or recover the specified messages (second button) to its original folder (Deleted Items folder).

Figure 4: All of the messages in the Deleted Items folder

By default, the feature above works only with the Deleted Items folder (soft delete), but if a message is deleted using Shift + Delete (hard delete) from another folder, it will not appear in the Recover Deleted Items of the Deleted Items folder, or in another common case: when an user moves messages from his/her mailbox (Inbox, Sent Items) to a .pst file.

You can roll back this situation by modifying the registry. You will have to add an entry called DumpsterAlwaysOn in the registry of the computer that lets the Recover Deleted Items work in all of the Outlook folders.

To modify the registry, follow these steps:

1. Go to Start, select Run, type regedit and then click OK.
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options
3. Right click on right side frame, then go to New, select DWord Value, type DumpsterAlwaysOn and then complete the value field with a 1 (Figure 5)
4. Restart Outlook

Figure 5: Adding the value DumpsterAlwaysOn

After that registry modification, you will be able to use the Recover Deleted Items feature for all Outlook folders.

Note:
When you export messages from your Inbox to a *.pst file, all the messages moved in this process will be considered as hard deleted from the Inbox.

Recovering Deleted Items through OWA

You can also recover deleted items when using Outlook Web Access. We can see the Recover Deleted Items icon in the Deleted Items folder (Figure 6).

Figure 6: The Recovery Deleted Item on Deleted Items folder

This button does not appear in other folders, so, when we do a hard delete using Outlook Web Access, we cannot see the deleted message.

Testing the recovery process with Outlook Web Access

To test the OWA recovery process, you can access any user mailbox and then do a hard delete of two messages located on his/her Inbox folder (Figure 7). After pressing Shift + Delete, you will see a dialog box, click OK to continue.

Figure 7: Deleting two messages from inbox with Shift + Del (hard delete)

In order to recover the messages that were accidentally deleted from the Inbox folder, we will have to use the following syntax in Internet Explorer to get access to the deleted items:

http://<server>/exchange/<user>/<folder>/?cmd=ShowDeleted
Where:
<server> : Server name
<user> : user who has deleted some important messages
<folder> : Folder that the important messages were deleted

We can now see a new page with all the messages that were hard deleted in the Inbox folder. (Figure 8).

Figure 8: Recovering Deleted Items

In the Recover Deleted Items page, you will have two options for each message: Recover the selected message or permanently delete it from the Exchange database.

Tips for the Recover Deleted Items feature

Here are answers to some frequently asked questions about Recover Deleted Items:

Tip #1: How can I recover hard deleted items in folders that have spaces?

It’s easy. You should use %20 between words. Here are some examples:

• I’m Brazilian and my Inbox is called “Caixa de Entrada”, so to recover deleted items, I use this syntax:
  http://<server>/exchange/<user>/Caixa%20de%20Entrada/?cmd=ShowDeleted

Tip #2: Which versions of Microsoft Outlook can use the Recover Deleted Items feature?

The Microsoft KB Article 246153 mentions the following versions:

• Microsoft Outlook 97
• Microsoft Outlook 98
• Microsoft Outlook 2000
• Microsoft Outlook 2002
• Microsoft Outlook 2003

Tip #3: Can I recover Notes and Contacts with the Recover Deleted Items feature?

Yes, but you will have to use Outlook 2000 or higher to do this. If you are using an older version (Outlook 97 and 98) you will only be able to recover mail items.

Messages deleted out of the defined period of Keep deleted Items for

When deleted messages are older than the Keep deleted Items for value, you should use Recovery Storage Group to restore the data. My fellow MVP Henrik Walther has written an article about this feature. This article can be found at http://www.msexchange.org/tutorials/Exchange-Dial-tone-Restore-Method-Part1.html

Conclusion

In this article we verified how a user can recover deleted items in their mailbox. This article should not be used as the only recovery method. In the next article, we will see how to recover deleted items in Public Folder stores.

More Information:

How to recover items that have been hard deleted in Outlook

 

Recovering Deleted Items in Exchange Server 2003 (Part 2)

How to configure the deleted items retention period on Public Folders and how to recover deleted items from Public Folders using Outlook client.

 

Introduction

It has been a while since I released the first article of this series here at MSExchange.org. In the first article we looked at how to recover deleted items using Outlook Web Access (OWA) and Outlook 2003 client. Since then, Exchange Server 2007 and Outlook 2007 were released and they have been out there for a while.

In this article we are going to look at the changes in the Recover Deleted Items in Exchange Server 2007 and Outlook 2007. We will then go into the Recover Deleted Items feature to recover items deleted in Public Folders.

Changes in Outlook 2007…

In the first article we saw how to add the DumpsterAlwaysOn registry key in a workstation with Outlook client installed. This procedure will enable the item “Recover Deleted Items...” under Tools menu, right?

If you have Outlook 2007 installed you do not need to configure anything. By default, Outlook 2007 has the Recover Deleted Item option under Tools menu. If you are going to upgrade your clients to the newer version you do not need to worry about that registry key anymore. If you are distributing the registry key through a script or something similar, you can stop and save some time during your logon script. If you apply that registry on Outlook 2007, it will not affect anything on the client because Outlook 2007 has that key set already.

Configuring Deleted Items on Exchange Server 2007

Exchange Server 2007 is quite different from Exchange Server 2003, however, the Deleted Items configuration on the server side has not changed significantly. The biggest difference between the two is that we can also change it using command line (Exchange Management Shell), which we could not do in the previous version.

In order to change the deleted items limit for Exchange Server 2007, we can perform either of these steps:

To change using Exchange Management Console, open it, expand Server Configuration, expand Mailbox, click on the mailbox server on the right side, right-click on the database that is located in the Work Panel and click Properties. Then, click on Limits tab and there it goes, the configuration is there like we had on Exchange Server 2003.

Note:
In Exchange Server 2007 all mailbox database are configured to keep deleted items for 14 days.

If you like command-line, you can use Exchange Management Shell to get the work done. To do so, just open Exchange Management Shell and type in Get-MailboxDatabase to list all databases of the current server. Then, you can run Get-MailboxDatabase <Database Name> | fl to get all attributes of a specific database. In our article we just want to get the number of days that a deleted item is kept in our database. To accomplish such a task we can run the following cmdlet:

Get-MailboxDatabase | Select Name, DeletedItemRetention

The cmdlet above will be enough to list all databases and list their names and deleted item retention information. In order to change the value of DeletedItemRetention attribute, we can use this cmdlet:

Set-MailboxDatabase <Database Name> -DeletedItemRetention  30.0:0:0

Note:
In our cmdlet above we are changing the number of days to 30. The value can be expressed in the following format: Days.Hours:Minutes:Seconds

Configuring Exchange Server 2003/2007 Public Folders deleted items retention

Okay, now that we are on the same page regarding the Recover Deleted items retention in both versions of Exchange Server, we are going to validate the configuration on the Public Folder. The Public Folder can be configured to keep deleted items in two different places: at Public Folder store level or Folder level. By default, the folder level retention configuration follows the Public Folder database settings, however, if you define a value at folder level it will take precedence and the value defined at folder level will be used.

Let us start changing the Public Folder level in both Exchange Server versions, as follows:

Using Exchange Server 2003, we can open Exchange System Manager, expand Administrative Groups, Expand <Administrative Group Name>, expand <Server name>, expand <Storage Group Name>,  right click on the Public Folder store and click Properties, then click on Limits tab. We are able to define how many days a deleted item will be kept in the dumpster of the Public Folder database and if we are going to wait for a backup before deleting any item permanently, as shown in Figure 01.

Figure 01

Using Exchange Server 2007, we just need to open Exchange Management Console, expand Server Configuration, and click on Mailbox item, click on Mailbox Server on the right side and then right-click on the Public Folder store and click Properties. Then, click on Limits tab and you can define the same value we saw previously on Exchange Server 2003.

To avoid a single recover deleted item configuration in a Public Folder store, an administrator can define different limits at folder level and it takes precedence on the Public Folder store level. Here we can see that we have some differences between the versions. Using Exchange Server 2003, we just need to open the Public Folder hierarchy and right click on a folder which would show the limits tab which would allow us to configure the retention limits.

On the other hand, using Exchange Server 2007 we did not have a similar tool until the release of Service Pack 1of the product. So if you have the RTM version, the only way to do so is by using Exchange Management Shell. If you have SP1 installed then you have a tool called Public Folder Management Console which allows Public Folder management through GUI.

In order to change the recover deleted item retention limit at folder level on Exchange Server 2007 SP1, you can open the Exchange Management Console, click on the Tools item on the left, and then click on Public Folder Management Console on the right. Expand Default Public Folders, and click on a folder and a Properties item will be displayed in the Toolbox Actions. Clicking on it will reveal the Limits tab, the default configuration is set to Use database retention values. In order to change this, uncheck this option and define the new number of retention days.

Recovering Deleted Items in a Public Folder scenario

When we delete an item from a Public Folder it is always a hard deletion process which means it does not go to any Deleted Folder. In order to recover a deleted item from a Public Folder we just need to select the folder where the message was deleted and click on Tools and then Recover Deleted Items, as shown in figure 02.

Figure 02

This procedure can be also used to recover sub folders deleted in a Public Folder. When you recover a folder, the folder name will receive a prefix (Recovered) and all the messages existent at the deletion time will be recovered as well.

Sometimes, we just need to visualize the dumpster content and sometimes you do not have Outlook handy, so here are two possible options to visualize the Public Folder dumpster content:

The first one is by using the Exchange MAPI Editor and a second option is using PFDAVAdmin, where there is a radio button that allows an administrator to list the content of the dumpster, as shown in Figure 03.

Figure 03

Conclusion

In this article we saw what has changed since the my last article related to Recover Deleted Item features in Outlook 2007/Exchange Server 2007. We have also seen how to configure and use the same feature with Public Folders