UPDATE 14/9/2018: Script has now moved to https://gallery.technet.microsoft.com/exchange/PowerShell-Recover-items-89f9f92e, and supports recovery to original item location. I’ve removed the script from this page, as it is outdated.
We had a request recently for a sample PowerShell script that shows how to recover deleted items from and Exchange 2010 mailbox. While not possible (as far as I am aware) using any standard Exchange cmdlets, it is certainly possible using the EWS Managed API.
The script has been written so that it can be automated quite easily. The scenario that the script was originally requested for was to be able to run such a script against a large number of mailboxes where items had been mistakenly deleted. The script parameters are:
RecoverDeletedItems [-Mailbox <string>]
-Mailbox : Mailbox SMTP email address
-Credentials: can be used to pass credentials into the script (as obtained using Get-Credential)
-Username : Username for the account being used to connect to EWS (if not specified, current user is assumed)
-Password : Password for the specified user (required if username specified)
-Domain : If specified, used for authentication (not required even if username specified)
-Impersonate : Include this switch to use impersonation.
-EwsUrl : Forces a particular EWS URl (otherwise autodiscover is used, which is recommended)
-EWSManagedApiPath : Full path to the EWS Managed API (if not specified, default paths are searched – any version should work)
-IgnoreSSLCertificate: If present, invalid (e.g. self-certified) certificates will be accepted
-AllowInsecureRedirection: this affects autodiscover only
To run this against many mailboxes, you can used an impersonation account and then list all the mailboxes in a file that can be used by PowerShell to pipe the data into the script. Script is attached to this post.
The deleted items will be restored to standard folders depending upon their item type. When an item is deleted (sent to the dumpster), there is no information kept as to which folder the item was in before it was deleted, so (as far as I am aware) it is not possible to restore to the same folder. Emails are restored to Inbox (unless they have the IsFromMe flag set, in which case they are restored to Sent Items), appointments to Calendar folder, and so on.