Restoring Hard & Soft Deleted Items

Microsoft provides a way for Outlook users to recover items after they have emptied from the Deleted Items Folder.  However, if the user has hard-deleted the item (i.e. SHIFT+DEL), then the item bypasses the Deleted Items Folder and is normally non-recoverable from the Outlook client.

DigiScope® provides administrators the ability to quickly find and recover hard-deleted items as well as items emptied from the Deleted Items Folder.

NOTE:  Restoration of deleted items via SingleTouch or the Restore Wizard is disabled by default to avoid unwanted recovery of items marked as deleted.  So to recover deleted items via the SingleTouch or Recovery Wizard actions, you must enable this ability among the SingleTouch/Restore Wizard Options.  Alternately, you may use the Drag-N-Drop functionality (which is not governed by this setting) to recover the deleted items to the desired location.

 

Soft-Deleted Items

These are items that go through a normal delete process.

  1. The user selects the items they want to delete, right-clicks and chooses Delete, which places them in the Deleted Items Folder.

    At this point, the user could easily recover the items by simply dragging and dropping them from the Deleted Items Folder back to the desired location.

  2. However, if at some point in the future the user right-clicks on the Deleted Items Folder and selects Empty "Deleted Items" Folder, the items appear to be non-recoverable.

    The reality is these messages are marked with the "ptagDeletedOnFlag" attribute so they are hidden from view and will remain in a recoverable state until the Deleted Item Retention threshold is reached.

    Many users are unaware of this capability, which of course means administrators have to go to the user's desk, or remote in, to demonstrate Outlook's Recover Deleted Items feature.  Even when users become aware of this feature, they quickly discover its functional limitations and, since it is not a feature they use often, they end up calling the Administrator for help the next time they need to know how to recover deleted emails in Outlook. .

 

Hard-Deleted Items

These are items that bypass the normal soft-delete process.

  1. The user finds items they want to delete and then holds down the Shift key and hits the Delete key (SHIFT+DEL).

  2. The user sees a dialog similar to this:

    Perma-Delete.png

  3. The user clicks Yes.

  4. The item skips moving to the Deleted Items Folder, and instead the "ptagDeletedOnFlag" attribute is set immediately so that the item becomes hidden and seems to have been permanently deleted.

    However, once again, the data is recoverable until the Deleted Item Retention threshold is reached.

 

Whether the user is executing the hard-delete function for legitimate or nefarious reasons, these items can be quickly found and recovered by either:

Whichever approach you use, deleted items will appear as grayed out items that can be rapidly recovered or exported.

 

Exchange 2010/2013/2016 Dumpster 2.0

From Exchange 2010 on, the Dumpster has been redesigned so that:

Dumpster 2.0 no longer flags emails with the "ptagDeletedOnFlag" attribute when they are emptied from the Deleted Items folder or are hard-deleted.  Instead, Dumpster 2.0 moves the emails to a special new folder in the user's mailbox called Recoverable Items.  (Note this folder exists in a section of the mailbox that cannot be viewed by any client-side mail clients such as Outlook; however DigiScope exposes this folder and all sub folders so that you can take appropriate actions.)

Inside the Recoverable Items folder, there are three sub folders, each with a different purpose:


Continue to Exporting Data