Microsoft provides a way for Outlook users to recover items after they have emptied from the Deleted Items Folder. However, if the user has hard-deleted the item (i.e. SHIFT+DEL), then the item bypasses the Deleted Items Folder and is normally non-recoverable from the Outlook client.
DigiScope provides administrators the ability to quickly find and recover hard-deleted items as well as items emptied from the Deleted Items Folder.
NOTE: Restoration of deleted items via SingleTouch or the Restore Wizard is disabled by default to avoid unwanted recovery of items marked as deleted. So to recover deleted items via the SingleTouch or Recovery Wizard actions, you must enable this ability among the SingleTouch/Restore Wizard Options. Alternately, you may use the Drag-N-Drop functionality (which is not governed by this setting) to recover the deleted items to the desired location.
These are items that go through a normal delete process.
The user selects the items they want to delete, right-clicks
and chooses Delete, which
places them in the Deleted Items
Folder.
At this point, the user could easily recover the items by simply dragging
and dropping them from the Deleted
Items Folder back to the desired location.
However, if at some point in the future the user right-clicks
on the Deleted Items Folder
and selects Empty "Deleted Items"
Folder, the items appear to be non-recoverable.
The reality is these messages are marked with the "ptagDeletedOnFlag" attribute so they are hidden
from view and will remain in a recoverable state until the Deleted Item Retention threshold is reached.
Many users are unaware of this capability, which of course means administrators
have to go to the user's desk, or remote in, to demonstrate Outlook's
Recover Deleted Items feature.
Even when users become aware of this feature, they quickly discover
its functional limitations and, since it is not a feature they use
often, they end up calling the Administrator for help the next time
they need to know how to recover deleted emails in Outlook. .
These are items that bypass the normal soft-delete process.
The user finds items they want to delete and then holds down the Shift key and hits the Delete key (SHIFT+DEL).
The user sees a dialog similar to this:
The user clicks Yes.
The item skips moving to the Deleted
Items Folder, and instead the "ptagDeletedOnFlag" attribute is set immediately
so that the item becomes hidden and seems to have been permanently
deleted.
However, once again, the data is recoverable until the Deleted Item Retention threshold is reached.
Whether the user is executing the hard-delete function for legitimate or nefarious reasons, these items can be quickly found and recovered by either:
Applying a filter to show only deleted items, and browsing the specific folders (Inbox, Calendar, Contacts, Sent Items, etc.) where the items are expected; or
Performing a search of the entire mailbox, specifying in the search settings to include Deleted Items in the results.
Whichever approach you use, deleted items will appear as grayed out items that can be rapidly recovered or exported.
From Exchange 2010 on, the Dumpster has been redesigned so that:
Exchange Dumpster data moves with the mailbox during a mailbox move/migration action.
Dumpster data is indexed and discoverable by search.
Dumpster data is now stored on a per-mailbox basis, rather than a per-folder basis. From an end-user perspective, this means that deleted data is now easier to recover because the Recover Deleted Items tool will now expose deleted data across the entire mailbox.
Dumpster 2.0 no longer flags emails with the "ptagDeletedOnFlag"
attribute when they are emptied from the Deleted Items folder or are hard-deleted.
Instead, Dumpster 2.0 moves the emails to a special new folder in
the user's mailbox called Recoverable
Items. (Note this folder exists in a section of the mailbox
that cannot be viewed by any client-side mail clients such as Outlook;
however DigiScope exposes this folder and all sub folders so that you
can take appropriate actions.)
Inside the Recoverable Items folder,
there are three sub folders, each with a different purpose:
Deletions - The Deletions folder replaces the ptagDeletedOnFlag view that was displayed when a user accessed the Recover Deleted Items tool. When a user soft deletes or performs an Outlook hard delete against an item, the item is moved to the Recoverable Items folder.
Purges - For more information, please see Single Item Recovery in Exchange.
Audits & Versions - For more information, please see Single Item Recovery in Exchange.
Continue to Exporting Data