Litigation Hold, Single Item Recovery, & Mailbox Database Deleted Items Retention

Hello
I'm looking for a simple explanation of how the three features mentioned in the subject line interact and affect one another.
Specifically, I'm after the answer to the following question:
If a users mailbox has litigation hold enabled, and the mailbox database it lives on has a deleted items retention value of 365 days, does that users "Recoverable Items" get deleted after 365 days, or does litigation hold, as I supspect bypass the retention
value?
If Single Item Recovery is enabled for said user as well, and added to the scenario above - how does this affect the retention of the deleted items?
I cannot find a definitive article that describes mailbox database deleted items retention, litigation hold and single item recovery and their behaviours when used together.
Regards
Matt
Matt

Hello again,
Just wanted to open this thread up again, and gain some further clarification, specifically on the behaviour of items in "Recoverable Items\ Deletions" folder.
In the following scenario how will items be processed:
-SingleItemRecoveryEnabled -True
-LitigationHoldEnabled - True
-UseDatabaseRetentionDefaults -True
-Items in the Deletions folder have passed the retention value date as specified on the database.
Given the parameters above, when the I run the Managed Folder Assistant against a mailbox, I'm expecting to see the items in the Deletions folder move, and be placed in Purges folder.
This is not happening however, items are only removed from the Deletions folder when LitigationHold is disabled. Then, items bypass the Purges folder altogether and are removed from the mailbox/database altogether.
I referred to the article below for clarification:
http://blogs.technet.com/b/exchange/archive/2009/09/25/3408389.aspx#_Short-Term_Preservation_of
"...the message was not purged from the mailbox store. Instead the message was moved from the Recoverable
Items\Deletions folder to the Recoverable Items\Purges folder. All store hard-deleted items end up in this folder when single item recovery is enabled. The Recoverable Items\Purges folder is not visible to the end user, meaning that they do not see data retained
in this folder in the Recover Deleted Items tool.
When the message deletion timestamp has exceeded the deleted item retention window, Records Management will purge the item."
Can anyone assist in explaining the behaviour I'm observing?
I'm in a transition period where by our organisation has been journalling all
email to an Online service since 2008 and this service will continue to be used solely as our archiving and compliance mechanism.
Since Exchange 2010 was adopted by the company around 18 months ago, the previous mail administrator had litigation hold enabled on all mailboxes
from the outset, so I'm in the position now where by I have two retention methods running side by side.
Long story short, the online archiving will be used moving forward and litigation hold will be disabled within Exchange.
What I want to do is transition from long term data
preservation inside Exchange, to short term preservation - hence the reason for now enabling SIR.
Currently I have mailboxes with 10's of GB's of mail sat in the "Recoverable Items\Deletions" folder, and very little, if anything in some
cases, in the respective "Purges" folder.....
Can anyone advise on a "correct" procedure for making this transition?
Regards
Matt
Matt

Similar Messages

Powershell Command to permanently delete items in ALL users Deleted Items folder older than X days.

Does anyone know a powershell command that can be run on Exchange 2010 SP1 that will permanently delete mail in the deleted items folder older than X days for ALL users in a specific database? This should include any user created subfolders in deleted items
also.
I know that seems bizarre to have user created subfolders in deleted items but we have found that users have discovered that if they create subfolders then their deleted items dont get purged at the regular retention period time.
Thank You.

Hi,
For Exchange 2010 SP1, we can use search-mailbox and new-mailboxexportrequest to delete message in certain folder.
Understanding Exchange Search
http://technet.microsoft.com/en-us/library/bb232132.aspx
Xiu Zhang
TechNet Community Support

Exchange 2013 - Public Folder Mailbox and Single Item Recovery

Hello,
I recently had a request to recover some messages that an ex-employee deleted from the "recover deleted items" folder in their public folder. Since this resides on a public folder mailbox and it does have the option for
"Single Item Recovery" to be enabled on the box (which I enabled not knowing if this really works or not), is there a way I can still recovery these items or do I have to go to a backup to obtain those messages. Since ExFolders does not work that
is not an option. I've seen commands to restore a public folder that was deleted but not items that were deleted directly from a public folder. I checked using MFCMAPI and I do see the dumper root and the public folder dumpster for each folder but it
looks to be only the "deletions" folder and don't see anything similar to a "purges" type folder. Any ideas or am I stuck recovering from backup? Thanks in advance!

So I think you are stuck and will need to restore the EDB to a Recovery Database to restore the items because when the end user purged the items from the "Recover Deleted Items" it removes them from the Recoverable Items/Deletions folder.
Check out this article
http://blogs.technet.com/b/exchange/archive/2013/08/23/recovering-public-folder-information-in-exchange-2013.aspx
I have not played with the recoverable items settings on the 2013 public folder enabled mailbox EDB but you might try checking out Litigation or In Place Hold to use as a safety mechanism moving forward. That said this will also increase the
DB size so consider all the options before implementing
Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline Exchange Mailbox and Public Folder EDB's and Live Exchange Servers or Import/Migrate direct from Offline EDB to Any Production Exchange Server, even cross version i.e. 2003 -->
2007 --> 2010 --> 2013 with Lucid8's
DigiScope

Exchange Online Archive and Single Item recovery

We are currently looking to implement online archiving in Exchange 2010.
From my perspective, we are doing it to relocate the older messages to some cheaper storage, while making primary mailbox sizes are little more manageable.
Management however, want to ensure that once an item is moved to the online archive that it cannot be permanently deleted until after a 7 year retention period (for discovery purposes).
Journaling isn't an option at this point..
We have an Archive RPT which moves the items to the users archive after 90 days.
We have another RPT which will Delete items from the Archive after 7 years (Delete no Recovery).
We then have "Keep deleted Items for", set to 30 Days on the Primary Mailbox Database.
and then have "Keep deleted Items for", set to 7 years (2555 Days) on the Archive Database(this is so that items are not immediately deleted if the user manually deletes from the archive).
Obviously with this setup, users will be able to purge items from the "Deletions" sub folder (Recover Deleted Items) if they want to remove it from the archive.
My understanding is that if I enable Single Item Recovery for everyone, then the items that the user might remove from the "Deletions" sub folder will be transparently moved to the "Purges" sub folder, and are therefore discoverable
if required, up until the retention period of each database (30 days for Primary mailbox, 7 years for archive).
This sounds like exactly what we are after.
Thus my questions;
Apart from the obvious storage implications of doing this (7 years is alot of email), are there any other issues\risks associated with going down this method for email retention?
Is there a better way of achieving what we are after? I dont suppose we could completely restrict deletion access to the users archive completely for example?
If a user was to drag an item back into their primary mailbox.. and then delete it before the Managed Folder Assistant moved it back to the archive.. Would that be a potential hole in the retention requirement?
Thanking you all in advance for your insight..

You may want to use Litigation Hold to have users unable to delete the item permanently.
http://blogs.technet.com/b/exchange/archive/2011/08/16/retention-hold-and-litigation-hold-in-exchange-2010.aspx
I know it works on Active mailbox but not sure if the same attributes available for Archive Database. Just run the cmdlet and see if it can be done.
Where Technology Meets Talent

Deleted Items recovery in Outlook question

I recently implemented a policy to users deleted items boxes via Exchange Server 2007. I applied this policy to just a few users to test it out and all appears to working well. The policy is set to delete any items that hit the deleted items
folder and sit there for seven days. My question is in regards to the deleted items recovery feature in Outlook. Does the policy I created in Exchange overwrite the server deleted item retention of 30 days? So, being that I currently have
the Exchange Server deleted item retention set at 30 days when I click on my deleted items box in Outlook and then on the Recover Deleted Items option under tools I should see 30 days of deleted emails right? When I do this I only see two emails though...
Can someone help clear this up for me please? Thanks - Abacus

Hi,
What’s the version of Outlook?
Deleted item retention must be configured on the server. Otherwise, there will be no deleted items
stored in the dumpster available for recovery. By default, the DumpsterAlwaysOn
registry key is set to 1 in Outlook 2007, so all folders are enabled for deleted item recovery. By default, all folders are recoverable on the Exchange server.
In Outlook 2003 and earlier versions, only the
Deleted Items folder is enabled for recovery by default. All folders are recoverable, however, you must enable the ability to see the items in the dumpster. You must use the DumpsterAlwaysOn
registry key to recover hard-deleted items, which are those items that were deleted while holding down the SHIFT key and that were never moved to the
Deleted Items folder.
More information:
How to Recover a Deleted Item
Recover deleted items

Is it possible to prevent users from using the ''Purge'' option from the ''Recover deleted items'' in Office 365?

Hi,
After speaking with a Microsoft engineer over the phone, I've been told that there is no way to prevent users to go to their OWA and manually Purge specific items from the ''Recover deleted items''. The Microsoft tech told us to place the desired mailboxes
on a litigation-hold and that all data will be recoverable... but only from the time you place the mailbox onto Litigation-Hold and previous items, which doesn't take effect for new-coming emails.
1- From what I understand, any new items coming in the mailbox after the Litigation-Hold is put in place will still be ''purgeable'', right?
2- Is there a way (PowerShell, Security group, etc.) that can prevent a user from using the Purge option?
We are very surprised that there is absolutely no thread that talks about this issue, which in our opinion, is a major legal and security flaw from Office 365. This is a main concern for us to actually go with Office365. For instance, this means that at
any given time, if a user exchanges emails with a competitor, they can manually purge emails sent and receive as soon as it is sent/received, even after Litigation-Hold is in place.
Thank you for your reply and let us know if you have more questions.
Normand Bessette, IT support technician, Newad Media

Thank you for the reply.
Is there still a way to prevent users from using the Purge option, like with a Powershell script to disable Purge?

Emails are automatically moved to Recover deleted Items folder

Hi,
We have a user and he is receiving his emails in Inbox but after few seconds it will be automatically moved to Recover Deleted Items. We checked his Outlook and also in OWA and we couldn't see any rule. Even though I ran /cleanrules switch but still
same problem exists. Any suggesstion to resolve this issue? Thanks

Hi,
By "Recover Deleted Items folder", do you mean the Deleted Items folder or
Recover Deleted Items dialog when clicking Folder tab >
Recover Deleted Items button?
I'd like to confirm if all the received messages don’t disappear directly but still only stay in your mailbox for a short period of time before they disappeared?
Which version of Outlook are you using? Do you have the default delivery location of your mailbox set to a PST file?
In addition, some problematic add-in may also cause such issue, especially the virus scanner add-in that integrate with Outlook. If you have such add-in installed, I'd recommend you contact the vendor of the antivirus, ask them how to uninstall the
add-in or change the settings to ignore Outlook emails when scanning.
Regards,
Steve Fan
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs.

Recovering an Entire Folder from Recover Deleted Items

Question:
If an entire folder is deleted , placed in Deleted Items, then Deleted Items is emptied ... can the entire Folder be recovered to Deleted Items from
Recover Deleted Items function?
I seem to recall that this was once possible - but when I test with Outlook 2013 with my Exchange Server 2013 - only the mail items come back to Deleted Items - the original folder is not restored.

The Recoverable Items folder resides in the non-IPM subtree of each mailbox. The non-IPM subtree is a storage area within the mailbox that contains operational data about the mailbox. This subtree isn't visible to users using Outlook, Microsoft Office Outlook
Web App, or other email clients.
I would refer you on this informative technet gallery that will help you to understand this concern in depth and recover the entire folder into previous used version back :https://technet.microsoft.com/en-us/library/ee364755%28v=exchg.150%29.aspx
Also, please check this another helpful resource :https://technet.microsoft.com/en-us/library/ff660637%28v=exchg.150%29.aspx
Moreover, if you wish to manage this task automatically, you may also give a shot to this automated solution (http://www.exchangeserverrecovery.com/) that could be a good alternative approach in such critical
circumstance.

SCSM 2012 - Deleting deleted items

I have never deleted the items held in the Deleted Items folder.
There are currently 10008 configuration items in there. I have always been a bit worried about deleting these, I'm not sure if I will lose details of the incidents logged for those users who have left the company, if I can still get them back
from the datawarehouse reporting then no problem.
Am i best to delete all these items? could it cause any impact on performance if I just leave them?
tamrep

Hey
Once you delete those objects, all relationships from those in the CMDB are lost. If the information is already transfered to the DWH, the information stays there and can still be accessed.
Cheers
Marcel
Marcel Zehner // Blog --> http://marcelzehner.ch // Twitter --> @marcelzehner // Business --> http://www.itnetx.ch

Delete Item without Transactions

Hi Experts,
We have some problem on our ItemMaster, we have uploaded 5000 items on our SAP but 4000 of this Items are all obsolete. We need to delete this 4000 Items...how can we delete this system in a fast way?
Please help...
Thanks,
Richard

Hi
There are lot of thread already discussed about the same topic
Pls find the following links :
Remove Item Master Data
Re: Delete item master data using DTW
Re: How do you delete item master data?
Giridharan V

Enable single item recovery with two retention settings at the database level.

Hello All,
We have an Exchange 2010 SP3 RU4 environment and planning on moving from third party archives solution to Native Exchange archives for cost reduction purposes, upgrading to Exchange 2013 to benefit from added in place features is not within scope at
this stage.
We are looking at implementing the following steps and want to know if it will work:
1-Create archive DB(s) as per our usage and growth projections
2-Enable archives for all our users and migrate current archive content to it.
3-Create Retention Tag/Policy to move all records from live to archive "Age limit for retention" 90 days (no retention tags on the policy)
4-Enable Single Item recovery for all of our users (script the same to run twice daily to enable SIR for newly created accounts)
5-Set the "Keep Deleted Items" on the Live DB(s) to 90 days and the Archive DB(s) to 7 Years
6-We are NOT using Legal Hold or plan to use it except on per as need basis
Are we accomplishing the following:
1-Items are automatically archived after 90 days
2-Items archived now have a 7year retention based on the "keep deleted items" set for the archive DB(s)
3-Items copied back to the live mailbox by a user will be returned to the archive database the next time the folder assistant runs against this user account (based on load or if run manually)
4-Hard deleted items by a user is recoverable as long as the email record is within the retention period set at the database where it resides.
5-Hard deleted items are recoverable using MFCMapi or by a restore.
6-Items are permanently purged on the archive DB(s) after 7 years.
Any input, ideas, recommendations, clarifications would be greatly valued and appreciated.
Ash

Thanks CodexCZ,
So, SIR will "kind of" do the same as the retention tag except I can use different durations based on the limits on each DB? am I correct?
thanks again.
Ash

What is the behavior of items in an Exchange Online Inactive mailbox that were under a Litigation Hold for a set period of time.

I am specifically asking what happens to the items in an Inactive Mailbox that was placed on Litigation Hold prior to Deletion when the Litigation Hold has say a '6 mo.' Retention Period assigned.
Do any of those items 'expire' out of the mailbox? Do only the items in the 'Admin' folders of the Deleted Items get removed, or none?
I am not asking about recoverability of that mailbox, more of what the behavior is specifically when the Litigation Hold is set to expire after a certain amount of time.

There is no expiration, check the blog post here:
http://blogs.technet.com/b/exchange/archive/2013/03/21/preserve-mailbox-data-for-ediscovery-using-inactive-mailboxes-in-exchange-online.aspx
All content in an inactive mailbox is on hold until you remove the hold from the mailbox.

Deleted AD account and mailbox on Litigation Hold in Exchange 2013 CU7

Hi,
We have recently leveraged Litigation Hold and unlimited mailbox sizes in lieu of GFI MailboxArchiver.
Our user accounts admin just deleted an AD user including the mailbox in ADUC and watched it as it vanished (refresh button) in EAC.
As far as I know the mailbox should still be on the exchange server, how can I verify that? My aim is to make sure the mailbox has not been permanently deleted since we are required to maintain it for 7 years.
I have rewritten the process for the user admins, they should Disable user in ADUC, Disconnect Mailbox, Delete user in ADUC, is that the right way to delete the user but maintain the mailbox for 7 years? Command used: Get-Mailbox -ResultSize Unlimited -Filter
{RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -LitigationHoldEnabled $true -LitigationHoldDuration 2555
Tnx,
Timotatty
Timmy

Hi,
Generally, disabled and deleted mailboxes are retained in the mailbox database until the deleted mailbox retention period expires, which is 30 days by default. After the retention period expires, the mailbox is permanently deleted or
purged.
If the mailbox is still retained in database, we can run the following command to list all deleted or disabled mailbox:
Get-MailboxDatabase | Get-MailboxStatistics | where {$_.disconnectdate –ne $null} | FL displayname,MailboxGUID,DisconnectReason,DisconnectDate
If you want to retain the mailbox for 7 years, please make sure the
mailbox retention period has been set for 7 years. We can run the following command to check it:
Get-MailboxDatabase | fl Identity,*Retention*
If it is not set to 7 years, we can run the following command to set it:
Get-MailboxDatabase | Set-MailboxDatabase -MailboxRetention dd.hh:mm:ss
https://technet.microsoft.com/en-us/library/bb232039(v=exchg.150).aspx
Regards,
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Winnie Liang
TechNet Community Support

Manage "Do not permanently delete items until you back up the database" mailbox level

Hi,
I need the active directory attribute name for "Do not permanently delete items until you back up the database" at mailbox level and the EMS command for enabling/disabling
the above setting (the other settings in the following screenshot I found).
Thanks in advance!

Well, there are only 3 possible values I believe... 1 = database default, 2 = retain for custom period and 3 = Retain Until Backup Or Custom Period... However I have seen 2 doesn't work for some reason and if you have database default is not selected
and keep deleted item for x days set to something else other than default and Do not permanently delete items until you back up the database is unselected then it set the value to 5 as well.... I guess other than these possible values if anything else is set
then it will give you warning that object is corrupted.
But yes value is other than 3 then checkbox is automatically deselected set based on what value it has... in short I would check what's the value for deletedItemFlags by setting all the possible options before coming to conclusion... ;)

Single item recovery in Exchange 2013

I am looking for some help in identifying the simplest process to recover a single item in Exchange 2013 in a scenario where the item is no longer available in the dumpster (i.e. a retained deleted item).
In Exchange 2010 the process was:
Restore the mailbox database from backup to the Recovery database
Restore the item using the Restore-Mailbox cmdlet with the -AllContentKeywords parameter to identify and restore the individual item (or items) to a target folder in the user's mailbox.
The Restore-Mailbox cmdlet is no longer available in Exchange 2013.
I guess one possible option is the following:
Restore the mailbox database from backup to the Recovery database
Restore the mailbox to a dummy mailbox (or Discovery Mailbox) using New-MailboxRestoreRequest.
Use the Search-Mailbox cmdlet to find the item in the dummy mailbox and restore it to a target folder in the user's mailbox.
It just seems like a very long-winded method to restore a single item. Any way to do this better?
Alexei

Hi ,
In exchange 2013 single item recovery work as follows .
Scenario 1 : Items from the deleted items folder and also the hard deleted items (shift + delete) will move it to the dumpster (i.e deletions folder) which is an sub-folder in recoverable deleted items folder.On that deletions folder items will be retained
based upon retention period .
Scenario 2 : In case if we move the items from the deletions folder it will get move in to the purges folder (if single item recovery is enabled) .purges folder is also one more sub folder for recoverable deleted items folder .
In purges folder items will be again started to get retain for the whole retention period (I mean to say retention period count will not get calculated from the day when it moves from the deletions folder to purges) instead again that particular email item
start to get retained till the whole retention period get's over .
You can use mfcmapi tool and e-discovery search in exchange 2013 to recover the items which is moved from deletions folder to purges folder.
Reference blog : http://www.msexchange.org/articles-tutorials/exchange-server-2010/high-availability-recovery/single-item-recovery-part1.html
For an additional information litigation and In place hold is one of the feature in exchange which will retain emails for the years that you want .
http://blogs.technet.com/b/exchange/archive/2013/12/11/litigation-hold-and-in-place-hold-in-exchange-2013-and-exchange-online.aspx
Note : from 2010 on wards single item recovery feature is available.
http://blogs.technet.com/b/exchange/archive/2009/09/25/3408389.aspx
Regards
S.Nithyanandham

Litigation Hold, Single Item Recovery, & Mailbox Database Deleted Items Retention

Similar Messages

Maybe you are looking for