Understanding Recoverable Items
Applies to: Exchange Server 2010 SP3, Exchange Server 2010 SP2
To protect from accidental or malicious deletion and to facilitate discovery efforts commonly undertaken before or during litigation or investigations, Microsoft Exchange Server 2010 introduces the Recoverable Items folder. The Recoverable Items folder replaces the feature known as the dumpster in Exchange Server 2007. The Recoverable Items folder is used by the following Exchange features:
Deleted item retention
Single item recovery
Litigation hold
Mailbox audit logging
Contents
Terminology
Recoverable Items Folder
Recoverable Items Mailbox Quotas
Terminology
Knowledge of the following terms will help you understand the content in this topic.
- Delete
Describes when an item is deleted from any folder and placed in the Deleted Items default folder.
- Soft delete
Describes when an item is deleted from the Deleted Items default folder and placed in the Recoverable Items folder. Additionally describes when a Microsoft Outlook user deletes an item by pressing Shift+Delete, which bypasses the Deleted Items folder and places the item directly in the Recoverable Items folder.
- Hard delete
Describes when an item is marked to be purged from the mailbox database. This is also known as a store hard delete.
Return to top
Recoverable Items Folder
To better meet customers' legal compliance requirements, the dumpster is reinvented as the Recoverable Items folder in Exchange 2010. The Recoverable Items folder resides in the non-IPM subtree of each mailbox. The non-IPM subtree is a storage area within the mailbox that contains operational data about the mailbox. This subtree isn't visible to users using Outlook, Microsoft Office Outlook Web App, or other e-mail clients.
This architectural change provides the following key benefits:
When a mailbox is moved to another mailbox database, the Recoverable Items folder moves with it.
The Recoverable Items folder is indexed by Exchange Search and can be discovered using Multi-Mailbox Search.
The Recoverable Items folder has its own storage quota.
Exchange can prevent data from being purged from the Recoverable Items folder.
Exchange can track edits of certain content.
The Recoverable Items folder contains the following subfolders:
Deletions This subfolder contains all items deleted from the Deleted Items folder. (In Outlook, you can soft delete an item by pressing Shift+Delete.) This subfolder is exposed to users through the Recover Deleted Items feature in Outlook and Outlook Web App.
Versions If either litigation hold or single item recovery is enabled, this subfolder contains the original and modified copies of the deleted items. This folder isn't visible to end users.
Purges If either litigation hold or single item recovery is enabled, this subfolder contains all items that are hard deleted. This folder isn't visible to end users.
Audits If mailbox audit logging is enabled for a mailbox, this subfolder contains the audit log entries. To learn more about mailbox audit logging, see Understanding Mailbox Audit Logging.
Deleted Item Retention
An item is considered to be soft deleted in the following cases:
A user deletes an item or empties all items from the Deleted Items folder.
A user presses Shift+Delete to delete an item from any other mailbox folder.
Soft-deleted items are moved to the Deletions subfolder of the Recoverable Items folder. This provides an additional layer of protection so users can recover deleted items without requiring Help desk intervention. Users can use the Recover Deleted Items feature in Outlook or Outlook Web App to recover a deleted item. Users can also use this feature to permanently delete an item.
Items remain in the Deletions subfolder until the deleted item retention period is reached. The default deleted item retention period for a mailbox database is 14 days. You can modify this period for a mailbox database or for a specific mailbox. In addition to a deleted item retention period, the Recoverable Items folder is also subject to quotas. To learn more, see Recoverable Items Mailbox Quotas later in this topic.
After the deleted item retention period elapses, the item is moved to the Purges folder and is no longer visible to the user. When the Managed Folder Assistant processes the mailbox, items in the Purges subfolder are purged from the mailbox database.
Single Item Recovery
If an item is removed from the Deletions subfolder, either using the Recover Deleted Items feature or by an automated process such as the Managed Folder Assistant, the item can't be recovered by the user. In previous versions of Exchange, recovering these items required the administrator to restore the mailbox database or a mailbox from backup copies. This process generally delayed recovery by minutes or hours, depending on the backup mechanism used.
Exchange 2010 introduces single item recovery, a feature you can use to recover items without having to restore the mailbox databases using backup media. This results in considerably shorter recovery periods. When the Managed Folder Assistant processes the Recoverable Items folder for a mailbox that has single item recovery enabled, any item in the Purges subfolder isn't purged if the deleted item retention period hasn't elapsed for that item. Additionally, if the user changes certain properties of an item in any mailbox folder, a copy of the item is made before the modification is written to the Exchange store. The copy is stored in the Versions subfolder by a process known as copy-on-write page protection. You can recover different versions of a modified item until the deleted item retention period elapses.
The following table lists the contents of and actions that can be performed in the Recoverable Items folder if single item recovery is enabled.
Recoverable Items folder and single item recovery
| State of single item recovery | Recoverable Items folder contains soft-deleted items | Recoverable Items folder contains modified and hard-deleted items | Users can purge items from the Recoverable Items folder | Managed Folder Assistant automatically purges items from the Recoverable Items folder |
|---|---|---|---|---|
Enabled |
Yes |
Yes |
No |
Yes. By default, all items are purged after 14 days, with the exception of calendar items, which are purged after 120 days. |
Disabled |
Yes |
No |
Yes |
Yes. By default, all items are purged after 14 days, with the exception of calendar items, which are purged after 120 days. If the Recoverable Items warning quota is reached before the deleted item retention period elapses, messages are deleted in first in, first out (FIFO) order. |
Single item recovery isn't enabled by default for new mailboxes or mailboxes moved from a previous version of Exchange. You must use the Exchange Management Shell to enable single item recovery for a mailbox, and then configure or modify the deleted item retention period. To learn more about how to enable single item recovery for a mailbox and to perform single item recovery of deleted items, see the following topics:
Litigation Hold
Exchange 2010 introduces Multi-Mailbox Search, a feature that administrators or records managers can use with delegated Discovery Management permissions to perform discovery searches of mailbox content. Exchange 2010 also introduces litigation hold, which you can use to preserve items in user mailboxes and protect the items from deletion by users or automated processes.
Placing a mailbox on litigation hold stops the Managed Folder Assistant from automatically purging messages from the Purges subfolder. Additionally, copy-on-write page protection is also enabled for the mailbox. Copy-on-write page protection creates a copy of the original item before any modifications are written to the Exchange store. After the mailbox is removed from litigation hold, the Managed Folder Assistant resumes automated purging.
The following table lists the contents of and actions that can be performed in the Recoverable Items folder if litigation hold is enabled.
Recoverable Items folder and litigation hold
| State of litigation hold | Recoverable Items folder contains soft-deleted items | Recoverable Items folder contains modified and hard-deleted items | Users can purge items from the Recoverable Items folder | Managed Folder Assistant automatically purges items from the Recoverable Items folder |
|---|---|---|---|---|
Enabled |
Yes |
Yes |
No |
No |
Disabled |
Yes |
No |
Yes |
Yes |
To learn more about Multi-Mailbox Search and litigation hold, see the following topics:
Copy-on-Write Page Protection and Modified Items
If a user who is placed on litigation hold (or has single item recovery enabled) modifies specific properties of a mailbox item, a copy of the original mailbox item is created before the changed item is written. The original copy is saved in the Versions subfolder. This process is known as copy-on-write page protection. Copy-on-write page protection applies to items residing in any mailbox folder. The Versions subfolder isn't visible to users.
The following table lists the message properties that trigger copy-on-write page protection.
Properties that trigger copy-on-write page protection
| Item type | Properties that trigger copy-on-write page protection |
|---|---|
Messages (IPM.Note*) Posts (IPM.Post*) |
|
Items other than messages and posts |
Any change to a visible property, except the following:
|
Items in the Drafts default folder |
None. Items in the Drafts folder are exempt from copy-on-write page protection. |
Important
In Exchange 2010 Service Pack 1 (SP1), copy-on-write page protection doesn't save a version of the meeting when a meeting organizer receives responses from attendees and the meeting's tracking information is updated. Also, changes to RSS feeds aren't captured by copy-on-write page protection.
When litigation hold is removed from a mailbox and single item recovery is disabled, copies of modified items stored in the Versions folder are removed.
Return to top
Recoverable Items Mailbox Quotas
When an item is moved to the Recoverable Items folder, its size is deducted from the mailbox quota and added to the size of the Recoverable Items folder. In Exchange 2010, mailbox databases have a configurable Recoverable Items warning quota (soft limit) of 20 gigabytes (GB) and a Recoverable Items quota (hard limit) of 30 GB. By default, these limits are inherited by all mailboxes in the database. However, you can configure individual mailboxes with different quotas. To learn more, see Configure Deleted Item Retention and Recoverable Items Quotas.
When the Recoverable Items folder for a mailbox reaches the Recoverable Items quota, no more items can be stored in the folder. This impacts mailbox functionality in the following ways:
Mailbox users can't delete items.
The Managed Folder Assistant can't delete items based on retention tag or managed folder settings.
For mailboxes that have single item recovery or litigation hold enabled, the copy-on-write page protection process can't maintain versions of items edited by the user.
For mailboxes that have mailbox audit logging enabled, no mailbox audit log entries can be saved in the Audits subfolder.
For mailboxes that aren't placed on litigation hold, the Managed Folder Assistant automatically purges items from the Recoverable Items folder when the deleted item retention period elapses. If the folder reaches the Recoverable Items warning quota, the assistant automatically purges items in FIFO order.
When the Recoverable Items folder reaches the soft and hard limit defaults, you are notified by means of an event log and a Microsoft System Center Operations Manager alert. This alert fires when the Recoverable Items folder first reaches the soft and hard limit defaults, and then once daily afterward.
The following table lists the events logged when the Recoverable Items folder reaches the soft and hard limit defaults.
Recoverable Items quota warnings and errors
| Event ID | Type | Source | Message |
|---|---|---|---|
10024 |
Warning |
MSExchangeIS Mailbox Store |
The mailbox for <mailbox user> (GUID) has exceeded the Recoverable Items Warning Quota. Please remove items from Recoverable Items or increase the Recoverable Items Warning Quota and Recoverable Items Quota. If the Recoverable Items Quota is exceeded, the user will be unable to delete items from the mailbox. |
10023 |
Error |
MSExchangeIS Mailbox Store |
The mailbox for <mailbox user> (GUID) has exceeded the maximum Recoverable Items Quota. Items cannot be deleted from this mailbox. The mailbox owner should be notified about the condition of the mailbox as soon as possible. Please remove items from Recoverable Items or increase the Recoverable Items Quota to restore functionality. |
10023 |
Warning |
MSExchangeMailboxAssistants |
The mailbox:<mailbox user> Recoverable Items size has exceeded the warning quota limit. Items were deleted from Recoverable Items folders to prevent mailbox outage. Recoverable Items Warning Quota: 20 GB (21,474,836,480 bytes) Original Recoverable Items size: 21475005311 Current Recoverable Items size: 21474823820 Folder stats: - Folders processed: RecoverableItemsRoot, RecoverableItemsVersions, RecoverableItemsPurges, RecoverableItemsDeletions - Original folder sizes: 21391661934, 55190914, 1987247, 26157788 (item counts: 276828, 400, 84, 646) - Current folder sizes: 21391480443, 55190914, 1987247, 26157788 (item counts: 276817, 400, 84, 646) |
If the mailbox is placed on litigation hold, copy-on-write page protection can't maintain versions of modified items. To maintain versions of modified items, you must reduce the size of the Recoverable Items folder. You can use the Search-Mailbox cmdlet to copy messages from the Recoverable Items folder of a mailbox to a discovery mailbox, and then delete the items from the mailbox. Alternatively, you can also raise the Recoverable Items quota for the mailbox. For details, see Clean Up the Recoverable Items Folder.
Return to top
© 2010 Microsoft Corporation. All rights reserved.