Entra / Microsoft 365 · Exchange Online
Report recoverable items (PowerShell)
Report items stored in the Exchange Online Recoverable Items folder using the Get-RecoverableItems cmdlet.
Connect & set up
Run these once per session. All scopes are read-only unless the script makes changes.
Connect-ExchangeOnline -SkipLoadingCmdletHelp
Run it
The main script. Copy it, or download the .ps1 and run it from your console.
param([int] $LookbackDays = 365,[string] $StartDate = "Get-Date ($StartDate) -format "dd-MMM-yyyy hh:mm",[string] $EndDate = (Get-Date))$Modules = Get-Module | Select-Object -ExpandProperty NameIf ("ExchangeOnlineManagement" -notin $Modules) {Write-Host "Connecting to Exchange Online..."Connect-ExchangeOnline -SkipLoadingCmdletHelp}[datetime]$StartDate = (Get-Date).AddDays(-$LookbackDays)[datetime]$EndDate = Get-Date -format "dd-MMM-yyyy hh:mm"Write-Host "Scanning for mailboxes..."[array]$Mbx = Get-ExoMailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Sort-Object DisplayNameIf (!($Mbx)) {Write-Host "No mailboxes found - exiting!"; break}Write-Host ("Processing {0} mailboxes..." -f $Mbx.Count)$Report = [System.Collections.Generic.List[Object]]::new()ForEach ($M in $Mbx) {Write-Host ("Processing mailbox {0}" -f $M.UserPrincipalName) -ForegroundColor Yellow[array]$Items = Get-RecoverableItems -Identity $M.UserPrincipalName -SourceFolder RecoverableItems `-FilterStartTime $StartDate.toString() -FilterEndTime $EndDate.toString() -ResultSize Unlimited | `Sort-Object {$_.LastModifiedTime -as [datetime]}# If some items are returned, report themWrite-Host ("Found {0} items" -f $Items.Count)ForEach ($Item in $Items) {$DateOfRecord = [datetime]::ParseExact($Item.LastModifiedTime, "MM/dd/yyyy HH:mm:ss", $null);$ReportLine = [PSCustomObject][Ordered]@{Mailbox = $M.UserPrincipalNameSubject = $Item.Subject'Last Modified Time' = Get-Date ($DateOfRecord) -format 'dd-MMM-yyyy HH:mm'LastParent = $Item.LastParentPathItemClass = $Item.ItemClass}$Report.Add($ReportLine)}}Write-Host ("Details of {0} items from Recoverable Items reported from {1} mailboxes" -f $Report.count, $Mbx.count)$Report | Out-GridView -Title ("Items found in Recoverable Items folder from {0}" -f $StartDate)$Report | Export-CSV -Encoding utf8 c:\temp\RecoverableItemsFiles.csvWrite-Host "Output CSV file available in c:\temp\RecoverableItemsFiles.csv"
Parameters
ParameterDefaultNotes
-LookbackDays365Number of days back to filter recoverable items by received date.-StartDateGet-Date ($StartDate) -format "dd-MMM-yyyy hh:mmStart of the reporting window.-EndDate(Get-Date)End of the reporting window.Attribution
Author
Office365itpros