Single Item Recovery (Part 2)

by [Published on 8 Sept. 2011 / Last Updated on 8 Sept. 2011]

Continuing the look at the feature known as Single Item Recovery in Exchange 2010.

If you would like to read the other parts in this article series please go to:

Introduction

This is the second part of an article looking at the Exchange 2010 feature called Single Item Recovery. In part one, we discussed what Single Item Recovery is and how it differs from the dumpster found in earlier versions of Exchange. We then went on to seeing how the feature actually works but left that topic incomplete. With that in mind, let’s get straight back to finishing that topic before looking at how we should plan for the implementation of Single Item Recovery. We will then finish up by looking at how to enable Single Item Recovery.

How Single Item Recovery Works - Continued

We left part one of this article series having learnt that when a user deletes the contents of the Deleted Items folder, the messages that were stored in the Deleted Items folder are moved to the Recoverable Items\Deletions folder and are no longer visible to the user in Outlook. As we know from dumpster 1.0, it is also possible for the user to purge the contents of the dumpster from the Recover Deleted Items window that you saw in Figure 1-1 in part one of this article. You might therefore now be wondering what happens in this case with dumpster 2.0 when Single Item Recovery is enabled?

If the user does choose to purge the contents of the Deletions folder, the items are actually moved to the Purges sub-folder of the Recoverable Items folder. Therefore, as far as the user is concerned, the items can no longer be recovered or viewed in any way via Outlook. Note that items from the Deletions folder are also moved to the Purges folder when the deleted item retention period passes.

With Single Item Recovery enabled, items will remain in the Recoverable Items\Purges folder even if the mailbox owner deletes items from their inbox, empties the Deleted Items folder and then purges the contents of the dumpster. These items can then be searched for by a compliance officer if required, as the items are both indexed and discoverable. Additionally, these items will move with the mailbox if the mailbox is moved to a different mailbox database.

The Purges folder will be emptied after the deleted item retention period has passed unless the mailbox has been configured for Legal Hold, in which case no items are purged from the Purges folder. The Recoverable Items\Versions folder is also used in conjunction with Legal Hold. In this case, if the user makes a modification to an item, a copy of the original item is placed into the Versions folder so that the unmodified item can be discovered by a compliance officer.

Planning for Single Item Recovery

When you are designing an Exchange 2010 system, it is important to understand whether the Single Item Recovery feature is going to be enabled or not. The reason for this is because when enabled, the Single Item Recovery feature for a 14-day deleted item retention period produces a 1.2% increase in the size of a mailbox.

For example, consider the scenario where the system is being planned so that each user can have a 5GB mailbox and a 14 day deleted item retention setting. This means that an additional 60MB of space is required for each mailbox that is enabled for Single Item Recovery. To calculate this effect, the Exchange 2010 Mailbox Server Role Requirements Calculator has a corresponding Single Item Recovery field for each tier of user being planned. This is shown in Figure 2-1 and it must be pointed out that the values in Figure 2-1 are the defaults seen when the calculator is first downloaded. Notice how the calculator has Single Item Recovery enabled by default for its calculations whereas in Exchange 2010 itself, Single Item Recovery is disabled by default for each mailbox.

  
Figure 2-1: Single Item Recovery in the Mailbox Role Requirements Calculator

Let’s first set the Single Item Recovery in the calculator to the setting of disabled. We can see that each mailbox is 5120MB by default and that these tier users will send and receive 100 messages per day at an average message size of 75KB. Note also the deleted item retention window has been set to 14 days. With that in mind, we can move to the Role Requirements tab of the calculator and from Figure 2-2 it can be seen that we require 263MB of dumpster and whitespace for each of these mailboxes.

 
Figure 2-2: Mailbox Whitespace Requirements With Single Item Recovery Disabled

Now let’s see what happens if we set the Single Item Recovery field in the calculator to a setting of enabled. The effect is shown in Figure 2-3 where it can be seen that we now require 325MB of dumpster and whitespace for each of these mailboxes. The difference between 325MB and 263MB is 62MB, which is approximately 1.2% of the 5120MB mailbox size as stated earlier.


Figure 2-3: Mailbox Whitespace Requirements With Single Item Recovery Enabled

Enabling Single Item Recovery

Single Item Recovery is not enabled by default in Exchange 2010. To see this, let’s look at the properties of a newly created mailbox for a user called Neil. We can use the Get-Mailbox cmdlet to dump the various parameters of this mailbox and the specific parameter that we are interested in is SingleItemRecoveryEnabled. Therefore we can use the following command to filter for this particular parameter, as it shows us all parameters that contain the string ‘single’:

Get-Mailbox neil | fl *single*

The result of running this command is shown in Figure 2-4.


Figure 2-4: Single Item Recovery Disabled by Default

To enable Single Item Recovery for this mailbox, we simply need to set the SingleItemRecoveryEnabled parameter to true and this can be performed using the following command:

Set-Mailbox neil –SingleItemRecoveryEnabled $true

You will notice a warning message is presented when this command is run. The warning says:

“WARNING: The single item recovery setting may take up to 60 minutes to take effect”

This is to allow Active Directory replication to take place. There are also some other important parameters to consider that are related to Single Item Recovery. They are:

  • RetainDeletedItemsFor. This parameter is used to control the amount of time that items are maintained and is set to 14 days by default.
  • RecoverableItemsQuota. The recoverable items folder has an overall quota assigned to it, to protect against denial of service attacks.
  • RecoverableItemsWarningQuota. Working with the RecoverableItemsQuota parameter, this parameter allows you to configure a warning threshold for the overall quota assigned to the recoverable items folder.

Figure 2-5 shows the default values assigned to these parameters once a mailbox has been enabled for Single Item Recovery.


Figure 2-5: Single Item Recovery Parameters for a Mailbox

In Figure 2-5, you can see that the RecoverableItemsQuota and RecoverableItemsWarningQuota parameters for the mailbox are set to a value of unlimited by default. However, this doesn’t tell the whole story as you can also see in Figure 2-5 that I have included the UseDatabaseQuotaDefaults parameter which has a value of true. Therefore, we can see that this mailbox is configured to use settings stored on the actual mailbox database so we need to examine the properties of the mailbox database on which this particular mailbox is stored.

Figure 2-6 shows the RecoverableItemsQuota and RecoverableItemsWarningQuota parameters from the mailbox database on this Exchange 2010 server. Here you can see that these parameters have 30GB and 20GB limits respectively which are the default settings.


Figure 2-6: Single Item Recovery Quota Settings for a Database

Summary

That completes part two of this three-part article on the Single Item Recovery feature of Exchange 2010 and in this part we have mainly concentrated on what is required when planning the feature as well as how to enable it. In the final part of this article, we will look at performing a discovery search for items that a user has purged and finish up with a deeper look at using MFCMAPI to examine the contents of the dumpster in Exchange 2010.

If you would like to read the other parts in this article series please go to:

Featured Links