Hi there folks!
In some situation during regular operations an user deletes something and the Operations/Exchange Admin has to work on the issue to restore the data. Sounds familiar?
If you are using Single Item Recovery and based on the restore requirements you don’t have to go back to tapes or historical backup then you can run a single cmdlet to export the content of just the Recoverable Items to a PST and from that point on your Operations/Service Desk will be able to identify what happened with the message.
The result will be a PST where we have all the Recoverable Items structure available and from that information we can easily identify if the message was accessible to the users (Deletions folder) or if the user deleted from that place (Purges). Bear in mind that Purges will be populated if we are using Single Item Recovery.