End User Access to the Recoverable Items Folder

The Microsoft TechNet article Understanding Recoverable Items says: “To better meet customers’ legal compliance requirements, the dumpster is reinvented as the Recoverable Items folder in Exchange 2010. The Recoverable Items folder resides in the non-IPM subtree of each mailbox. The non-IPM subtree is a storage area within the mailbox that contains operational data about the mailbox. This subtree isn’t visible to users using Outlook, Microsoft Office Outlook Web App, or other e-mail clients.”

Is it possible for a user to access to this areas? Yes, but not with a regular email client.

An end user, who is not an Exchange administrator and has only access to his own mailbox, can use MFCMAPI to investigate the content in this “hidden” area of his mailbox. If his MAPI profile is configured for Cached Exchange Mode then he has to enable the Online Mode in MFCMAPI, otherwise MFCMAPI accesses the OST file and the Recoverable Items Folder is not visible.

Now MFCMAPI accesses the Exchange Server and you can browse through the folders of your mailbox.

The following screenshot shows the content in the DiscoveryHolds subfolder of a mailbox hosted on Exchange Server 2013.

Another option for an end user is to use the EWSEditor.

Both tools provide interesting features including the option to export an email to a file or delete an item in the mailbox. However, the delete function does not allow a user to purge an email from his mailbox. So far I haven’t found a loophole how a user can hide a discriminating email from a discovery search.