Restore items

%3CLINGO-SUB%20id%3D%22lingo-sub-876787%22%20slang%3D%22en-US%22%3ERestore%20items%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-876787%22%20slang%3D%22en-US%22%3E%3CP%3EOn%20September%2023rd%20(3%20days%20ago)%20a%20user%20deleted%20a%20large%20number%20of%20files%20from%20SharePoint%20online.%3C%2FP%3E%3CP%3EFiles%20are%20still%20in%201st%20Recycle%20Bin.%3C%2FP%3E%3CP%3EMy%20question%20is%3A%3C%2FP%3E%3CP%3EWhat%20would%20be%20the%20most%20simple%20command%20to%20restore%20those%20files%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20little%20confused%20because%20I'm%20not%20sure%20from%20which%20side%20to%20%22attack%22%20the%20issue.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EKind%20regards%2C%3C%2FP%3E%3CP%3EDino%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-876787%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESharePoint%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20PowerShell%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-877002%22%20slang%3D%22en-US%22%3ERe%3A%20Restore%20items%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-877002%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F390770%22%20target%3D%22_blank%22%3E%40DiVojich%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20use%20Pnp%20cmdlet%20to%20restore%20the%20file%20with%20filters%20of%20the%20deleted%20user%20name%20and%20date%20filter.%26nbsp%3B%20Please%20refer%20the%20below%20script.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22%22%3EGet-PnPRecycleBinItem%20-firststage%20%7C%20Where-object%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20class%3D%22br0%22%3E%7B%3C%2FSPAN%3E%3CSPAN%20class%3D%22br0%22%3E(%3C%2FSPAN%3E%3CSPAN%20class%3D%22%22%3E%24_.DeletedDate%20-gt%20%24Deletedate%3C%2FSPAN%3E%3CSPAN%20class%3D%22br0%22%3E)%3C%2FSPAN%3E%3CSPAN%20class%3D%22%22%3E%20-%3C%2FSPAN%3E%3CSPAN%20class%3D%22kw1%22%3Eand%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22br0%22%3E(%3C%2FSPAN%3E%3CSPAN%20class%3D%22%22%3E%24_.DeletedByEmail%20-eq%20%3C%2FSPAN%3E%3CSPAN%20class%3D%22st0%22%3E'test%40domain.com'%3C%2FSPAN%3E%3CSPAN%20class%3D%22br0%22%3E)%3C%2FSPAN%3E%3CSPAN%20class%3D%22br0%22%3E%7D%3C%2FSPAN%3E%3CSPAN%20class%3D%22%22%3E%20%7C%20Restore-PnpRecycleBinItem%20-Force%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1587948%22%20slang%3D%22en-US%22%3ERe%3A%20Restore%20items%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1587948%22%20slang%3D%22en-US%22%3E1)Run%20windows%20Power%20shell%20as%20administrator%3CBR%20%2F%3E%3CBR%20%2F%3E2)Install%20this%20module%3CBR%20%2F%3EInstall-Module%20SharePointPnPPowerShellOnline%3CBR%20%2F%3E%3CBR%20%2F%3E3)Connecting%20to%20a%20specific%20site%20with%20the%20help%20of%20its%20URL%3CBR%20%2F%3ENote%20%3A-%20dont%20use%20'%26lt%3B%26gt%3B'%20braces%20any%20where%3CBR%20%2F%3E%3CBR%20%2F%3EConnect-PnPOnline%20-Url%20%3CSITE%20url%3D%22%22%3E%3CBR%20%2F%3E%3CBR%20%2F%3EEnter%20Global%20admin%20credentials%20when%20it%20gives%20you%20a%20prompt.%3CBR%20%2F%3E%3CBR%20%2F%3E4)to%20check%20connection%20run%20below%20command%20it%20will%20show%20the%20list%20of%20deleted%20items%20of%20the%20this%20particular%20site%3CBR%20%2F%3E%3CBR%20%2F%3EGet-PnPRecycleBinItem%3CBR%20%2F%3E%3CBR%20%2F%3E5)%20Defining%20date%20variables%3CBR%20%2F%3E%24today%20%3D%20(Get-Date)%3CBR%20%2F%3E%24date1%20%3D%20%24today.date.addDays(-3)%3CBR%20%2F%3E%24date2%20%3D%20%24today.date.addDays(0)%3CBR%20%2F%3E%3CBR%20%2F%3E6)Run%20this%20command%20to%20restore%20the%20files%20as%20the%20date%20variable%20values%20like%20above%20-3%20and%200%20%2C%20so%20that%20the%20restored%20files%20are%20backed%20to%20these%20many%20days%20only%20and%20not%20includes%20all%20the%20files%20deleted%20by%20hte%20user%20over%20all%3CBR%20%2F%3E%3CBR%20%2F%3EGet-PnPRecycleBinItem%20%7C%20%3F%20%7B(%24_.DeletedDate%20-gt%20%24date2%20-and%20%24_.DeletedDate%20-lt%20%24date1)%20-and%20(%24_.DeletedByEmail%20-eq%20'xyz%40domain.com'%20)%7D%20%7C%20Restore-PnPRecycleBinItem%20-Force%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3EIn%20emergency%20cases%20If%20you%20wish%20to%20restore%20all%20the%20files%20and%20folders%20deleted%20by%20a%20specific%20user%20from%20the%20specific%20site%3CBR%20%2F%3EPlease%20repeate%20the%20obove%20steps%201-4%20and%20then%20give%20the%20command%20in%20the%20below%205th%20step%3CBR%20%2F%3E%3CBR%20%2F%3E5)%20Get-PnPRecycleBinItem%20-FirstStage%20%7C%20%3F%20DeletedByEmail%20-eq%20'xyz%40domain.com'%20%7C%20Restore-PnpRecycleBinItem%20-Force%3CBR%20%2F%3E%3CBR%20%2F%3EWait%20for%20few%20minutes%20because%20we%20are%20restoring%20files%20in%20bulk%3CBR%20%2F%3E%3C%2FSITE%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1588144%22%20slang%3D%22en-US%22%3ERe%3A%20Restore%20items%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1588144%22%20slang%3D%22en-US%22%3ENote%20%3A-%20However%20there%20is%20a%20limitation%20to%20this%20script%20that%20it%20could%20retrieve%20only%20a%20fixed%20number%20of%20data%20files%3CBR%20%2F%3Efor%20example%20what%20i%20observed%20is%20about%2012000%20files%20.%3CBR%20%2F%3EScenario%3A-%20If%20you%20already%20restored%20the%20file%20among%20these%2012000%20files%20it%20will%20throw%20error%20so%20better%20don't%20try%20to%20do%20manually%20any%20attempt%20to%20restore%20before%20running%20this%20command%20.%3CBR%20%2F%3EScenario%202%3A-%20After%20receiving%20this%20error%20If%20you%20try%20to%20rename%20the%20already%20restored%20empty%20folder%20you%20will%20receive%20a%20all%20the%20contents%20of%20the%20folder%20in%20the%20renamed%20folder%20and%20a%20seperately%20named%20with%20the%20original%20of%20the%20folder.%3CBR%20%2F%3EExample%3A-%201)folder%20A1%20is%20deleted%20it%20is%20in%20the%20recylebin%3CBR%20%2F%3E2)%20you%20go%20to%20recycle%20bin%20and%20restore%20it%20from%20the%20bin%3CBR%20%2F%3E3)%20the%20folder%20will%20be%20restored%20to%20the%20originally%20location%20without%20any%20file%20in%20it%3CBR%20%2F%3E4)%20now%20if%20you%20try%20to%20restore%20using%20the%20folder%20again%20using%20this%20script%3CBR%20%2F%3E5)it%20wont%20restore%20and%20will%20give%20the%20error%3CBR%20%2F%3E6)%20If%20you%20try%20to%20rename%20existing%20A1%20folder%20to%20B1%3CBR%20%2F%3E7)%20Then%20if%20you%20re%20enforce%20the%20script%20it%20will%20restore%20an%20empty%20folder%20A1%20seperately%3CBR%20%2F%3E8)%3C%2Fimg%3E%20and%20the%20files%20under%20the%20folders%20will%20be%20restored%20to%20the%20location%20B1%3CBR%20%2F%3E9)%20the%20reason%20being%2C%20at%20the%20hardware%20level%20in%20the%20data%20center%20the%20actual%20location%20is%20now%20B1%3CBR%20%2F%3E10)%20so%20if%20you%20don't%20wanna%20rename%20every%20already%20restored%20folder%20please%20do%20not%20restore%20any%20file%3CBR%20%2F%3Ebefore%20running%20script%20and%20it%20would%20behave%20normally%3CBR%20%2F%3EThis%20is%20a%20very%20unusual%20behaviour%20caused%20by%20the%20team%20work%20of%20users%20and%20IT%3C%2FLINGO-BODY%3E
Contributor

On September 23rd (3 days ago) a user deleted a large number of files from SharePoint online.

Files are still in 1st Recycle Bin.

My question is:

What would be the most simple command to restore those files?

 

I'm little confused because I'm not sure from which side to "attack" the issue.

 

Kind regards,

Dino

3 Replies

@DiVojich 

You can use Pnp cmdlet to restore the file with filters of the deleted user name and date filter.  Please refer the below script.

Get-PnPRecycleBinItem -firststage | Where-object {($_.DeletedDate -gt $Deletedate) -and ($_.DeletedByEmail -eq 'test@domain.com')} | Restore-PnpRecycleBinItem -Force

1)Run windows Power shell as administrator

2)Install this module
Install-Module SharePointPnPPowerShellOnline

3)Connecting to a specific site with the help of its URL
Note :- dont use '<>' braces any where

Connect-PnPOnline -Url <site URL>

Enter Global admin credentials when it gives you a prompt.

4)to check connection run below command it will show the list of deleted items of the this particular site

Get-PnPRecycleBinItem

5) Defining date variables
$today = (Get-Date)
$date1 = $today.date.addDays(-3)
$date2 = $today.date.addDays(0)

6)Run this command to restore the files as the date variable values like above -3 and 0 , so that the restored files are backed to these many days only and not includes all the files deleted by hte user over all

Get-PnPRecycleBinItem | ? {($_.DeletedDate -gt $date2 -and $_.DeletedDate -lt $date1) -and ($_.DeletedByEmail -eq 'xyz@domain.com' )} | Restore-PnPRecycleBinItem -Force


In emergency cases If you wish to restore all the files and folders deleted by a specific user from the specific site
Please repeate the obove steps 1-4 and then give the command in the below 5th step

5) Get-PnPRecycleBinItem -FirstStage | ? DeletedByEmail -eq 'xyz@domain.com' | Restore-PnpRecycleBinItem -Force

Wait for few minutes because we are restoring files in bulk
Note :- However there is a limitation to this script that it could retrieve only a fixed number of data files
for example what i observed is about 12000 files .
Scenario:- If you already restored the file among these 12000 files it will throw error so better don't try to do manually any attempt to restore before running this command .
Scenario 2:- After receiving this error If you try to rename the already restored empty folder you will receive a all the contents of the folder in the renamed folder and a seperately named with the original of the folder.
Example:- 1)folder A1 is deleted it is in the recylebin
2) you go to recycle bin and restore it from the bin
3) the folder will be restored to the originally location without any file in it
4) now if you try to restore using the folder again using this script
5)it wont restore and will give the error
6) If you try to rename existing A1 folder to B1
7) Then if you re enforce the script it will restore an empty folder A1 seperately
8) and the files under the folders will be restored to the location B1
9) the reason being, at the hardware level in the data center the actual location is now B1
10) so if you don't wanna rename every already restored folder please do not restore any file
before running script and it would behave normally
This is a very unusual behaviour caused by the team work of users and IT