SharePoint Online: Search Recycle Bin using PowerShell

Requirement: Search the SharePoint Online recycle bin for all files deleted by a particular user.

How to search SharePoint Online Recycle Bin?

The SharePoint Online Recycle Bin acts as a safety net, temporarily storing deleted items before permanent removal. As an admin, you may need to search the Recycle Bin to find specific deleted items for recovery or troubleshooting purposes. However, navigating through a large recycle bin and searching for specific files can be tedious. This is where the power of PowerShell comes in! Did you know you can use PowerShell to search the recycle bin in SharePoint Online? In this blog post, we’ll explore the basics of using PowerShell to search the SharePoint online recycle bin.

To find all items deleted by a particular user, do the following:

  1. Navigate to your SharePoint Online site, and Click on Site Settings Gear >> Choose “Site Settings”.
  2. From the Site settings page, click on “Recycle bin” from Site Collection Administration. This page gives you all deleted items in the site collection, along with deleted user data. search recycle bin sharepoint online

However, searching the SharePoint Online recycle bin through the web user interface is painful when you have a lot of deleted files. So, let’s use PowerShell to get deleted files from the Recycle bin.

PowerShell script to Search SharePoint Online Recycle bin

Searching SharePoint Online Recycle Bin is easy and fast using PowerShell filtering and commands. It saves admins from manually browsing all deleted content for sites, lists, libraries, or items. With filters and wildcards, you can easily find content deleted recently.

Here is the SharePoint Online PowerShell to search the recycle bin:

#Load SharePoint Online Assemblies
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"
   
##Variables for Processing
$SiteUrl = "https://crescent.sharepoint.com/sites/Sales"
$AdminUserName="Salaudeen@crescent.com"
$DeletedByUserAccount="salaudeen.rajack@crescent.com"

#Get the password to connect 
$Password = Read-host -assecurestring "Enter Password for $AdminUserName"
$Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($AdminUserName,$Password)
 
Try {    
    #Setup the context
    $Context = New-Object Microsoft.SharePoint.Client.ClientContext($SiteUrl)
    $Context.Credentials = $Credentials
    
    #Get the site recycle bin
    $Site = $Context.Site
    $RecycleBinItems = $Site.RecycleBin
    $Context.Load($Site)
    $Context.Load($RecycleBinItems)
    $Context.ExecuteQuery()

    #Get all items deleted by particular user in Recycle bin
    $DeletedByUser = $RecycleBinItems | Where {$_.DeletedByEmail -eq $DeletedByUserAccount}
    Write-Host "Total Number of Items deleted by user:" $DeletedByUser.Count
    
    #format output as table and print to console
    $DeletedByUser | Select Title, DeletedByEmail, DeletedDate | Format-Table
}
catch {
    write-host "Error: $($_.Exception.Message)" -foregroundcolor Red
}

PnP PowerShell to Get SharePoint Online Recycle Bin Items:

Searching your recycle bin in SharePoint Online using PnP PowerShell is easy. With just a few lines of code, you can query the contents of your recycle bin and find the items you’re looking for. To get started, open PowerShell and connect to your SharePoint Online site. Then, run the following script:

The syntax for the Get-PnPRecycleBin cmdlet goes like this:

Get-PnPRecycleBinItem 
[-RowLimit <Int32>]
[-Identity <Guid>]
[-Connection <PnPConnection>] 
[-Includes <String[]>]
[-FirstStage]
[-SecondStage]

Below is a table outlining these parameters, along with descriptions and example usage for each.

ParameterDescriptionExample Usage
-RowLimitLimits the number of items returned.Get-PnPRecycleBinItem -RowLimit 10
-FirstStageSpecifies whether to return items from the first-stage Recycle Bin.Get-PnPRecycleBinItem -FirstStage
-SecondStageSpecifies whether to return items from the second-stage (Site Collection) Recycle Bin.Get-PnPRecycleBinItem -SecondStage
-IdentityRetrieves a specific recycle bin item by either providing its ID.Get-PnPRecycleBinItem -Identity 99c4d7f5-55b2-4f93-8c6c-8d8d8b0f3d08

Here is an example of how to search the SharePoint Online recycle bin with the PnP PowerShell cmdlet Get-PnPRecycleBinItem:

#Config Variables
$SiteURL = "https://Crescent.sharepoint.com/sites/marketing"

#Connect to PnP Online
Connect-PnPOnline -Url $SiteURL -Interactive

#Get Recycle bin Items
Get-PnPRecycleBinItem -RowLimit 500000 | Select Title, ItemType, Size, ItemState, DirName, DeletedByName, DeletedDate | Format-table -AutoSize

This PowerShell script gets all items from the given SharePoint Online site collection’s recycle bin.

sharepoint online powershell get recycle bin

Elevate your search strategy with advanced techniques, including filtering results and using date filters to refine your searches. E.g., To get all deleted items in the first stage recycle bin in the past seven days, use the following:

Get-PnPRecycleBinItem -FirstStage | Where-Object { $_.DeletedDate -gt (Get-Date).AddDays(-7) }

Or restore all Microsoft Word documents from the recycle bin:

Get-PnPRecycleBinItem -RowLimit 1000 | Restore-PnPRecycleBinItem -Force | Where {$_.LeafName -like "*.docx"}

This script restores all the items with filename ends with the .docx extension. You can also export recycle bin items data to a CSV file by:

#Get Recycle bin Items and Export to CSV
Get-PnPRecycleBinItem -RowLimit 500000 | Select Title, ItemType, Size, ItemState, DirName, DeletedByName, DeletedDate | Export-Csv "C:\Temp\RecycleBin.csv" -NoTypeInformation

This script gets you all deleted items’ data from both the first and second-stage recycle bins. Once you have found the required deleted content, use Restore and recover items from the Recycle Bin back to your SharePoint sites or OneDrive. You can pipeline input from this cmdlet to restore. E.g., let’s restore everything from the second stage recycle bin:

Get-PnPRecycleBinItem -SecondStage | Restore-PnPRecycleBinItem -Force

To restore deleted items from the recycle bin, use: How to Restore Deleted Items in SharePoint Online?

Conclusion

The SharePoint Online Recycle Bin, akin to the recycle bin on your computer, stores deleted items from lists, libraries, and sites for a designated period before permanent deletion. However, manually searching through a large recycle bin can be time-consuming and inefficient. You can also use PowerShell to manage the Recycle Bin if you’re a SharePoint Online Administrator. For example, you can use PowerShell to empty the Recycle Bin or to restore items from the Recycle Bin. To learn more about using PowerShell with SharePoint Online, see the following articles:

Salaudeen Rajack

Salaudeen Rajack - Information Technology Expert with Two-decades of hands-on experience, specializing in SharePoint, PowerShell, Microsoft 365, and related products. He has held various positions including SharePoint Architect, Administrator, Developer and consultant, has helped many organizations to implement and optimize SharePoint solutions. Known for his deep technical expertise, He's passionate about sharing the knowledge and insights to help others, through the real-world articles!

16 thoughts on “SharePoint Online: Search Recycle Bin using PowerShell

  • Is it possible to search for this by specifying the deletion date?
    It is now possible to get the last 10 days with “Where { $_.DeletedDate -gt (Get-Date).AddDays(-10)}”, but I want to search only 10 days ago.

    Reply
  • This is great but one user deleted more than the threshold, and it doesn’t load the results to anywhere. Can we search for a keyword, or how can I achieve this threshold error?

    Thank you

    Reply
  • Great Contribution.
    When I execute a script that generate the following message; Can you tell me how to avoid this

    PS C:\Windows\system32> C:\Temp\ScriptTest\ListRecycledBin.ps1
    Get-PnPRecycleBinItem : La operación que se intentó realizar está prohibida porque supera el umbral de vista de lista.
    En C:\Temp\ScriptTest\ListRecycledBin.ps1: 9 Carácter: 1
    + Get-PnPRecycleBinItem -RowLimit 5000 | Select Title, ItemType, Size, …
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : WriteError: (:) [Get-PnPRecycleBinItem], ServerException
    + FullyQualifiedErrorId : EXCEPTION,PnP.PowerShell.Commands.RecycleBin.GetRecycleBinItems

    Reply
  • Thank you so mutch, this was very useful to me.

    Thanksssssss!!!!!!!!!!!!!!!!!!!!!!!!!!

    Reply
  • Is it possible to do the same thing for 2013?

    Reply
  • I am getting threshold error while executing Restore-PNPRecycleItem. ALready used rowlimit paramenter in Get-PNP item.

    Reply
  • change the connect part to this: #Connect to PnP Online Connect-PnPOnline -Url $SiteURL –UseWebLogin

    Reply
  • Is there a way to show the retention label?

    Reply
  • Nope, sorry… Can’t log into PnPOnline with MFA required this way. Any other suggestions? Thanks.

    Reply
    • you can use this, Connect-PnPOnline -Url -PnPO365ManagementShell -LaunchBrowser

      after you run the command it will produce a code that you can use to login your credential

      Reply
  • You might want to look into Restore-PnPRecycleBinItem after you have located the files from the CSV.

    Reply
  • Excellent post, mate!
    Is there a way to restore specific files using Powershell? I found the items I wanted but they are deep back in date so would take me forever to scroll there to restore them.

    Reply
  • Hi,

    Great script, but I have a question to this? Will it be possible to resore items to you local server / pc added to this script.

    Thanks.

    Reply
    • No! The Deleted Items can be restored only to its original location! There are no ways to directly restore a deleted item to a different location. However, You can restore and then move!

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *