How to Recover Deleted Emails in Microsoft 365

When the CEO realizes they deleted a vital email thread three weeks ago, email recovery suddenly becomes an urgent task. Sure, you can look in Outlook’s Deleted Items folder, but how can you recover what has undergone “permanent” deletion? This article reviews how you can save the day by bringing supposedly unrecoverable email back from the great beyond.

Deleted Email Recovery in Microsoft And Office 365

Email Recovery for Outlook in Exchange Online through Microsoft and Office can be as simple as dragging and dropping the wayward email from the Deleted Items folder to your Inbox. But what do you do when you can’t find the email you want to recover? First, let’s look at how email recovery is structured in Microsoft 365. There are a few more layers here than you might think! In Microsoft 365, deleted email can be in one of three states: Deleted, Soft-Deleted, or Hard-Deleted. How you recover an email and how long you must do so depends on the email’s delete status and the applicable retention policy.#

Let’s walk through the following graphic and talk about how email gets from one state to another, the default policies, how to recover deleted emails in each state, and a few tips along the way.

Items vs. Email

Outlook is all about email, yet it also has tasks, contacts, calendar events, and other types of information. For example, just like email, you can delete calendar entries and may be called on to recover them. For this reason, the folder for deleted content is called “Deleted Items.” Also, when discussing deletions and recovery, referring to “items” rather than limiting the discussion to just email is common.

Policy

Various rules control the retention period for items in the different states of deletion. A policy is an automatically applied action that enforces a rule related to services. Microsoft 365 has hundreds of policies you can tweak to suit your requirements. See Overview of Retention policies for more information.

‘Deleted Items’ Email

When you press the Delete key on an email in Outlook, it’s moved to the Deleted Items folder. That email is now in the “Deleted” state, which simply means it moved to the Deleted Items folder. How long does Outlook retain deleted emails? By default – forever! You can recover your deleted mail with just a drag and drop to your Inbox. Done! If you can’t locate the email in the Deleted Items folder, double-check that you have the Deleted Items folder selected, then scroll to the bottom of the email list. Look for the following message:

If you see the above message, your cache settings may be keeping only part of the content in Outlook and the rest in the cloud. The cache helps to keep mailbox sizes lower on your hard drive, which in turn speeds up search and load times. Click on the link to download the missing messages.

But I Didn’t Delete It!

If you find content in the Deleted Items and are sure you did not delete it, you may be right! Administrators can set Microsoft 365 policy to delete old Inbox content automatically. Mail can ‘disappear’ another way. Some companies enable a personal archive mailbox for users. When enabled, by default, any mail two years or older will “disappear” from your Inbox and the Deleted Items folder. However, there is no need to worry. While missing, the email has simply moved to the Archives Inbox. A personal Archives Inbox shows up as a stand-alone mailbox in Outlook, as shown below.

As a result, it’s a good idea to search the Archives Inbox if it is present when searching for older messages. Another setting to check is one that deletes email when Outlook is closed. Access this setting in Outlook by clicking “File,” then “Options,” and finally “Advanced” to display this window:

If enabled, Outlook empties the Deleted Items when closed. The deleted email then moves to the ‘soft-delete’ state, which is covered next. Keep in mind that with this setting, all emails will be permanently deleted after 28 days.

‘Soft-Deleted’ Email

The next stage in the process is Soft-Deleted. Soft-deleted emails are in the Deleted-Items folder but is still easily recovered. At a technical level, the mail is deleted locally from Outlook and placed in the Exchange Online folder named Deletions, which is a sub-folder of Recoverable Items. Any content in the Recoverable Items folder in Exchange Online is, by definition, considered soft-deleted. You have, by default, 14 days to recover soft-deleted mail. The service administrator can change the retention period to a maximum of 30 days. Be aware that this can consume some of the storage capacity assigned to each user account, and you could get charged for overages.

How items become soft-deleted

There are three ways to soft-delete mail or other Outlook items.

• Delete an item already in the Deleted Items folder. When you manually delete something that is already in the Deleted Items folder, the item is soft-deleted. Any process, manual or otherwise, that deletes content from this folder results in a ‘soft-delete.’
• Pressing Shift + Delete on an email in your Outlook Inbox will bring up a dialog box asking if you wish to “permanently” delete the email. Clicking Yes will remove the email from the Deleted-Items folder but only perform a soft delete. You can still recover the item if you do so within the 14-day retention period.

• The final way items can be soft-deleted is by using Outlook policies or rules. By default, no policies will automatically remove mail from the Deleted-Items folder in Outlook. However, users can create rules that ‘permanently’ (soft-delete) email. If you’re troubleshooting missing emails, have the user check for such rules, as shown below. You can click Rules on the Home menu and examine any created rules in the Rules Wizard below.

Note that the caution is a bit misleading as the rule’s action will soft-delete the email, which, as already stated, is not an immediate permanent deletion.

Recovering soft-deleted mail

You can recover soft-deleted mail directly in Outlook. Be sure the Deleted Items folder is selected, then look for “Recover items recently removed from this folder“ at the top of the mail column or the “Recover Deleted Items from Server” action on the Home menu bar.

Clicking on the recover items link opens the Recover Deleted Items window.

Click on the items you want to recover or Select All, and click OK. NOTE: The recovered email returns to your Deleted Items folder. Be sure to move it into your Inbox. If the email you’re looking for is not listed, it could have moved to the next stage: ‘Hard-Deleted.’ While users can recover soft-deleted emails, Administrators can also recover soft-deleted emails on their behalf using the ‘Hard-Deleted’ email recovery process described next (which works for both hard and soft deletions). Also, Microsoft has created two PowerShell commands that are very useful in this process for those who would rather script the tasks. You can search and restore soft-deleted emails using the Get-RecoverableItems and Restore-RecoverableItems cmdlets.

Hard-Deleted Email

The next stage for deletion is ‘Hard Delete.’ Technically, items are hard-deleted when items are moved from the Recoverable folder to the Purges folder in Exchange Online. Administrators can still recover items in the folder with the recovery period set by policy which ranges from 14 (the default) to 30 (the maximum). You can extend the retention beyond 30 days by placing legal or litigation hold on the item or mailbox.

How items become Hard-Deleted

There are two ways content becomes hard-deleted.

• By policy, soft-deleted email is moved to the hard-deleted stage when the retention period expires.
• Users can hard-delete mail manually by selecting the Purge option in the Recover Deleted Items window shown above. (Again, choosing to ‘permanently delete’ mail with Shift + Del results in a soft delete, not a hard delete.)

Recovering Hard-Deleted Mail

Once email enters the hard-delete stage, users can no longer recover the content. Only service administrators with the proper privileges can initiate recovery, and no administrators have those privileges by default, not even the global admin. The global admin does have the right to assign privileges so that they can give themselves (or others) the necessary rights. Privacy is a concern here since administrators with these privileges can search and export a user’s email. Microsoft’s online documentation Recover deleted items in a user’s mailbox details the step-by-step instructions for recovering hard-deleted content. The process is a bit messy compared to other administrative tasks. As an overview, the administrator will:

• Assign the required permissions
• Search the Inbox for the missing email
• Copy the results to a Discovery mailbox where you can view mail in the Purged folder (optional).
• Export the results to a PST file.
• Import the PST to Outlook on the user’s system and locate the missing email in the Purged folder.

Last Chance Recovery

Once hard-deleted items are purged, they are no longer discoverable by any method by users or administrators. You should consider the recovery of such content as unlikely. That said, if the email you are looking for is not recoverable by any of the above methods, you can open a ticket with Microsoft 365 Support. In some circumstances, they may be able to find the email that has been purged but not yet overwritten. They may or may not be willing to look for the email, but it can’t hurt to ask, and it has happened.

What about using Outlook to backup email?

Outlook does allow a user to export an email to a PST file. To do this, click “File” in the Outlook main menu, then “Import & Export” as shown below.

You can specify what you want to export and even protect the file with a password. While useful from time to time, a backup plan that depends on users manually exporting content to a local file doesn’t scale and isn’t reliable. Consequently, don’t rely on this as a possible backup and recovery solution.

Alternative Strategies

After reading this, you may be thinking, “Isn’t there an easier way?” A service like Office 365 Backup allows you to recover from point-in-time snapshots of an inbox or other Microsoft 365 content. Having a service like this when you get that urgent call to recover mail from a month ago can be a lifesaver.

Before We Go

As you can see, it’s become abundantly clear that having a robust recovery strategy is not just an option but a necessity. Below are compelling arguments to illustrate why a well-structured recovery strategy is pivotal in the realm of email management in Microsoft 365:

• Unexpected Deletions are Inevitable: Accidental deletions are more common than one might think. Whether it’s the CEO or a new intern, anyone can mistakenly delete crucial emails. A recovery strategy ensures these accidents don’t turn into crises.
• Compliance with Legal and Regulatory Requirements: Many industries are governed by stringent laws and regulations that mandate the retention of electronic communications, including emails, for specific periods. Having a recovery strategy in place ensures compliance with these legal obligations, thus avoiding potential legal ramifications and hefty fines.
• Protecting Against Malicious Activities: Cyber threats are increasingly sophisticated, with emails often being the main target of malicious actors. An effective recovery strategy can be the difference between quickly restoring lost data and suffering prolonged downtime or permanent data loss.
• Mitigating the Impact of Technical Failures: Technical glitches, system crashes, or server issues can lead to loss of email data. A recovery strategy ensures that you have backups and processes in place to restore lost emails, thereby minimizing operational disruptions.
• Maintaining Business Continuity: Emails are often the lifeline of business communications. Loss of access to important emails can halt decision-making processes and project workflows. A sound recovery strategy maintains business continuity, ensuring that email data is always accessible, even in the event of accidental or malicious deletions.
• Safeguarding Intellectual Property and Sensitive Information: Emails often contain proprietary information, trade secrets, and sensitive data. Loss of such emails not only affects business operations but can also lead to competitive disadvantages and breaches of confidentiality. A robust recovery strategy protects this vital information.
• Ease of Administration and Time Efficiency: Time is of the essence in business. A recovery strategy streamlines retrieving deleted emails, saving valuable administrative time and effort that might otherwise be spent navigating complex recovery processes.
• Cost-Effectiveness in the Long Run: While setting up a recovery strategy might seem like an upfront investment, it is cost-effective in the long run. It mitigates the risks of losing crucial business information, spending on legal battles due to non-compliance, or losing business due to operational delays.
• Reinforcing User Confidence: Knowing there is a safety net for email recovery enhances user confidence in using the email system. Users are more likely to utilize the system effectively and without fear of irreversible mistakes.
• Adaptability to Organizational Changes: As your organization evolves, so do your communication needs and practices. A flexible recovery strategy can adapt to these changes, ensuring that email recovery processes remain efficient and relevant.

The importance of a well-considered recovery strategy for Microsoft 365 cannot be overstated. It’s a critical component of modern business practices, ensuring your organization’s email communications remain resilient, compliant, and efficient. Remember, it’s not just about recovering a lost email; it’s about preserving the integrity and continuity of your entire business operation.

Summary

Users can recover most deleted emails without administrator intervention. Often, deleted emails simply sit in the deleted folder until manually cleared. When that occurs, email enters the ‘soft-deleted stage’ and is easily restored by a user within 14 days. After this period, the item enters the ‘hard-deleted’ state. A service administrator can recover hard-deleted items within the recovery window. After the hard-deleted state, the email should be considered uncoverable. Policies can be applied to extend the retention times of deleted mail in any state. While administrators can go far with web-based administration tools, the entire recovery process can be scripted with PowerShell to customize and scale larger projects or provide granular discovery. Using a backup solution designed for Microsoft 365, such as Altaro Office 365 Backup, is always a great idea.