Recovering Deleted Emails from a User's Mailbox in Office 365 (Microsoft 365)

Recovering Deleted Emails from a User's Mailbox in Office 365 (Microsoft 365)

In Microsoft 365 (formerly Office 365), when a user deletes an email, the email moves to the Deleted Items folder. However, if the user has permanently deleted an email (e.g., by emptying the Deleted Items folder or using Shift + Delete), the email may be recoverable for a period of time from the Recoverable Items folder, which is a hidden folder that contains items marked for permanent deletion.

If the email is outside of the retention period or deleted beyond recovery, there may be limited options for recovery.

Here's a step-by-step guide on how to recover emails deleted by a user from their mailbox:

---

Step 1: Verify Email Deletion Status

First, determine whether the email has been permanently deleted or is still in the Deleted Items or Recoverable Items folder.

1. Ask the User:
   • Have the user check the Deleted Items folder in Outlook (or Outlook on the web). If they find the deleted email there, they can simply restore it by selecting it and moving it back to the inbox or another folder.
2. If it's not in Deleted Items:
   • It could have been permanently deleted, but it may still be recoverable through the Recoverable Items folder.

---

Step 2: Recover Emails from the Deleted Items Folder (for Soft Deleted Emails)

1. Ask the User to Recover the Email from Deleted Items:

   • Outlook Desktop App: Open the Deleted Items folder. If you don't see the email there, ask the user to click on "Recover items deleted from this folder" at the top of the list (this is visible if items are recoverable but hidden).
   • Outlook Web (OWA): In the Outlook Web App, open the Deleted Items folder, and click on the "Recover deleted items" link at the top.

2. Restore the Deleted Email:

   • Select the emails you want to recover and click Restore. The emails will be returned to their original folder (such as the Inbox).

---

Step 3: Recover Items from the Recoverable Items Folder (for Permanently Deleted Emails)

If the email is not in the Deleted Items folder, and it was permanently deleted, it may be in the Recoverable Items folder. This folder is a special folder in Microsoft 365 that retains items for a period of time after they have been deleted from the Deleted Items folder (this retention period is typically 14 to 30 days, depending on your retention policy).

Recover from the Recoverable Items Folder (User’s End):

1. User Method: If the user is using Outlook Desktop or Outlook on the web:

   • Outlook Desktop App:
     1. Go to the Deleted Items folder.
     2. At the top, click on "Recover items deleted from this folder".
     3. In the Recoverable Items window, select the email(s) to recover.
     4. Click Restore to return the item(s) to their original folder.
   • Outlook Web (OWA):
     1. Log into Outlook on the web.
     2. Click on the Deleted Items folder.
     3. Select "Recover items deleted from this folder" at the top of the page.
     4. Choose the items you wish to recover and click Restore.

Admin Method (if the user cannot recover the email themselves):

If the user is unable to recover deleted items (for example, if they are outside the retention period or the user is unable to access the Recoverable Items folder), you as an administrator can use the Microsoft 365 admin center or PowerShell to attempt recovery.

---

Step 4: Recover Deleted Emails from the Admin Center (Admin)

Using Microsoft 365 Admin Center:

As an admin, you can recover emails that are still within the retention period, even if they are not visible in the user’s Deleted Items or Recoverable Items folders.

1. Log into the Microsoft 365 Admin Center:

   • Go to Microsoft 365 Admin Center and log in with your admin credentials.

2. Navigate to the Exchange Admin Center (EAC):

   • In the Admin Center, expand the Admin Centers section on the left-hand side and click on Exchange to go to the Exchange Admin Center.

3. Search for the User's Mailbox:

   • In the EAC, go to Recipients → Mailboxes.
   • Search for the mailbox of the user who deleted the emails.

4. Initiate a Mailbox Search:

   • Select the user’s mailbox, and on the right panel, click on "More options" → "Restore deleted items".

5. Search Deleted Items:

   • In the Restore Deleted Items panel, specify a date range or select the "All" option to search for all deleted items.
   • Click on Search to locate the deleted items.

6. Recover the Items:

   • Once the search is complete, select the emails that you want to recover.
   • Click Restore to recover the emails back to the user’s mailbox.

---

Step 5: Recover Emails via PowerShell (for Admins)

In some cases, PowerShell might be required, especially if emails are beyond the typical recovery window or if you need to perform bulk recovery.

Using PowerShell to Recover Deleted Emails:

1. Connect to Exchange Online PowerShell:

   • Open PowerShell and connect to Exchange Online by using the following commands:

     $UserCredential = Get-Credential
     $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Authentication Basic -AllowRedirection -Credential $UserCredential
     Import-PSSession $Session -DisableNameChecking
     

2. Search for the Deleted Items:

   • Use the Search-Mailbox cmdlet to search for the deleted items. Example:

     Search-Mailbox -Identity "user@domain.com" -SearchQuery 'Subject:"Subject of deleted email"' -TargetMailbox "admin@domain.com" -TargetFolder "Recovered Items" -LogLevel Full
     

   • This will search for items in the user’s mailbox and copy the results to the Recovered Items folder in the admin’s mailbox.

3. Recover the Items:

   • Once the items are found, you can restore them to the original mailbox using:

     Restore-Mailbox -Identity "user@domain.com" -TargetMailbox "user@domain.com" -TargetFolder "Inbox"
     

4. Disconnect from PowerShell:

   • After completing the recovery process, disconnect the session:

     Remove-PSSession $Session
     

---

Step 6: Check the Retention Policy and Recovery Limitations

In some cases, even if you follow all the steps above, deleted emails may no longer be recoverable. Here are a few reasons why that might happen:

• Retention Period Expired: Microsoft 365 has retention periods that dictate how long deleted items are recoverable. After this period (typically 14–30 days), emails are permanently deleted.
• User's Retention Policy: If the organization has configured specific retention policies that apply to emails, those might limit the recovery window or prevent the recovery of certain items.

Review Retention Settings:

1. In the Admin Center, you can review retention policies by going to Compliance Center → Information governance → Retention.
2. Ensure that policies are set to retain deleted items for the desired period.

---

Conclusion

• For users: First check the Deleted Items folder in Outlook or OWA and use the "Recover deleted items" feature to restore the emails.
• For administrators: If the email is permanently deleted and is within the recoverable retention period, you can recover it via the Microsoft 365 Admin Center or using PowerShell.
• Retention Policies: Be mindful of the retention settings for deleted emails, as emails older than the retention window may not be recoverable.

By following these steps, you can efficiently recover deleted emails from a user's mailbox in Microsoft 365, either by the user themselves or with administrative help.