Although mailbox data in Office 365 is fairly secure, it does not mean it is protected from deleting. Users, either by accident or on purpose, can remove their emails from Inbox and Deleted Items folder or even purge them from Recoverable Items folder. What’s more, retention policies can exist, which live only for deleting certain emails from users’ mailboxes. Of course, Office 365 gives you a plan B, just in case you would need to recover deleted emails. This plan, however, only works when the time gap between deletion and recovery is not too big.
So what options do you have when a user comes to you begging for help recovering deleted emails in Office 365?
Native options to recover deleted items in Office 365
In Office 365, there are two ways a deleted email can be recovered. The first one involves users who can recover deleted emails by themselves using built-in recovery options. The second option requires some help from an administrator to search for a deleted email using eDiscovery. Below you will find instructions on how to proceed in either way.
- Recover deleted emails in Office 365 – user’s instruction
- Recover deleted emails in Office 365 – admin’s instruction
Recover deleted emails in Office 365 – instruction for users
In many cases, users can recover a deleted email by themselves within their Office 365 account. Once a user has noticed that they accidentally deleted an email, he or she can restore it directly from the Deleted Items folder. If the email was e.g. hard deleted (using a Shift+Delete key combination) or removed from the Deleted Items folder by a user or a retention policy, it needs to be recovered from the Recoverable Items folder. Follow the steps below to recover deleted items from the Deleted Items folder or Recoverable Items folder:
Method 1: Recover emails from Deleted Items folder:
- In your Office 365 account, go to the Mail app.
- On the left folder pane, go to the Deleted Items folder and click on it.
- In the Deleted Items folder, find the message you want to restore and right-click on it. In the resulting window, extend the Move option and select Inbox (or Move to a different folder… if you want to move that email to a different location).
- Now, the deleted email should be moved back to your Inbox.
But what if a deleted email is not present in the Deleted Items folder anymore? Then, you can search for that email in the Recoverable Items folder.
Method 2: Recover items from the Recoverable Items folder:
- In your Office 365 account, go to the Mail app.
- Now, on the left folder pane, go to the Deleted Items folder, right-click on the folder, and select the Recover deleted items option.
or, if you are already in the Deleted Items folder, click the link Recover deleted items on top of a deleted-email list.
- In the resulting window, find an email you want to recover, right-click on it, and then click Recover.
- If you need to recover more emails at once, you can select them by checking a checkbox next to each email (you need to hover over an email to see the checkbox). When emails have been selected, click the Recover button located on top of the window.
- All selected emails should appear in the Inbox folder.
There also might be a situation when a user cannot find a deleted email in their Office 365 mailbox. If that is the case, a user will probably ask you to recover missing emails.
Recover deleted items in Office 365 – instruction for administrators
If a user was not able to recover deleted emails from their Office 365 mailbox, you can do it directly in Exchange Online using the In-Place eDiscovery & Hold option (you have to be a global administrator in Office 365 to proceed). To recover deleted emails, follow the step below:
Important: You can recover emails only if they had not been purged from the user’s mailbox. In other words, you can recover deleted emails if they are still available in the Recoverable Items folder. If they’re not, you will not recover those emails.
- Before you will be able to follow this procedure, make sure you have sufficient rights to perform eDiscovery search. To check that:
a. Log in to your Office 365 account and go to the app view. Click the Admin app.
b. On the left pane, extend Admin center and click on Exchange to open Exchange admin center.
c. Then, go to Permissions>Admin roles. From the list of roles, select Discovery Management and click the Pencil icon to edit that role.
d. In the resulting window, go to the Members section and click the Plus icon to add a member. Search for yourself, click Add and then OK. Click Save.
e. Now, sign out and sign in again to Office 365, so changes take effect.
- Once you have assigned permissions to yourself, go to the Compliance management section and then In-Place eDiscovery & Hold. Click on the Plus icon to create a new search.
- Provide a name for your search and, optionally, a description. Click Next.
- Now, you can choose a mailbox that you want to search. To do that, select the Specify mailboxes to search option, and then click on the Plus icon to add a mailbox. Click Next, once you have added it.
- The next step is to specify criteria for a search query. To do that, click the Filter based on criteria option, and adjust search options to your needs.
Note: When you need to provide more than just one keyword in a search query, remember to separate them with OR or AND, not commas!
- In the same window, click on the Select message types… button to narrow down the search to emails. A new window will open. Click Select the message types to search and tick a checkbox next to Email. Click OK.
- Once you adjusted the search query to your needs, click Next.
- In the In-Place Hold settings page, click Finish without checking any checkbox as we do not want to place content on hold.
- Now, your settings will be saved. Once the process is completed, click Close.
- Go back to the In-Place eDiscovery & Hold tab, click your newly created search and click on the Export to a PST file icon.
- If an installation window appears, click Run to install the eDiscovery Export Tool application.
- In the eDiscovery PST Export Tool window, select a location for your PST file using the Browse button. Leave the options Enable deduplication and Include unsearchable items unchecked.
- After selecting a location for the PST file, click Start to download the file to your computer. If you are asked to provide your Discovery Export Credentials, enter them and click OK. Once the process is completed, go to the location where the file is saved.
- Now, it’s time to open recovered emails from the PST file in a user’s mailbox. To complete this step, you can either advise a user on how to do it or import the file yourself. To proceed, you need a desktop version of Outlook as Outlook on the Web and Outlook Web App does not open PST files.To start, open your Outlook, and go to the File tab. Then, click Open & Export>Open Outlook Data File.
- In the resulting window, search for the PST file that contains recovered emails, select it, and click OK.
- Now, you should see a new folder tree in your Outlook. Expand that new PST file using the arrow, and click on the folder from which you want to recover emails. In my example, it is the Inbox folder.
- To recover a selected email, right-click on it and then click Move>Other folder…
- Select a folder and click OK.
- A deleted email should appear back in your Outlook personal folder.
Limitations/inconvenience of native solutions
Native options, though helpful, have some limitations that you may found inconvenient when managing deleted data. Take a look at the list below to learn more:
- If a folder has been deleted from Deleted Items, you can recover only single items that the folder included, not the folder itself. It means that emails will be recovered to Inbox, not to the original folder.
- Permanently deleted emails can be recovered from Recoverable Items within 14 days (by default) or within 30 days (option for Exchange Online mailboxes – you need to remember set 30-day retention up first). After that time, emails can’t be recovered.
- Emails purged from the Recoverable Items folder can’t be recovered.
- To extend a retention period to more than 30 days, you need to place a mailbox on In-Place Hold or Litigation Hold.
- In-Place Hold is a premium feature, which requires an Exchange Online Plan 2 or Exchange Online Archiving license.
- Deleted emails found by eDiscovery are not recovered directly to an original location – you need to export them to a PST file first and then import to the user’s mailbox (or ask a user to do that themselves).
- Recovered emails imported via a PST file are not imported directly to their original folders – they need to be moved manually to corresponding folders.
- To restore deleted emails using a PST file, you need to use a desktop version of Outlook (Outlook on the Web does not open PST files).
- To view deleted emails in the Recovery Items folder, you need to copy eDiscovery results to a discovery mailbox.
- The procedure can be considered time consuming
Email recovery with a third party tool – CodeTwo Backup for Office 365
If native solutions do not exactly meet your requirements, you need to use a third party tool like CodeTwo Backup for Office 365. The application overcomes native limitations allowing you to manage email recovery process in an easier and faster manner.
Below I listed some of the advantages that come with CodeTwo Backup for Office 365 and help to overcome native limitations:
- Offline access to deleted items.
- Even if an email has been permanently deleted from a mailbox, it still can be recovered from the offline backup copy.
- If a user deleted an entire folder, you can restore that folder with all emails in it.
- Deleted emails can be restored from the program’s console directly to users’ mailboxes – there is no need to export search results to a PST file, and then import them to a mailbox via Outlook.
- you can preview email content before recovering it.
How to recover emails with CodeTwo Backup for Office 365
To recover deleted emails using a CodeTwo Backup application, you first need to make sure you created a backup copy of your emails. Backed up emails are stored on your local drive, so you can access them at any time, even if you are offline. Every time a user deletes an email, either by accident or on purpose, you can search backup copies and recover missing emails immediately.
So how to recover deleted emails in Office 365 using CodeTwo Backup program? Follow the instruction below to learn more.
Note: I have already created backup copies of my emails using CodeTwo Backup. To see how to do this, follow this link.
- To start a restore job, open the CodeTwo Backup console and click on the Backups tab.
- In the Backups tab, select a storage that contains a mailbox you want to search.
- Once you have selected a storage, you should see a list of mailboxes available within that storage. They are displayed on the left-hand side of the console.
- Find the mailbox you want to search and click on the plus icon next to it to extend the folder tree. Then, click Inbox to see the list of emails.
Note: When you click on a specific email in the middle pane, you will see its preview in the right-hand side pane.
- To search emails, you can also use a built-in search engine. It gives you various criteria to select from.
- When you have found emails you want to recover, you can preview them in the right-hand pane. Additionally, you can check the time when an email was created, modified or deleted. If a user removed an email, its removed version will appear on the list of versions as Deleted on.
Note: The Deleted on version only indicates that an email was removed. To recover a deleted email, select its Created on or Modified on version.
- To restore a selected email, right-click on it and then click Restore selected items.
Note: You can select more emails to be restored at once by pressing Ctrl or Shift on your keyboard while selecting particular emails.
- Now, the Create restore items job wizard will open. In the first step, provide a name for your restore job. Then, click Next.
- In the Source data section, you can double check details about selected emails.
- It’s time to select a target location for emails you want to recover. Use the Manage button to select a server connection. Then, decide whether to restore the emails to the original location or to an alternative one. Once you have finished, click Next.
- Now, adjust restore options to your needs. Then, click Next.
- In the Job summary section, you can check details of an already created restore job. If everything is fine, click Finish.
- The job will not start automatically so the application will ask you whether you want to start the job now. Click Yes to start the restore process (or No if you prefer to start that job later – you can do it from the Jobs tab).
- To monitor the restore job progress, go to the Jobs tab, find your restore job, and click on it. All details regarding that process will display in the lower pane.
- Once the job has finished, access the mailbox to view recovered emails.
And that’s it! The process is very simple and doesn’t take much time. You do not have to play with PST files, and what even more appealing, there is no need to engage end users in the process. The entire recovery process can be done with just a few clicks from one place.