email hacked all items deleted

Question

email hacked all items deleted

David Delfs 60

My email was hacked. They took control. I've changed password and removed the rules and forwarding. All of my emails were permanently deleted to hide activity. Is there any way for me to see the actual history of activity on the account and to recover my old messages?

0 comments

Answer accepted by question author

Brian Tillman 27,015 Independent Advisor

Microsoft doesn't keep backups of people's mailboxes. If the messages were deleted by the hacker and then purged from the mailbox, they're gone for good. However, since this forum is dedicated to using classic Outlook for Windows, perhaps you were not using a Microsoft mailbox. In that case, you'll need to contain your mail provider. With classic Outlook for Windows, you could make periodic backups of your mail so you don't lose important messages.

David Delfs 60 Reputation points

2026-01-18T23:51:51.2466667+00:00

It was a .msn account so my long-time Microsoft mailbox, per your guidance, the messages are likely gone. Thanks

2 additional answers

Your answer

David Delfs 60 Reputation points

2026-01-18T23:51:51.2466667+00:00

It was a .msn account so my long-time Microsoft mailbox, per your guidance, the messages are likely gone. Thanks

Answer 1

David Delfs 60

how best to contact microsoft support

0 comments

Answer 2

To investigate the activity on your hacked email account and potentially recover deleted messages, you can follow these steps:

Check Audit Logs: Microsoft provides audit logs that can help you identify actions taken on your account. You can search the audit log for events related to deleted email items. Since mailbox audit logging is enabled by default for Office 365 and Microsoft 365 organizations, you can access these logs to see if there are records of deleted emails. Use the following PowerShell command to search for deleted items:
```
   Search-UnifiedAuditLog -StartDate <start_date> -EndDate <end_date> -UserIds <your_email> -Operations SoftDelete,HardDelete -ResultSize 1000
```
Replace <start_date> and <end_date> with the appropriate dates and <your_email> with your email address.
Recover Deleted Emails: If your emails were deleted but are still within the retention period, you may be able to recover them. Check the Deleted Items folder and the Recoverable Items folder in your mailbox. If items are found there, you can restore them.
Message Trace: You can also use the Message Trace feature in the Microsoft Defender portal to verify the contents of your Sent Items folder and see if any messages were sent during the time your account was compromised.
Investigate Suspicious Activity: Look for any unusual activity in your account, such as changes to inbox rules or suspicious messages in your Sent Items or Deleted Items folders. This can provide insight into what actions were taken by the hacker.
Contact Support: If you are unable to recover your emails or need further assistance, consider reaching out to Microsoft support for help with your compromised account.

By following these steps, you should be able to gather information about the activity on your account and take action to recover any deleted messages if possible.

References: