This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(105.60000000000001, 30%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPD%3C/text%3E%3C/svg%3E)
Hello everyone!
I'm confused. How to recover deleted messages in exchange online mailbox with litigation hold? It seems that deleted messages must be plased to "Recoverable Items " folder, but what if my user deleted messages from this folder too?
Hi!
Recapping:
Content search: https://learn.microsoft.com/en-us/microsoft-365/compliance/use-content-search-for-targeted-collections?view=o365-worldwide
or
https://learn.microsoft.com/en-us/microsoft-365/compliance/content-search?view=o365-worldwide
2) With "litigation hold" applied, the emails can be deleted from recoverable items folder, these emails will go in the "Purge" folder, and can be recovered with Content Search, eDiscovery, Advanced eDiscovery, Recover deleted items in Admin Center.
3) All the deleted emails not older than 14-30 days can be recovered, even if the mailbox doesn't have the "litigation hold" enabled.
4) If the mailbox has the "litigation hold" enabled, all the deleted emails can be recovered no matter when them where deleted.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(252.8, 22%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELL%3C/text%3E%3C/svg%3E)
Wow! Thank you for sharing such detailed content!This will definitely help more people : )
Hi @Pavel.Dyachuk ,
Yes, you could following the path in new Exchange Admin Center to recovering delted message: Recipients -> Mailboxes -> Select the mailbox -> More actions -> Recover deleted items.
You could also run the following command to search for messages and restore recovered items:
Get-RecoverableItems -Identity <> -SubjectContains <> -FilterItemType <> -FilterStartTime <> -FilterEndTime <>
Restore-RecoverableItems -Identity <> -FilterItemType <> -SubjectContains <> -FilterStartTime <> -FilterEndTime <> -MaxParallelSize <>
For more information you could refer to the link proivded by Andy.
According to the following Microsoft official article we could know the difference between enabling and disabling Litigation Hold. For more information you could refer to: Recoverable Items folder in Exchange Online and In-Place Hold and Litigation Hold
----------
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi!
It seems that my user can purge messages from recoverable items folder despite Litigation Hold.
Yes, that is by design. If you need to recover items that have been purged from the dumpster and the user is on hold or you have single item retention enabled, then you use Ediscovery to find those messages.
Ok. If it's by design - why in this table told that user cant purge messages from recoverable items folder?
The items arent purged if the mailbox s on hold. They may think they are, but they are not
I thought that they just can't delete messages there. If they try - system will tell them that this action restricted.
As I mentioned before, thats not the way it works.
Maybe. Instructions unclear in microsoft help article. For now I'm working with Microsoft support and will update if find something new. Thank you.
Hi @Pavel.Dyachuk ,
Looking forward to your good news.
----------
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi @Pavel.Dyachuk ,
I am writing here to confirm with you how thing going now?
----------
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi!
Still working with Microsoft.
Hi @Pavel.Dyachuk ,
Ok, if there is anything I can help, you can mention it in this post and I will help you further.
----------
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hello!
eDiscovery is the only way I can view and restore deleted messages from mailbox with litigation hold?
If the messages are purged from the recover deleted items folder, that is the supported method, yes
If you are on-prem, you can also use search-mailbox:
https://learn.microsoft.com/en-us/powershell/module/exchange/search-mailbox?view=exchange-ps
You could also view messages with mfcmapi, but that's not really practical:
We are using exchange online. Is help for Exchange Online eDiscovery exists?
In the past, eDiscovery was not comfortable to use. This is the only way?
Yes. Search-mailbox is deprecated in Exchange Online, though it may still work.
Those are your only real options once the message is purged. Those messages are not visible by any client except mfcmapi.
The link I gave above is for Ediscovery and how to use it
Can you please share help for exchange online ediscovery?
It seems that I can recover messages through new Exchange Admin Center. But I can do same to another mailbox without Litigation Hold. So what is the difference?
that recovers messages from the user's dumpster, not items that have been purged from that dumpster