Could not find an email deleted using the Search Query

Imthyas 116 Reputation points
2020-11-29T16:29:48.517+00:00

Few users received some unwanted email and Management informed to delete the email from their Mailboxes.

So, I used Search Query and deleted those emails within 2 hrs from the Received time from all the mailboxes.

But after a week , we got a request from Legal Team asking for a copy of that email or all the copies , as it was sent to 21 users.

Email gateway is not configured to keep a copy of incoming emails.

So, checked for the Backup , as we have an option on Exchange DB to keep the "Deleted Items for 7 days".

Unfortunately, could not find that email anywhere, not in Backup nor anywhere.

So, why it was permanently deleted , when it should have been there in Permanent Delete Items till the retention period.

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,480 questions
{count} votes

Accepted answer
  1. Andy David - MVP 144.7K Reputation points MVP
    2020-11-29T19:13:30.083+00:00

    Well, it won't help you now of course :)
    The idea of Single Item Recovery is to ensure that you can recover items a user deletes even if they empty their mailbox "dumpster"

    https://learn.microsoft.com/en-us/exchange/recipients/user-mailboxes/single-item-recovery?view=exchserver-2019

    Personally, I prefer 30 days for each mailbox, but that is really up to each business and their requirements.

    I wouldn't rely on that however when using the -DeleteContent switch. Instead, copy the items to another mailbox before removing them with that command

    Example from that doc I linked above:

    Search-Mailbox -Identity "April Stewart" -SearchQuery 'Subject:"Your bank statement"' -TargetMailbox "BackupMailbox" -TargetFolder "AprilStewart-DeletedMessages"   
    -LogLevel Full -DeleteContent
    
    0 comments No comments

3 additional answers

Sort by: Most helpful
  1. Kael Yao-MSFT 37,676 Reputation points Microsoft Vendor
    2020-11-30T03:16:55.617+00:00

    @Imthyas
    Hi,

    The Deleted item retention setting ("Deleted Items for 7 days" in this case) moves the deleted items to the "Recoverable Items" folder and keep them for 7 days before permanently delete.
    And the "Don't permanently delete items until the database is backed up" keeps the deleted items there until a database backup is done.

    However,if you run the Search-Mailbox command with DeleteContent parameter via EMS to delete items, it will delete all items in the search result (including the ones in the Recoverable folder) permanently.


    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    2 people found this answer helpful.
    0 comments No comments

  2. Andy David - MVP 144.7K Reputation points MVP
    2020-11-29T16:35:07.117+00:00

    What specific command did you use to delete them?
    Typically the messages are gone unless Single Item Recovery is enabled on the mailbox or its on hold.

    If you used https://learn.microsoft.com/en-us/exchange/search-for-and-delete-messages-exchange-2013-help

    then note:

    When you use the Search-Mailbox cmdlet with the DeleteContent switch, messages are permanently deleted from the source mailbox. Before you permanently delete messages, we recommend that you either use the LogOnly switch to generate a log of the messages found in the search before they're deleted or copy the messages to another mailbox before deleting them from the source mailbox.

    0 comments No comments

  3. Imthyas 116 Reputation points
    2020-11-29T19:01:36.01+00:00

    the command is like this:
    Get-Mailbox -resultsize unlimited |Search-Mailbox -SearchQuery 'Subject:"FW: ???????"','From:"xxxxxxxxx@Karima ben .com"' -DeleteContent | select-object Identity,Success

    Also ,I have Enabled -- Keep Deleted Items for 7 days and also the option "Don't permanently delete the Items until the DB is backed up"

    So, even though I have the above option, I need to enable Single Item Recovery for each of the mailbox.

    0 comments No comments