Could not find an email deleted using the Search Query

Question

Few users received some unwanted email and Management informed to delete the email from their Mailboxes.

So, I used Search Query and deleted those emails within 2 hrs from the Received time from all the mailboxes.

But after a week , we got a request from Legal Team asking for a copy of that email or all the copies , as it was sent to 21 users.

Email gateway is not configured to keep a copy of incoming emails.

So, checked for the Backup , as we have an option on Exchange DB to keep the "Deleted Items for 7 days".

Unfortunately, could not find that email anywhere, not in Backup nor anywhere.

So, why it was permanently deleted , when it should have been there in Permanent Delete Items till the retention period.

Answer 1

Well, it won't help you now of course :)
The idea of Single Item Recovery is to ensure that you can recover items a user deletes even if they empty their mailbox "dumpster"

https://learn.microsoft.com/en-us/exchange/recipients/user-mailboxes/single-item-recovery?view=exchserver-2019

Personally, I prefer 30 days for each mailbox, but that is really up to each business and their requirements.

I wouldn't rely on that however when using the -DeleteContent switch. Instead, copy the items to another mailbox before removing them with that command

Example from that doc I linked above:

Search-Mailbox -Identity "April Stewart" -SearchQuery 'Subject:"Your bank statement"' -TargetMailbox "BackupMailbox" -TargetFolder "AprilStewart-DeletedMessages"   
-LogLevel Full -DeleteContent

Answer 2

@Imthyas
Hi,

The Deleted item retention setting ("Deleted Items for 7 days" in this case) moves the deleted items to the "Recoverable Items" folder and keep them for 7 days before permanently delete.
And the "Don't permanently delete items until the database is backed up" keeps the deleted items there until a database backup is done.

However,if you run the Search-Mailbox command with DeleteContent parameter via EMS to delete items, it will delete all items in the search result (including the ones in the Recoverable folder) permanently.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

What specific command did you use to delete them?
Typically the messages are gone unless Single Item Recovery is enabled on the mailbox or its on hold.

If you used https://learn.microsoft.com/en-us/exchange/search-for-and-delete-messages-exchange-2013-help

then note:

When you use the Search-Mailbox cmdlet with the DeleteContent switch, messages are permanently deleted from the source mailbox. Before you permanently delete messages, we recommend that you either use the LogOnly switch to generate a log of the messages found in the search before they're deleted or copy the messages to another mailbox before deleting them from the source mailbox.

Answer 4

the command is like this:
Get-Mailbox -resultsize unlimited |Search-Mailbox -SearchQuery 'Subject:"FW: ???????"','From:"xxxxxxxxx@Karima ben .com"' -DeleteContent | select-object Identity,Success

Also ,I have Enabled -- Keep Deleted Items for 7 days and also the option "Don't permanently delete the Items until the DB is backed up"

So, even though I have the above option, I need to enable Single Item Recovery for each of the mailbox.