question

PavelDyachuk avatar image
0 Votes"
PavelDyachuk asked LucasLiu-MSFT edited

Litigation Hold. How to recover deleted messages.

Hello everyone!
I'm confused. How to recover deleted messages in exchange online mailbox with litigation hold? It seems that deleted messages must be plased to "Recoverable Items " folder, but what if my user deleted messages from this folder too?

office-exchange-online-itpro
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

PavelDyachuk avatar image
0 Votes"
PavelDyachuk answered LucasLiu-MSFT edited

Hi!
Recapping:
1) To recover deleted messages I can use Content Search, eDiscovery, Advanced eDiscovery, Recover deleted items in Admin Center. 87334-image.png
For Advanced eDiscovery special license needed: https://docs.microsoft.com/en-us/microsoft-365/compliance/overview-ediscovery-20?view=o365-worldwide#subscriptions-and-licensing

Content search: https://docs.microsoft.com/en-us/microsoft-365/compliance/use-content-search-for-targeted-collections?view=o365-worldwide
or
https://docs.microsoft.com/en-us/microsoft-365/compliance/content-search?view=o365-worldwide

2) With "litigation hold" applied, the emails can be deleted from recoverable items folder, these emails will go in the "Purge" folder, and can be recovered with Content Search, eDiscovery, Advanced eDiscovery, Recover deleted items in Admin Center.

3) All the deleted emails not older than 14-30 days can be recovered, even if the mailbox doesn't have the "litigation hold" enabled.

4) If the mailbox has the "litigation hold" enabled, all the deleted emails can be recovered no matter when them where deleted.



image.png (10.3 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Wow! Thank you for sharing such detailed content!This will definitely help more people : )

0 Votes 0 ·
AndyDavid avatar image
0 Votes"
AndyDavid answered AndyDavid edited
· 6
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello!
eDiscovery is the only way I can view and restore deleted messages from mailbox with litigation hold?

0 Votes 0 ·

If the messages are purged from the recover deleted items folder, that is the supported method, yes
If you are on-prem, you can also use search-mailbox:
https://docs.microsoft.com/en-us/powershell/module/exchange/search-mailbox?view=exchange-ps


You could also view messages with mfcmapi, but that's not really practical:


https://stephenegriffin.github.io/mfcmapi/

0 Votes 0 ·

We are using exchange online. Is help for Exchange Online eDiscovery exists?
In the past, eDiscovery was not comfortable to use. This is the only way?

0 Votes 0 ·
Show more comments
PavelDyachuk avatar image
0 Votes"
PavelDyachuk answered AndyDavid commented

It seems that I can recover messages through new Exchange Admin Center. But I can do same to another mailbox without Litigation Hold. So what is the difference?
80187-image.png



image.png (10.3 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

that recovers messages from the user's dumpster, not items that have been purged from that dumpster

https://docs.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/recover-deleted-messages

0 Votes 0 ·
LucasLiu-MSFT avatar image
0 Votes"
LucasLiu-MSFT answered LucasLiu-MSFT commented

Hi @PavelDyachuk ,
Yes, you could following the path in new Exchange Admin Center to recovering delted message: Recipients -> Mailboxes -> Select the mailbox -> More actions -> Recover deleted items.

You could also run the following command to search for messages and restore recovered items:

 Get-RecoverableItems -Identity <> -SubjectContains <> -FilterItemType <> -FilterStartTime <> -FilterEndTime <>
 Restore-RecoverableItems -Identity <> -FilterItemType <> -SubjectContains <> -FilterStartTime <> -FilterEndTime <> -MaxParallelSize <>

For more information you could refer to the link proivded by Andy.

According to the following Microsoft official article we could know the difference between enabling and disabling Litigation Hold. For more information you could refer to: Recoverable Items folder in Exchange Online and In-Place Hold and Litigation Hold
80533-image.png



If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.






image.png (22.5 KiB)
· 11
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi!
It seems that my user can purge messages from recoverable items folder despite Litigation Hold.
80475-1.png


80476-2.png


0 Votes 0 ·
1.png (40.2 KiB)
2.png (21.2 KiB)

Yes, that is by design. If you need to recover items that have been purged from the dumpster and the user is on hold or you have single item retention enabled, then you use Ediscovery to find those messages.

0 Votes 0 ·

Ok. If it's by design - why in this table told that user cant purge messages from recoverable items folder?
80726-image.png


0 Votes 0 ·
image.png (52.8 KiB)
Show more comments

Hi @PavelDyachuk ,
I am writing here to confirm with you how thing going now?



If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


0 Votes 0 ·

Hi!
Still working with Microsoft.

0 Votes 0 ·

Hi @PavelDyachuk ,
Ok, if there is anything I can help, you can mention it in this post and I will help you further.



If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


0 Votes 0 ·