Cannot find a deleted user on eDiscovery

Question

Hi All,

we had a user in 2019 and now I need to get their emails for 2018 and 2019. I tried to create a Core eDiscovery for this, but I am not able to find his name on Exchange Mailbox to specify the location for eDiscovery search. I can see other inactive mailboxes but not this specific one. I tried to find the user via PowerShell,

"Get-MsolUser -All -ReturnDeletedUsers | Select-Object UserPrincipalName, DisplayName"

But this command only return the list of users who were deleted recently.

I really appreciate any advice on this.

Thanks
Nick

Answer 1

Hi Michev and Eric Yin,

Thanks for you messages, I was not able to find the user using eDiscovery or Powershell. However, I was able to find the emails sent from the user account and received by them. As I was not able to locate the user on eDiscovey search, I added their email manually and ran the search. I believed this is because of our recent migration to Office 365, may be the user never had an account in O365. Anyhow, I got what I was looking. Thanks

Appreciate your support.

Thanks
Nick

Answer 2

If you are not able to see him as inactive mailbox, you wont be able to perform eDiscovery. Just FYI, you should prefix inactive mailboxes with dot (.) when entering them in the eDisovery/Content search UI.

Answer 3

Hi,
If you can't find the user with command "Get-MsolUser -ReturnDeletedUsers", that means the user has been deleted from recycle bin (30 days) and can't be restored.
I'm afraid you should try other methods, maybe check if any pst remained?

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.