What are the correct steps to reliably recover permanently deleted items in Exchange Online

Question

we are trying to recover permanently deleted items from a user’s mailbox using the Recoverable Items folder. However, when we search via Outlook and also through the Compliance Center eDiscovery tool, the items do not appear, even though they should still be within the retention period. We confirmed that the mailbox has Single Item Recovery enabled, and Litigation Hold is active.

I also attempted to run a PowerShell search using Search-Mailbox and New-ComplianceSearch, but the deleted emails still cannot be found. This makes it unclear whether the items are truly purged or if there is a configuration issue preventing recovery.

Answer 1

Hi Schott Cyndi

Thank you for reaching out to Microsoft Q&A forum

Based on your description, I understand that you are facing challenges in recovering permanently deleted items from a mailbox's Recoverable Items folder in Exchange Online, despite confirming that the items are within the retention period, Single Item Recovery is enabled, and Litigation Hold is active. Searches conducted via Outlook, the Microsoft Purview Compliance Center's eDiscovery tool, and PowerShell cmdlets such as Search-Mailbox and New-ComplianceSearch have failed to locate the items, leading to uncertainty about whether the emails have been truly purged from subfolders like Deletions, Purges, or Versions, or if there's an underlying configuration, quota, or search parameter issue preventing their discovery and recovery.

I have conducted some research and testing and based on that, I think you can try my suggest approach below to see if the issue can be resolved:

Option 1: Verify Mailbox configuration and recoverable items status:

• Run this cmdlet to verify Single Item Recovery, Litigation Hold, and retention period (default 14 days, max 30).

    Get-Mailbox -Identity <UserPrincipalName> | Select SingleItemRecoveryEnabled, LitigationHoldEnabled, RetainDeletedItemsFor 
    
  

• Then, execute the cmdlet to view subfolder sizes. If the quota is exceeded, reduce it by manually purging unnecessary items from Deletions via Outlook or PowerShell.

    Get-MailboxFolderStatistics -Identity <UserPrincipalName> -FolderScope RecoverableItems | Select Name, FolderPath, ItemsInFolder, FolderSize 
  

Link reference: https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/recover-deleted-messages

Option 2: Perform targeted PowerShell searches for recoverable items:

Standard searches may miss items if not explicitly configured to include the dumpster (Recoverable Items). Retry with these cmdlets:

• Use this cmd to list deleted emails matching criteria like subject or date range. This directly queries the Recoverable Items folder, including subfolders like Purges.

Get-RecoverableItems -Identity <UserPrincipalName> -FilterItemType IPM.Note -SubjectContains "<Keyword>" -FilterStartTime "<StartDate>" -FilterEndTime "<EndDate>" 

• If items are found, restore them with

Restore-RecoverableItems -Identity <UserPrincipalName> -FilterItemType IPM.Note -SubjectContains "<Keyword>" -FilterStartTime "<StartDate>" -FilterEndTime "<EndDate>" -SourceFolder RecoverableItems

Items will restore to their original folders or Deleted Items if the original is missing.

• For Search-Mailbox, ensure you include the -SearchDumpster parameter

Link reference: https://learn.microsoft.com/en-us/exchange/security-and-compliance/recoverable-items-folder/recoverable-items-folder

Hope my answer will help you, if the issue still persists, kindly let me know in the comment section

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".     

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread