Trash Emails

Question

Looking for a trashed email in November 2025 but no November emails are showing. Help!!

---

Moderator: Moved from Microsoft Edge | Other | Windows 11

Answer 1

Hi. I'm Brian and I'll try to help.

Did you empty the Deleted Items folder? If so, did you look in the "Recover items deleted from this folder" folder? Messages in the Deleted Items folder are automatically purged after 30 days and move to the Recover area for another 30 days, after which they are removed permanently and cannot be recovered. Do you have the setting chosen that empties Deleted Items when you sign out?

Answer 2

To investigate missing emails, including those that may have been deleted or trashed, you can follow these steps:

1. Check Auditing Settings: Ensure that auditing was enabled for the mailbox when the emails were deleted. You can do this by running the following command in PowerShell:

      Get-Mailbox <mailbox> | Select AuditEnabled, AuditOwner, AuditDelegate, WhenCreated
   

2. Search for Deleted Emails: Use the Search-UnifiedAuditLog command to look for deleted emails within the specified date range. For example, to search for emails deleted in November 2025, you would run:

      Search-UnifiedAuditLog -StartDate 11/01/2025 -EndDate 11/30/2025 -UserIds <user1,user2> -Operations SoftDelete,HardDelete,MoveToDeletedItems -ResultSize 1000
   

   Replace <user1,user2> with the actual user email addresses.
3. Check Retention Policies: If no deletion records are found, check if any retention policies might have automatically deleted emails during that timeframe. You can search for retention policy actions using:

      Search-UnifiedAuditLog -StartDate 11/01/2025 -EndDate 11/30/2025 -UserIds <user1,user2> -Operations TaggedAsRecord,ApplyRetentionTag -ResultSize 1000
   

4. Shared Mailbox Auditing: If the email was in a shared mailbox, ensure that auditing is enabled for that mailbox as well. You can check this with:

      Get-Mailbox <sharedmailbox> | Select AuditEnabled, AuditOwner, AuditDelegate, AuditAdmin
   

5. Enable Comprehensive Auditing: If auditing was not enabled, you can enable it for future monitoring using:

      Set-Mailbox <mailbox> -AuditEnabled $true -AuditOwner @{Add="SoftDelete","HardDelete","MoveToDeletedItems","Move","Create","Update"}
   

By following these steps, you should be able to identify the status of the trashed emails and understand why they are not showing up.

---

References:

• Identify who deleted an email message or why an email is missing
• Missing search results