How to restore historic emails following an account compromise/hack?

Question

Hi, my email account was unfortunately hacked last week and whilst the account is now restored, I've noticed that all my incoming/outgoing emails that pre-date 1st January are no longer visible. Even when I try and recover deleted items in the last 30 days, my original emails are no longer there. Does anyone know of a way to recover this historic data or has it gone forever? :-( Many thanks.

Answer 1

Hi ,

I'm Dyari. Thanks for reaching out.

If the hacker has not deleted the emails, you can try the steps provided by Q&A Assist. If they are not recoverable, I’m afraid they have been permanently deleted, and there is no way to recover them.

Answer 2

To restore historic emails following an account compromise, you can follow these steps:

1. Check the Recoverable Items Folder: If your emails were deleted, they might be in the Recoverable Items folder. You can use the In-Place eDiscovery feature in the Exchange admin center (EAC) to search for missing items. However, be aware that you cannot restrict the search to just the Recoverable Items folder.
2. Use PowerShell to Search for Deleted Items: If you have access to PowerShell, you can use the Get-RecoverableItems cmdlet to search for recoverable deleted messages. For example:

      Get-RecoverableItems -Identity your-email@example.com -FilterItemType IPM.Note
   

   This command will help you find all recoverable items in your mailbox.
3. Recover Deleted Items: If the deleted items retention period has not expired, you may be able to recover soft-deleted items. In Exchange Online, the default retention period is 14 days, but it can be extended up to 30 days.
4. Contact Support: If you are unable to recover your emails using the above methods, consider reaching out to Microsoft support for assistance. They may have additional tools or options available to help recover your data.

It's important to act quickly, as the ability to recover deleted emails may be time-sensitive depending on your account settings and policies.

---

References:

• Recover deleted messages in a user's mailbox in Exchange Server
• Respond to a compromised cloud email account