Lost a years worth of sent emails

Question

I have lost 1 years worth or sent emails that seem to have been deleted from Nov 24 to Nov 25. How can I retrieve these? My host provider said I need to contact Microsoft support.

Answer 1

Dear Domini Atkin

This is a user-to-user community. As moderators, we have limited access to internal development details. Our role is to direct users to the appropriate support channels and resources. While we cannot provide backend analysis, we will do our best to assist within our responsibilities. 

Thank you for reaching out to the Microsoft Q&A forum. I understand you’re missing about one year of messages from your Sent Items (Nov 2024 to Nov 2025) and want to know how to retrieve them, including how to access an “audit log.” I am happy to assist you. Please:

• Confirm the messages are truly missing
  • Sign in to Outlook on the web (Outlook.com), open Sent Items, and use Search to locate a known recipient/subject.  
• Restore if they were deleted (Deleted Items, Junk, then Recoverable Items) 
  • In Outlook.com, first check Deleted Items and Junk Email. If not there, open Deleted Items and select “Recover items deleted from this folder,” then restore the messages.  
• Check if a rule moved or deleted sent mail 
  • Review mailbox rules because rules can automatically move or delete messages.  
• About the “audit log” 
  • Please note that audit log search is a Microsoft Purview feature for Microsoft 365/Office 365 enterprise organizations and requires specific admin roles (Audit Logs / View-Only Audit Logs). It isn’t an end-user feature for typical Outlook.com home accounts.  
• If nothing is recoverable via steps above  Contact Support via:  
  • Visit Contact - Microsoft Support     
  • Type a brief description of your issue in the search box    
  • Scroll down to the bottom > select Sign in to contact support    
  • Log in to your personal Microsoft account.     
  • Under Products & Services, select "Other Products"; Under Categories, select a suitable Category.   
  • Click "Chat with a support agent in your web browser" (during business hours) 

Thank you for your understanding.

Answer 2

To retrieve your lost sent emails from the specified period, you can use the Microsoft Purview audit log to investigate deletion activities. Here are the steps you can follow:

1. Access the Audit Logs: Ensure you have the Audit Logs role assigned in Microsoft Purview.
2. Connect to Exchange Online PowerShell: Use the command Connect-ExchangeOnline to connect.
3. Run Audit Log Searches: You can search for deleted emails using the following PowerShell command:

      Search-UnifiedAuditLog -StartDate 11/24/2022 -EndDate 11/25/2023 -UserIds <your_email> -Operations SoftDelete,HardDelete -ResultSize 1000
   

   Replace <your_email> with your actual email address.
4. Check Deleted Items: If the emails were moved to the Deleted Items folder, you can also check there for recovery options.
5. Contact Support: If you are unable to retrieve the emails yourself, contacting Microsoft Support may be necessary for further assistance.

Make sure to act quickly, as there may be retention policies that affect how long deleted emails can be recovered.

---

References:

• Identify who deleted an email message or why an email is missing
• Search the audit log to investigate common support issues