Request a mailbox restore

Question

My Outlook inbox messages were overwritten after a hacking incident. I need a full mailbox restore to the state before the attack. please restore my mailbox to a previous date (before Feb 16, 2026).

Answer 1

Hi Ahmed Emam

Thanks for posting your question. I understand how concerning it is to discover that your Outlook inbox was altered following a hacking incident, and I appreciate you explaining the timeline clearly.

If you are using Outlook.com personal (consumer) accounts, Microsoft does not support restoring an entire mailbox to a previous date or point in time (for example, before Feb 16, 2026). This type of full mailbox restore is only available for Microsoft 365 work or school accounts and must be performed by an organization’s administrator using enterprise backup tools. As a result, a full mailbox rollback is unfortunately not possible for Outlook.com personal accounts.

While a full restore isn’t supported, you can still try the following user‑side recovery options, which depend on Microsoft’s retention policies:

1. Recover deleted items Sign in to Outlook.com on the web > open “Deleted Items” > select “Recover items deleted from this folder”. This may restore messages that are still within the recoverable retention window.
2. Check other folders Review folders such as Archive, Junk Email, and Other, as compromised accounts are often affected by hidden rules that move messages automatically.

If the messages no longer appear in the recovery list, it means they are outside the retention period and cannot be restored.

Since this was a hacking incident, I strongly recommend securing your account to prevent further data loss:

• Change your Microsoft account password immediately using a strong, unique password: https://account.live.com/ResetPassword.aspx
• Review recent sign‑in activity and confirm all locations and devices are recognized: What is the Recent activity page?
• Go to Outlook.com settings and check:
  • Mail > Rules: remove any rules you did not create.
  • Mail > Forwarding: ensure no external email address is configured.
• Enable two‑step verification if it is not already turned on: How to use two-step verification with your Microsoft account
• Scan your device for malware before signing in again, as compromised devices can recreate malicious rules.

For more details, you can see: Recover deleted email messages in Outlook.com

Please feel free to keep me updated, Thank you for your time and understanding

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".    

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Mailbox restore for Outlook.com or consumer Outlook on the web cannot be performed directly here.

For Microsoft 365 work or school mailboxes, a full mailbox restore to a prior point in time is done by an administrator using Microsoft 365 Backup for Exchange:

1. In the Microsoft 365 admin center, go to Microsoft 365 Backup.
2. In the Exchange section, select Restore.
3. On Select type of content, keep Exchange mailbox content (emails, notes, contacts, calendars, and tasks) selected and choose Next.
4. Select the affected mailbox from the list of backed-up Exchange accounts and choose Next.
5. On Content scope, choose All emails, notes, contacts, calendars, and tasks to perform a full mailbox restore.
6. Select a restore point in time that is before the hacking incident (for example, a date and time before 16 Feb 2026). Confirm that backups exist for that time, then choose Next.
7. Choose the destination option:
   • Create a new folder for the backups (restores into a folder named Recovered Items YYYY-DD-MM, HH:MM), or
   • Replace mailbox items with backups (overwrites current versions of items with the backup content).
8. Review the settings on Review and finish, then select Restore user mailboxes.
9. Monitor progress on the Restoration tasks tab.

Note that Microsoft 365 Backup restores only deleted or modified mailbox items from the selected point in time; items that are unchanged are not overwritten. Items still in the Deleted Items folder are not restored by this feature and must be moved back manually by the mailbox user.

If the mailbox is an Exchange Online user mailbox that was soft-deleted (for example, license removed or account deleted) rather than just overwritten, it can be restored using Undo-SoftDeletedMailbox in Exchange Online PowerShell within the 30‑day retention period.

---

References:

• Restore data in Microsoft 365 Backup
• Delete or restore user mailboxes in Exchange Online