Recover deleted items in a user's mailbox - Admin Help

Note : You have to be a global administrator in Office 365 to perform the steps

 

Step 1 : Assign yourself eDiscovery Permission

The first step is to assign yourself the necessary permissions in Exchange Online so you can use the In-Place eDiscovery tool to search a user's mailbox. You only have to do this once. If you have to search another mailbox in the future, you can skip this step.

  1. Sign in to Office 365 
  2. Head to Admin Center > Select on Exchange 
  3. In Admin Exchange Center, Click on Permission, then click on Admin Roles
  4. Select Discovery Management, Click Edit

     5. In role group, under Members, click Add

  1. In Select Members, select yourself from the list of names, click Add, and then click OK.
  1. In Role Group, click Save.

     8. Sign out of office 365

*You have to sign out before you start the next step so the new permission will take effect.

 

Step 2 : Search the user's mailbox for deleted items

When you run an In-Place eDiscovery search, the Recoverable Items folder in the mailbox that you search is automatically included in the search. The Recoverable Items folder is where permanently deleted items are stored until they're purged (permanently removed) from the mailbox. So, if an item hasn't been purged, you should be able to find it by using the In-Place eDiscovery tool.

 

  1. Sign in to Office 365 with your work or school account.
  2. Select the app launcher icon in the upper-left and click Admin.
  3. In the left navigation in the Office 365 admin center, expand Admin, and then click Exchange.
  4. In the Exchange admin center, click Compliance management, click In-Place eDiscovery & Hold, and then click New .
  5. On the Name and description page, type a name for the search (such as the name of the user you're recovering email for), an optional description, and then click Next.
  6. On the Mailboxes page, click Specify mailboxes to search, and then click Add .
  7. Find and select the name of the user that you're recovering the deleted email for, click Add, and then click OK.
  8. Click Next. The Search query page is displayed. This is where you define the search criteria that will help you find the missing items in user's mailbox.
  9. On the Search query page, complete the following fields:
  • Include all contentSelect this option to include all content in the user's mailbox in the search results. If you select this option, you can’t specify additional search criteria.
  • Filter based on criteriaSelect this option to specify the search criteria, including keywords, start and end dates, sender and recipient addresses, and message types.

Click Next when you've completed the Search query page.

 

    10. On the In-Place Hold settings page, click Finish to start the search. To recover deleted email, there's no reason to place the user's mailbox on hold.

    11. Select the search you just created and click Refresh to update the information displayed in the details pane. The status of Estimate Succeeded indicates that the search has finished. Exchange also displays an estimate of the total number of items (and their size) found by the search based on the search criteria you specified in step 9.

    12. In the details pane, click Preview search results to view the items that were found. This might help you identify the item(s) that you're looking for. If you find the item(s) you're trying to recover, go to step 4 to export the search results to a PST file.

 

    13. If you don't find what you're looking for, you can revise your search criteria by selecting the search, clicking Edit , and then clicking Search query. Change the search criteria and then rerun the search

 

Step 3 : Copy the search result to a discovery mailbox

 

If you can't find an items by previewing the search results or if you want to see which items are in the user's Recoverable Items folder, then you can copy the search results to a special mailbox (called a discovery mailbox) and then open that mailbox in Outlook on the web to view the actual items. The best reason to copy the search results is so you can view the items in the user's Recoverable Items folder. More than likely, the item you're trying to recover is located in the Purges subfolder.

 

  1. In the Exchange admin center, go to Compliance management > In-Place eDiscovery & Hold.

  2. In the list of searches, select the search that you created in Step 2.

  3. Click Search search , and then click Copy search results from the drop-down list.

 

  1. On the Copy Search Results page, click Browse.

  1. Under Display Name, click Discovery Search Mailbox, and then click OK.

 

Note: The Discovery Search Mailbox is a default discovery mailbox that is automatically created in your Office 365 organization.

  1. Back on the Copy Search Results page, click Copy to start the process to copy the search results to the Discovery Search Mailbox.
  1. Click Refresh to update the information about the copying status that is displayed in the details pane.

      8. When the copying is complete, click Open to open the Discovery Search Mailbox to view the search results

 

The search results copied to the Discovery Search Mailbox are placed in a folder that has the same name as the In-Place eDiscovery search. You can click a folder to display the items in that folder.

 

 

When you run a search, the user's Recoverable Items folder is also searched. That means if items in the Recoverable Items folder meet the search criteria, they are included in the search results. Items in the Deletions folder are items that the user permanently deleted (by deleting an item from the Deleted Items folder or by selecting it and pressing Shift+Delete. A user can use the Recover Deleted Items tool in Outlook or Outlook on the web to recover items in the Deletions folder. Items in the Purges folder are items that the user purged by using the Recover Deleted Items tool or items they were automatically purged by a policy applied to the mailbox. In either case, only an admin can recover items in the Purges folder.

 

Step 4 : Export the search result to a PST file

 

After you find the item you're trying to recover for a user, the next step is to export the results from the search you ran in Step 2 to a PST file. The user will use this PST file in the next step to restore the deleted item to their mailbox.

  1. In the Exchange admin center, go to Compliance management > In-Place eDiscovery & Hold.
  2. In the list of searches, select the search that you created in Step 2.
  3. Click Export to a PST file.

 

     4. If you're prompted to install the eDiscovery Export Tool, click Run

  1. In the eDiscovery PST Export Tool, click Browse to specify the location where you want to download the PST file.

 

  1. Click Start to download the PST file to your computer.

The eDiscovery PST Export Tool displays status information about the export process. When the export is complete, you can access the file in the location where it was downloaded