Recover deleted emails in Office 365 – For Administrators

Posted On August 24, 2017 by Abhishek Kumar Posted in

Introduction:

Sometimes users accidentally can remove their emails from inbox and deleted items folder. You can find the deleted mail in Recover deleted items. There also might be a situation when a user cannot find a deleted email in their Office 365 mailbox, a user will probably ask you to recover missing mails. You can recover it directly through Exchange Online using the In-Place eDiscovery & hold options (You must be a Global Administrator in Office 365).

Steps:

To recover deleted emails, follow the steps below:

1. Login to your Office 365 account and go to the Admin app.

2. On Left pane, extend Admin centers and click Exchange (Exchange Admin Center).

3. Go to Permissions > Admin Roles. From list of roles select Discovery Management and click on Edit icon.

4. On resulting window, go to members section and click + to add a member. Search for your name and click add and Ok. Save it.

5. Sign out and Sign In again, so that changes take effect.

6. Once permission is assigned to you, go to the Compliance Management section and then In-Place eDiscovery & hold. Click + icon

7. Provide a name for your search and, optionally, a description. Click Next.

8. You can choose a mailbox you want to search. Select the Specify mailboxes to search option, and then click on the + icon to add a mailbox. Click Next.

9. The next step is to specify criteria for a search query. Click the Filter based on criteria option, and adjust search options to your needs. When you need to provide more than one keyword in a search query, you need to separate them with OR or AND, not commas.

10. In the same window, click on the Select message types and select Email. Click OK.

You can similarly search for contacts, meetings, etc.

11. Once you adjusted search query to your needs, click Next.

12. In the In-Place eDiscovery and hold page click Next without choosing any options as we don’t want to place any content on hold.

13. Now, your settings will be saved. Once the process is completed, click Close.

14. Select the search you created and click Refresh to update the information displayed in the details pane. The status of Estimate Succeeded indicates that the search has finished.

15. In details pane, click Preview search results to view the items. This helps you identify the items you are looking for.

16. If you can’t find an item by previewing search results, then you can copy the search results to a special mailbox (called a discovery mailbox) and then open that mailbox in Outlook on the web to view the items.

On the copy search results page, click Browse.

Under the display name, click Discovery Search Mailbox, and then click OK and Copy (shown in above image).

When the copying is complete, click Open to open the Discovery Search Mailbox to view the search results (shown in below image).

The search results copied to the Discovery Search Mailbox are placed in a folder that has the same name as the In-Place eDiscovery search.

17. After you find the item you’re trying to recover for a user, the next step is to export the results from the search you ran to Export to PST. The user will use this PST file in the next step to restore the deleted item to their mailbox. Click below arrow mark as shown in below image.

18. Click on Run to install eDiscovery tool.

19. Click on Browse button to add location and leave the enable deduplication & include unsearchable items option.

20. After providing PST location click Start, it will ask for Office 365 admin credentials, after providing the same download will start.

21. The last step is to just send this PST file to the user so that he can restore. User need to use the outlook desktop app to restore deleted item by using a PST file. Click to Open Outlook Data File, browse the file and click OK. The PST file appears in the left-nav bar in Outlook. Expand the same and right-click the item you want to recover and then click Move > Inbox.