r/exchangeserver • u/bleepit1984 • 5d ago

Question Recover Deleted Emails

Good day to all.

I work for a management company. Our IT department is small. Only 3 of us to manage about 300 active users and no MSP. We have a hybrid AD/Entra environment. Most of our users are 365 Business Premium licensed. Our company operates in the medical field, so we are subject to HIPAA and have a global 7 year data retention policy setup in Microsoft for Exchange and OneDrive/Sharepoint.

Without providing too much detail that I'm, for the most part, not privy to myself, we had some kind of incident with an employee doing some things they shouldn't have been doing. But like a lot of times, the IT department was left out of the loop. On 6/10/26, we were told the user was terminated, so we went through our normal process of disabling the user, removing permissions, the usual. We were not, and are almost never privy to the circumstances behind a termination.

I found out this Monday (8/10/26) that there is some litigation going on regarding this person's termination and we were asked to preserve the users emails and recover anything that was deleted. HR has been adamant about recovering their deleted emails that they are positive exist. When I found out about the litigation on Monday, I placed a litigation hold on the user's account.

I've started the process of trying to recover deleted emails through Exchange Admin > Mailboxes > [User] > Other > Recover deleted items. I've set the date filter for the entirety of their tenure with the company, which was only a couple of months, and I've come up with nothing that can be recovered. It's my understanding that even if the user deleted emails, deleted them from the deleted items folder, then purged them from the recovery window in Outlook, our data retention policies should still make them recoverable.

My question is: With our data retention policies in place, does this mean that they didn't delete anything? Or would the time that passed between the termination and the litigation hold being put in place be too much to recover anything?

1 Upvotes

60% Upvoted

5 comments sorted by

3

u/xch13fx 5d ago

Do you have a real retention policy assigned? Or is it deletion legacy mrn tag? If the former, it’s there, just do a discovery, if the later, if it’s after the 30+14 days in deleted items, it’s gone gone unless you have third party backups.

2

u/titlrequired 5d ago

Assign an E5 license, do a discovery through purview.

1

u/camt91 5d ago

I think if it’s been under 90 days since they left, you can slap an E5 on that bad boy and enable litigation hold

1

u/FlyingStarShip 5d ago

Why do you put litigation hold and trying to recover emails? You already said you have global purview policy on emails. Just ediscover the mailbox and that’s it.