How to recover, deleted ( deleted ) AKA hard deleted items in Office 365 with Legal Hold

So you have a user who you have enabled Legal Hold on , who had gone and deleted all his emails then deleted them out of recovery bin ( e.g. Shift Delete ) 

The workflow for Exchange ( 365 ) email deletions : 

Item gets deleted and goes to deleted Items
-Items gets deleted from deleted items goes to deleted items recovery which has a default age of 14 days ( can be increased to max of 30 days )
-Items go to legal hold ( Folder called Deletions or Purges under Recoverable Items forever ( Only if it is enabled on the user account

Instead of performing a eDiscovery on the whole mailbox , downloading the PST then restoring the folder you can actually use MFCMAPI 

On a PC with Outlook installed , grant the logged in user full permission to the mailbox you want restoring ( or login as the user ) and make sure the mailbox you are trying to access is in Outlook

Install MFCMAPI and open the tool.

Go to Tools and select Options.

  • Enable the MDB_ONLINE and MAPI_NO_CACHE option. OK.
  • Go to Session and select Logon
  • Once click on Logon, it will pop-up with your configured outlook profile and choose the profile, else you can open required profile. 
  • Double Click on the profile, Expand the folder Root Container.
  • Map into Recoverable Items under the Root Container folder and expand.
  • Here, Look into Deletion and Purges only. Right click on Deletions and select open Content table.
  • If you find any deleted items, proceed step 11 to step 13. Else follow the same procedure with Purges folder.
  • Found all deleted mailbox items in Purges. Total 2119 deleted mailboxes, its appear in the bottom.
  • Review and select required deleted items to restore and copy the messages.
  • Go to Top of Information Store available in the Root Container folder. Expand the TIS folder and choose your desired path to restore deleted items.
  • If required, create sub folder in your mailbox and past the same items into sub folder. I created a sub folder (deleted) under the Sent Items.
  • Once you paste, make sure your Outlook profile is active, Wait some time to get reflected in both Outlook and OWA.

Reflected in Outlook and Outlook web access.

VN:F [1.9.22_1171]
Rating: 0.0/10 (0 votes cast)
VN:F [1.9.22_1171]
Rating: 0 (from 0 votes)

Tags: Deletions, purges, recovery, restore items, shift delete

Trackback from your site.