{"id":3530,"date":"2018-08-03T08:28:21","date_gmt":"2018-08-03T08:28:21","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=3530"},"modified":"2018-08-03T08:42:35","modified_gmt":"2018-08-03T08:42:35","slug":"how-to-recover-deleted-deleted-aka-hard-deleted-items-in-office-365-with-legal-hold","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/how-to-recover-deleted-deleted-aka-hard-deleted-items-in-office-365-with-legal-hold","title":{"rendered":"How to recover, deleted ( deleted ) AKA hard deleted items in Office 365 with Legal Hold"},"content":{"rendered":"\n

So you have a user who you have enabled Legal Hold on ,<\/g> who had gone and deleted all his emails then deleted them out of recovery bin ( e.g. Shift Delete )\u00a0<\/p>\n\n\n\n

The workflow for Exchange ( 365 ) email deletions :\u00a0<\/p>\n\n\n\n

–Item<\/g> gets deleted and goes to deleted<\/g> Items-Items gets<\/g> deleted from deleted items goes to deleted items recovery which has a default age of 14 days ( can be increased to max of 30 days<\/a> )-Items go to legal hold ( Folder called Deletions or Purges under Recoverable Items forever ( Only if it is enabled on the user account<\/a> )\u00a0<\/p>\n\n\n\n

Instead of performing a eDiscovery<\/g><\/g> on the whole mailbox ,<\/g> downloading the PST then restoring the folder you can actually use\u00a0MFCMAPI\u00a0<\/p>\n\n\n\n

On a PC with Outlook installed , grant the logged in user full permission to the mailbox you want restoring ( or login as the user ) and make sure the mailbox you are trying to access is in Outlook<\/p>\n\n\n\n

Install MFCMAPI and open the tool.<\/p>\n\n\n\n

Go to\u00a0Tools<\/strong>\u00a0and select\u00a0Options<\/strong>.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n
  • Enable the\u00a0MDB_ONLINE<\/strong>\u00a0and\u00a0MAPI_NO_CACHE<\/strong>\u00a0option.\u00a0OK.<\/strong><\/li><\/ul>\n\n\n\n
    \"\"\/<\/figure>\n\n\n\n
    • Go to\u00a0Session<\/strong>\u00a0and select\u00a0Logon<\/strong>.\u00a0<\/li><\/ul>\n\n\n\n
      \"\"\/<\/figure>\n\n\n\n
      • Once click on Logon, it will pop-up with your configured outlook profile and choose the profile, else you can open required profile.\u00a0<\/li><\/ul>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        • Double Click on the profile, Expand the folder\u00a0Root Container<\/strong>.<\/li><\/ul>\n\n\n\n
          \"\"\/<\/figure>\n\n\n\n
          • Map into\u00a0Recoverable Items<\/strong>\u00a0under the Root Container folder and expand.<\/li><\/ul>\n\n\n\n
            \"\"\/<\/figure>\n\n\n\n
            • Here,\u00a0Look into Deletion and Purges only. Right click on Deletions and select\u00a0open Content table.<\/strong><\/li><\/ul>\n\n\n\n
              \"\"\/<\/figure>\n\n\n\n
              • If you find any deleted items, proceed step 11 to step 13. Else follow the same procedure with Purges folder.<\/li><\/ul>\n\n\n\n
                \"\"\/<\/figure>\n\n\n\n
                • Found all deleted mailbox items in Purges. Total 2119 deleted mailboxes, its appear in the bottom.<\/li><\/ul>\n\n\n\n
                  \"\"\/<\/figure>\n\n\n\n
                  • Review and select required deleted items to restore and copy the messages.<\/li><\/ul>\n\n\n\n
                    \"\"\/<\/figure>\n\n\n\n
                    • Go to\u00a0Top of Information Store\u00a0<\/strong>available in the Root Container folder. Expand the TIS folder and choose your desired path to restore deleted items.<\/li><\/ul>\n\n\n\n
                      \"\"\/<\/figure>\n\n\n\n
                      • If required, create sub folder in your mailbox and past the same items into sub folder. I created a sub folder (deleted) under the Sent Items.<\/li><\/ul>\n\n\n\n
                        \"\"\/<\/figure>\n\n\n\n
                        • Once you paste, make sure your Outlook profile is active, Wait some time to get reflected in both Outlook and OWA.<\/li><\/ul>\n\n\n\n
                          \"\"\/<\/figure>\n\n\n\n

                          Reflected in Outlook and Outlook web access.<\/p>\n","protected":false},"excerpt":{"rendered":"

                          So you have a user who you have enabled Legal Hold on , who had gone and deleted all his emails then deleted them out of recovery […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[2596,2597,2599,2602,2598],"class_list":["post-3530","post","type-post","status-publish","format-standard","hentry","category-research","tag-deletions","tag-purges","tag-recovery","tag-restore-items","tag-shift-delete"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/3530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/comments?post=3530"}],"version-history":[{"count":2,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/3530\/revisions"}],"predecessor-version":[{"id":3533,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/3530\/revisions\/3533"}],"wp:attachment":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/media?parent=3530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/categories?post=3530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/tags?post=3530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}