Tuesday, November 6, 2018

Learn how you can recover deleted emails in #Office365

Introduction:

Sometimes users accidentally can remove their emails from the inbox and deleted items folder. You can find the deleted mail in Recover deleted items. There also might be a situation when a user cannot find a deleted email in their Office 365 mailbox or had purged the deleted emails from Recover deleted items folder. You can recover it directly through Exchange Online using the In-Place eDiscovery & hold options or with Content Search in O365 Security & Compliance center (You must be a Global Administrator in Office 365).
In this article, we will see how to recover the emails from Exchange Online.
Pre-Requisites:
You must have applied Retention Policy from Office 365 Security & Compliance Center to Exchange Online. By default permanently deleted items are kept there for 14 days but you can increase the period to 30 days, but with the Retention policy we can Retain content so that it can’t be permanently deleted before the end of the retention period.
See how to create a Retention Policy in Office 365 Security & Compliance center.

Steps:

To recover deleted emails, follow the steps below:
1. Login to your Office 365 account and go to the Admin app.
2. On Left pane, extend Admin centers and click Exchange (Exchange Admin Center).
3. Go to Permissions > Admin Roles. From the list of roles select Discovery Management and click on Edit icon.
4. On the resulting window, go to the members' section and click + to add a member. Search for your name and click add and Ok. Save it.
5. Sign out and Sign In again, so that changes take effect.
6. Once permission is assigned to you, go to the Compliance Management section and then In-Place eDiscovery & hold. Click +icon
7. Provide a name for your search and, optionally, a description. Click Next.
8. You can choose a mailbox you want to search. Select the Specify mailboxes to search option, and then click on the + icon to add a mailbox. Click Next.
9. The next step is to specify criteria for a search query. Click the Filter based on criteria option, and adjust search options to your needs. When you need to provide more than one keyword in a search query, you need to separate them with OR or AND, not commas.
10. In the same window, click on the Select message types and select Email. Click OK.
You can similarly search for contacts, meetings, etc.
11. Once you adjusted search query to your needs, click Next.
12. In the In-Place eDiscovery and hold page click Next without choosing any options as we don’t want to place any content on hold.
13. Now, your settings will be saved. Once the process is completed, click Close.
14. Select the search you created and click Refresh to update the information displayed in the details pane. The status of Estimate Succeeded indicates that the search has finished.
15. In the details pane, click Preview search results to view the items. This helps you identify the items you are looking for.
16. If you can’t find an item by previewing search results, then you can copy the search results to a special mailbox (called a discovery mailbox) and then open that mailbox in Outlook on the web to view the items.
On the copy search results page, click Browse.
Under the display name, click Discovery Search Mailbox, and then click OK and Copy (shown in above image).
When the copying is complete, click Open to open the Discovery Search Mailbox to view the search results (shown in below image).
The search results copied to the Discovery Search Mailbox are placed in a folder that has the same name as the In-Place eDiscovery search.
17. After you find the item you’re trying to recover for a user, the next step is to export the results from the search you ran to Export to PST. The user will use this PST file in the next step to restore the deleted item to their mailbox. Click below arrow mark as shown in below image.
18. Click on Run to install eDiscovery tool.
19. Click on Browse button to add location and leave the enable deduplication & include unsearchable items option.
20. After providing PST location click Start, it will ask for Office 365 admin credentials, after providing the same download will start.
21. The last step is to just send this PST file to the user so that he can restore. User need to use the outlook desktop app to restore deleted item by using a PST file. Click to Open Outlook Data File, browse the file and click OK. The PST file appears in the left-nav bar in Outlook. Expand the same and right-click the item you want to recover and then click Move > Inbox.
In the below image,  you can see recoverable items.

Conclusion:

You can easily recover the deleted emails of users even if it is deleted from deleted items and is not shown under recover deleted items.

No comments:

Post a Comment

Can't verify domain in Office 365? Lets try this step.

Domain verification in Office 365 is a very simple task, you just need to add a custom domain, add the TXT or MX record by provided by your...