Employee terminated, emails deleted ... am I missing anything here?

[thecomputerguy]

Employee was terminated and the owner of the company asked me to look into why his deleted items folder was empty. I logged into the mailbox and verified it is empty. I restored everything that it would allow me to but nothing in the deleted items was restored. The only things that were restored went straight into junk mail, and were in fact junk mail.

I told him either one of two things was happening:

1.) He never deleted anything.
2.) He deleted and then perma deleted his deleted items

If the scenario is #2 then the emails are gone forever. I advised him to employ a cloud backup solution like Dropsuite to prevent this from happening in the future.

The retention policy on the deleted items folder is 90 days, Junk is 30 days.

He emailed me back tonight and asked me to call M$ and ask them to restore it.

I want to make sure that isn't a thing right? Am I missing anything?

 

[callthatgirl]

Have you offered Dropsuite in the past?

 

[Markverhyden]

According to the below retention is 14 days for email admin to recover emails in deleted items folder.

Configure Deleted Item retention and Recoverable Items quotas in Exchange Server

Summary: Learn how to configure the deleted item retention period for a mailbox or mailbox database in Exchange Server 2016 or Exchange Server 2019.

learn.microsoft.com

 

[Sky-Knight]

By default M365 doesn't delete anything for 30 days.

Recover and restore deleted items in Outlook - Microsoft Support

Learn how to recover deleted items, such as email, contacts, calendar appointments, and tasks in Outlook.

support.microsoft.com

User can nuke junk from his deleted all he wants, but 30 days back is still there. Go get them!

@Markverhyden Close sir! But that's for Exchange 2019, this isn't technically valid for M365 services. It is however, the service doing the lifting even if we don't have full control over it. Understanding Exchange is key to supporting M365 at a high level. But the number you want is 30, not 14! Also, you cannot configure this setting directly on M365 services.

 

[thecomputerguy]

By default M365 doesn't delete anything for 30 days.

Recover and restore deleted items in Outlook - Microsoft Support

Learn how to recover deleted items, such as email, contacts, calendar appointments, and tasks in Outlook.

support.microsoft.com

User can nuke junk from his deleted all he wants, but 30 days back is still there. Go get them!

@Markverhyden Close sir! But that's for Exchange 2019, this isn't technically valid for M365 services. It is however, the service doing the lifting even if we don't have full control over it. Understanding Exchange is key to supporting M365 at a high level. But the number you want is 30, not 14! Also, you cannot configure this setting directly on M365 services.

Ok yeah ... I already did that and nothing was restored to the deleted items folder ... the only rationale I can think of is that this user never deleted anything and just filed things into folders in Outlook.

 

[Sky-Knight]

Ok yeah ... I already did that and nothing was restored to the deleted items folder ... the only rationale I can think of is that this user never deleted anything and just filed things into folders in Outlook.

That's very likely. You can read the audit logs for the account to confirm that.