Somebody has deleted something they should not have. What matters now is which recovery window is still open, and those windows close by the day.
Here is every place the message might still be, in the order to check them.
First: stop and tell somebody
Before anything else. Recovery windows are counted from the moment of deletion, and continued use of the mailbox can push older recoverable items past their limit.
If the deletion was substantial — a whole folder, a mailbox, anything you suspect was not accidental — stop using the account entirely and involve IT support immediately.
Level 1: the Deleted Items folder
The obvious one, worth stating because people frequently do not look. Mail sits here until the folder is emptied or until a retention policy moves it on.
Note that the folder empties automatically in some configurations, so its being empty does not mean somebody emptied it.
Level 2: Recover Deleted Items
The one most people do not know exists.
Open the Deleted Items folder and choose Recover items recently removed from this folder. This reaches messages that were purged from Deleted Items, including anything deleted with Shift and Delete, which bypasses the folder entirely.
Available in the Outlook desktop application and in Outlook on the web. Retention here is 14 days by default, extendable to 30 by an administrator.
This level recovers the overwhelming majority of accidental deletions, and knowing it exists is worth more than everything below it.
Level 3: administrator recovery
An administrator has two additional routes.
Extending the retention window. If your tenancy is still at 14 days, an administrator can extend it to 30 — but only for items that have not yet expired. Doing it in advance is the useful move; doing it in response is often too late.
eDiscovery search. Content search across mailboxes can find items that individual recovery cannot, particularly where a message exists in another participant's mailbox. Available on Business Premium and above.
That last point is worth remembering. If a message was sent to or from somebody else in the business, their copy may still exist even though yours does not.
Level 4: retention policies and litigation hold
If the mailbox is covered by a retention policy or a litigation hold, deleted items are preserved regardless of user action for the period configured, and are recoverable by an administrator through eDiscovery.
This is the level that either saves you completely or does not exist. Retention policies must be configured in advance — there is no way to apply one retrospectively to data already gone.
Level 5: backup
A third-party Microsoft 365 backup gives point-in-time restore well beyond any native window, typically years.
This is the level that answers the case native tooling cannot: the message deleted eight months ago that is needed now because a project has become a dispute. It is also the only protection against a compromised administrator purging mailboxes deliberately, since every native protection sits inside the tenancy that account controls.
If you do not have backup, the reasoning for it is in this article. It costs a few pounds per user per month and it is the difference between "we can get that back" and "we cannot".
Special case: a deleted account
When somebody leaves and their account is removed to stop the licence cost, the mailbox is recoverable for 30 days by restoring the user. After that it is gone.
The correct approach is to convert the leaver's mailbox to a shared mailbox before removing the account. A shared mailbox under 50GB needs no licence, so the mail is preserved indefinitely at no cost and remains searchable. This one habit prevents a category of loss that businesses discover months later.
Special case: a local PST file
If the mail was archived to a PST on somebody's computer, none of the above applies. PSTs are local files, they are usually not backed up and they corrupt.
Check whether the file still exists, whether the computer is backed up and whether an older copy is available. Then plan to move PST data into online archives, because this is a data-loss risk sitting quietly in a lot of businesses.
Every recovery route above depends on a decision somebody made before the deletion. There is no configuration you can apply afterwards.
What to do this week
- Extend recoverable items retention from 14 days to 30. Free, takes a minute.
- Check whether you have real backup covering mailboxes, OneDrive, SharePoint and Teams.
- Change your leaver process to convert mailboxes to shared rather than deleting accounts.
- Tell your team about Recover Deleted Items. It resolves most incidents without anybody needing to call for help.
If you would like the retention settings and a tested backup put in place properly, that is what our backup and recovery service does. Ask us what your current recovery window actually is.
