⏰ Support Available: Mon-Fri 4:00pm-6:00am | Weekends 24/7
Recovering deleted email
Most of the time you can get it back yourself in about four minutes, and nobody needs to be involved. The steps are below, all of them, with nothing held back for a phone call.
The one thing worth knowing before you start is that some of this is on a clock. Do it now rather than at the weekend.
Three places to look, in this order
Each one goes a level deeper than the last. Most people find it at the first or second.
Step 1
Look in Deleted Items
Obvious, and worth saying because of what is not obvious: in Microsoft 365 there is no default rule that empties this folder. Unless somebody has deliberately added one, mail sits in Deleted Items indefinitely. If it is there, drag it back and you are finished. A lot of advice claims a thirty-day limit here. That is out of date.
Step 2
Recover items recently removed from this folder
If Deleted Items is empty, or you used Shift and Delete, the item went a level deeper. In Outlook on the web, open Deleted Items and use "Recover items deleted from this folder" at the top of the list. In Outlook for Windows, it is Recover Deleted Items on the Folder tab, or Home in newer versions. Everything recoverable will be listed. Select what you want and restore it, and it goes back to Deleted Items rather than the folder it came from.
Step 3
Ask an administrator, who can see more than you can
If it is not in that list either, it has been purged, and purged is not the same as gone. New Microsoft 365 mailboxes have single item recovery switched on by default, which means purged items are still held where an administrator can search and export them even though you cannot see them at all. This is the step most people never get to, because nothing in Outlook tells you it exists.
That is genuinely the whole self-service answer. If step one or two worked, you are done and you can stop reading. The rest of this page is about the windows, which matter if you are not sure how long ago it happened, and about the situation where recovering the content is not actually the problem.
The windows, and what starts each clock
This is the part nobody explains properly, and it is why people ring a week too late. The clocks do not all start when you think.
The one most articles get wrong
There is no default rule in Microsoft 365 that empties your Deleted Items folder after thirty days. The standard retention policy Microsoft applies to new mailboxes contains no tag that deletes from Deleted Items at all, and Microsoft says so in as many words. The fourteen-day clock everybody talks about only starts once an item has left that folder. So if it is still sitting in Deleted Items from four months ago, it is fine, and you have as long as you like.
| Where the item is | How long you have | What starts the clock |
|---|---|---|
| Sitting in Deleted Items | No default expiry | Nothing. It stays until somebody empties the folder or a tag is added deliberately. |
| Emptied from Deleted Items, or Shift and Delete from anywhere | 14 days by default, up to 30 if the tenant has raised it | Starts the moment the item leaves Deleted Items, not when it was first deleted. |
| Purged using Recover Deleted Items, or aged out | Whatever is left of the same 14 days | The same clock. Purging does not start a new one, which is the detail people get wrong. |
| Anything in Junk Email | 30 days | Starts when it arrives in Junk. This one does have a default tag on it. |
| Calendar items specifically | 120 days | Calendar entries are treated differently from mail and are kept considerably longer. |
| Any mailbox on legal hold | Retention limit ignored | Nothing expires while the hold is in place. This is the whole point of a hold. |
The fourteen days is a tenant setting and it can be raised to thirty, which is the maximum Microsoft allows. If you are an administrator reading this after a near miss, raising it is one command and it is the cheapest insurance in Microsoft 365. It only applies to mailboxes that already exist, so it needs doing again for new starters unless the underlying plan is changed too.
If it is not in any of those places
Five reasons, roughly in order of how often they turn out to be the answer.
The window simply closed
The commonest answer, and the reason this page leads with doing it now rather than tomorrow. Fourteen days from leaving Deleted Items is not long, and nobody notices a missing email on day one.
The mailbox filled its recovery space first
The Recoverable Items area has its own size limit, separate from the mailbox. If it fills before the fourteen days is up, the oldest items are removed first to make room. So the fourteen days is a maximum rather than a promise, and a mailbox that deletes a lot of large attachments can burn through it faster.
Somebody deleted the folder, not the message
A trap worth knowing. If a user-created folder is deleted with Shift and Delete, or deleted from inside Deleted Items, the folder itself is gone permanently and cannot be brought back even by a legal hold. Its contents do survive, in the recoverable area, under the normal window. So you can usually get the emails and not the structure.
A retention policy reached its end
If your organisation has a policy that deletes mail after a set period, that policy did what it was configured to do. Worth checking rather than assuming, because most small tenants have never set one up and are running on defaults.
A rule deleted it before anybody saw it
The uncomfortable possibility. A mailbox rule that moves or deletes messages from one particular sender is the standard mechanism in an email fraud, precisely so the victim does not see the replies. If mail has been going missing rather than being deleted once by accident, that is worth taking seriously.
That last one has its own page, because it is usually not really a question about email recovery. Business email compromise, what to do now covers what to do if messages have been disappearing and money is involved.
When getting the content back is not the actual problem
Everything above assumes the email went missing by accident and you just want it back. Sometimes that is not the situation, and the difference is worth naming plainly because the two need completely different work.
Recovering content answers: can I read this again? Evidencing an action answers: what was deleted, by whom, from which device, and at what time, in a form somebody else will accept. The first is a button. The second is a reconstruction, and no amount of clicking Recover Deleted Items produces it.
Somebody deleted it deliberately
A departing employee clearing out a mailbox on their last afternoon, or messages disappearing from a thread that later turned into an argument. The content may well still be recoverable. What matters just as much is the record of the deletion itself, and that lives in the audit log rather than in the mailbox.
A dispute or investigation is in prospect
Once there is any realistic prospect of a dispute, an insurance claim or a regulator, the priority stops being recovery and becomes preservation. Recovering an item and then continuing to use the mailbox normally is not the same as preserving it, and only one of those survives being questioned later.
You need to prove when, not just what
Sign-in and audit records establish who accessed a mailbox and what they did in it. They are kept on their own schedule, separately from the mail, and the Microsoft 365 default is 180 days for most tenants. A lot of published advice still says 90, which was the old figure. Either way it runs out, and it runs out quietly.
It has to be in a form somebody else will accept
An insurer, a lawyer or a tribunal will not accept a folder of forwarded emails. What is needed is a defensible export with the original headers intact, a record of how it was collected, and a written account in plain language of what was searched and what was found.
That work is email investigation and eDiscovery, and it is scoped and quoted after a short conversation rather than sold off a page, because the size of it depends entirely on what has to be established.
The one thing you control
Every window on this page runs whether or not anybody is thinking about it, and the only variable you have any influence over is how quickly somebody acts. A hold applied today preserves what is still there. A hold applied next month preserves whatever survived the intervening four weeks, which may be nothing.
The same decision comes up in two other places, and it is the same decision every time: on offboarding, where the option disappears the moment an account is deleted, and after a business email compromise, where the instinct to tidy up destroys the record. If any of those describe you, preserve first and work out what you need afterwards.
If you would rather somebody did it
For an ordinary recovery where the item has been purged and you need an administrator to go and get it, that is a short piece of Microsoft 365 support and usually a single call. For anything where what was deleted matters more than getting it back, it is the investigation work.
Questions about deleted email
Still missing?
Tell me what happened and roughly when. If the answer is that you can fix it yourself with the steps above, that is what you will be told, and there is no charge for that.
If it is time sensitive, call 0403 401 250 or email jamie@hamilton365.com.au