Skip to main content

We’d like to restore emails from Exchange Online archive that were deleted by the user during a specific period of time.

We are able to see all the messages he deleted in the Deleted Items folder, as our retention policy is 7 years from deletion. That’s a lot of messages, but we are only interested in the ones he deleted last week. Commvault must have a time tag on message deletion, otherwise it wouldn’t be able to purge based on deletion date. However, I’m unable to find this time tag and identify which messages were deleted last week.  Does anyone have any ideas?  Thank you!

Within the Exchange Agent you can restore emails using the following categories listed on the link below.

https://documentation.commvault.com/commvault/v11_sp20/article?p=12917.htm

 

Based on what you are describing, I believe you would use the time range and select the week you are intending to locate data from.


Thanks for your reply. I’m having trouble to test the filter (I click it but nothing comes up), but the document describes Time as “used to filter mails received on specific day or days). I’m looking for a filter for when the message is deleted, not when it is received.


Leonard, I’ll look into this for you.  I’m not sure if that is a filter/sortable item.


Leonard,

 

We do not necessarily track individual items deletion times.  In most scenarios we use received time to age data. If an item is moved to deleted items its still held by received time not based on deletion time.  We do not have a way of sorting or browsing by what items where deleted on what date built in.  


Hi Chris,

When setting the retention for mailbox, we have to option to “Retain messages based on Deletion Time for xxx day(s)”. How does that work if message deletion time is not tracked?  


That option retain messages based on deletion time for xxx days is a process that runs in the background and compares and contrasts vs what is inside the mailbox.  If it finds the message removed it will mark it for the next mailbox  retention cycle. 


Reply