Delete items in the Recoverable Items folder - Microsoft Purview (compliance) (2023)

  • Article
  • 24 minutes to read

The Recoverable Items folder for an Exchange Online mailbox exists to protect from accidental or malicious deletions. It's also used to store items that are retained and accessed by compliance features, such as holds and eDiscovery searches. However, in some situations organizations might have data that's been unintentionally retained in the Recoverable Items folder that they must delete. For example, a user might unknowingly send or forward an email message that contains sensitive information or information that may have serious business consequences. Even if the message is permanently deleted, it might be retained indefinitely because a legal hold has been placed on the mailbox. This scenario is known as data spillage because data has been unintentionally spilled into Office 365. In these situations, you can delete items in a user's Recoverable Items folder for an Exchange Online mailbox, even if that mailbox is placed on hold with one of the different hold features in Office 365. These types of holds include Litigation Holds, In-Place Holds, eDiscovery holds, and retention policies created in the security and compliance center in Office 365 or Microsoft 365.

This article explains how admins can delete items from the Recoverable Items folder for cloud-based mailboxes that are on hold. This procedure involves disabling access to the mailbox and disabling single item recovery, disabling the Managed Folder Assistant from processing the mailbox, temporarily removing the hold, deleting items from the Recoverable Items folder, and then reverting the mailbox to its previous configuration. Here's the process:

Step 1: Collect information about the mailbox

Step 2: Prepare the mailbox

Step 3: Remove all holds from the mailbox

Step 4: Remove the delay hold from the mailbox

Step 5: Delete items in the Recoverable Items folder

Step 6: Revert the mailbox to its previous state

Caution

The procedures outlined in this article will result in data being permanently deleted (purged) from an Exchange Online mailbox. That means messages that you delete from the Recoverable Items folder can't be recovered and won't be available for legal discovery or other compliance purposes. If you want to delete messages from a mailbox that's placed on hold as part of a Litigation Hold, In-Place Hold, eDiscovery hold, or retention policy created in the Microsoft Purview compliance portal, check with your records management or legal departments before removing the hold. Your organization might have a policy that defines whether a mailbox on hold or a data spillage incident takes priority.

Tip

If you're not an E5 customer, you can try all the premium features in Microsoft Purview for free. Use the 90-day Purview solutions trial to explore how robust Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview compliance portal trials hub. Learn details about signing up and trial terms.

Before you delete items

  • To create and run a Content Search, you have to be a member of the eDiscovery Manager role group or be assigned the Compliance Search management role. To delete messages, you have to be a member of the Organization Management role group or be assigned the Search And Purge management role. For information about adding users to a role group, see Assign eDiscovery permissions.

  • If a mailbox is assigned to an organization-wide retention policy, you have to exclude the mailbox from the policy before you can delete items from the Recoverable Items folder. It may take up to 24 hours to synchronize the policy change, and remove the mailbox from the policy. For more information, see "Organization-wide retention policies" in the Remove all holds from the mailbox section in this article.

  • You can't perform this procedure for a mailbox that has been assigned retention settings with a retention policy that's locked by using Preservation Lock. That's because this lock prevents you from removing or excluding the mailbox from the policy and from disabling the Managed Folder Assistant on the mailbox. For more information about locking policies for retention,see Use Preservation Lock to restrict changes to retention policies and retention label policies.

  • The procedure described in this article isn't supported for inactive mailboxes. That's because you can't reapply a hold (or retention policy) to an inactive mailbox after you remove it. When you remove a hold from an inactive mailbox, it's changed to a normal soft-deleted mailbox and will be permanently deleted from your organization after it's processed by the Managed Folder Assistant.

  • If a mailbox isn't placed on hold (or doesn't have single item recovery enabled), you can delete the items from the Recoverable Items folder. For more information about how to do this, see Search for and delete email messages in your organization.

Step 1: Collect information about the mailbox

This first step is to collect selected properties from the target mailbox that will affect this procedure. Be sure to write down these settings or save them to a text file because you'll change some of these properties and then revert back to the original values in Step 6, after you delete items from the Recoverable Items folder. Here's a list of the mailbox properties you need to collect.

  • SingleItemRecoveryEnabled and RetainDeletedItemsFor. If necessary, you'll disable single recovery and increase the deleted items retention period in Step 3.

  • LitigationHoldEnabled and InPlaceHolds. You need to identify all the holds placed on the mailbox so that you can temporarily remove them in Step 3. See the More information section for tips about how to identify the type hold that might be placed on a mailbox.

Additionally, you need to get the mailbox client access settings so you can temporarily disable them so the owner (or other users) can't access the mailbox during this procedure. Finally, you can get the current size and number of items in the Recoverable Items folder. After you delete items in the Recoverable Items folder in Step 5, you'll use this information to verify that items were removed.

  1. Connect to Exchange Online PowerShell. Be sure to use a user name and password for an administrator account that's been assigned the appropriate management roles in Exchange Online.

  2. Run the following command to get information about single item recovery and the deleted item retention period.

    Get-Mailbox <username> | FL SingleItemRecoveryEnabled,RetainDeletedItemsFor

    If single item recovery is enabled, you'll have to disable it in Step 2. If the deleted item retention period isn't set for 30 days (the maximum value in Exchange Online), then you can increase it in Step 2.

    (Video) Recover Deleted Emails in Exchange Online and Outlook

  3. Run the following command to get the mailbox access settings for the mailbox.

    Get-CASMailbox <username> | FL EwsEnabled,ActiveSyncEnabled,MAPIEnabled,OWAEnabled,ImapEnabled,PopEnabled

    You'll disable all of these access methods in Step 2.

  4. Run the following command to get information about the holds and retention policies applied to the mailbox.

    Get-Mailbox <username> | FL LitigationHoldEnabled,InPlaceHolds

    Tip

    If there are too many values in the InPlaceHolds property and not all of them are displayed, you can run the Get-Mailbox <username> | Select-Object -ExpandProperty InPlaceHolds command to display each value on a separate line.

  5. Run the following command to get information about any organization-wide retention policies.

    Get-OrganizationConfig | FL InPlaceHolds

    If your organization has any organization-wide retention policies, you'll have to exclude the mailbox from these policies in Step 3. It may take up to 24 hours to replicate the change.

    Tip

    If there are too many values in the InPlaceHolds property and not all of them are displayed, you can run the Get-OrganizationConfig | Select-Object -ExpandProperty InPlaceHolds command to display each value on a separate line.

  6. Run the following command to determine if a delay hold is applied to the mailbox.

    Get-Mailbox <username> | FL DelayHoldApplied,DelayReleaseHoldApplied

    If the value of the DelayHoldApplied or DelayReleaseHoldApplied property is set to True, a delay hold is applied to the mailbox and must be removed. For more information about delay holds, see Step 4: Remove the delay hold from the mailbox.

    If the value of either properties is set to False, a delay hold is not applied to the mailbox, and you can skip Step 4.

  7. Run the following command to get the current size and total number of items in folders and subfolders in the Recoverable Items folder in the user's primary mailbox.

    Get-MailboxFolderStatistics <username> -FolderScope RecoverableItems | FL Name,FolderAndSubfolderSize,ItemsInFolderAndSubfolders

    If the user's archive mailbox is enabled, run the following command to get the size and total number of items in folders and subfolders in the Recoverable Items folder in their archive mailbox.

    Get-MailboxFolderStatistics <username> -FolderScope RecoverableItems -Archive | FL Name,FolderAndSubfolderSize,ItemsInFolderAndSubfolders

    When you delete items in Step 5, you can choose to delete or not delete items in the Recoverable Items folder in the user's primary archive mailbox. If auto-expanding archiving is enabled for the mailbox, items in an auxiliary archive mailbox won't be deleted.

Step 2: Prepare the mailbox

After collecting and saving information about the mailbox, the next step is to prepare the mailbox by performing the following tasks:

  • Disable client access to mailbox so that the mailbox owner can't access their mailbox and make any changes to the mailbox data during this procedure.

  • Increase the deleted item retention period to 30 days (the maximum value in Exchange Online) so that items aren't purged from the Recoverable Items folder before you can delete them in Step 5.

  • Disable single Item recovery so that items won't be retained (for the duration of the deleted item retention period) after you delete them from the Recoverable Items folder in Step 5.

  • Disable the Managed Folder Assistant so that it doesn't process the mailbox and retain the items that you delete in Step 5.

Perform the following steps in Exchange Online PowerShell.

  1. Run the following command to disable all client access to the mailbox. The command syntax assumes that all client access methods were enabled on the mailbox.

    Set-CASMailbox <username> -EwsEnabled $false -ActiveSyncEnabled $false -MAPIEnabled $false -OWAEnabled $false -ImapEnabled $false -PopEnabled $false

    Note

    It might take up to 60 minutes to disable all client access methods to the mailbox. Note that disabling these access methods won't disconnect the mailbox owner if they are currently signed in. If the owner isn't signed in, they won't be able to access their mailbox after these access methods are disabled.

    (Video) eDiscovery in Microsoft 365 | How eDiscovery works | Step by Step guide to use eDiscovery in M365

  2. Run the following command to increase the deleted item retention period the maximum of 30 days. This assumes that the current setting is less than 30 days.

    Set-Mailbox <username> -RetainDeletedItemsFor 30
  3. Run the following command to disable single item recovery.

    Set-Mailbox <username> -SingleItemRecoveryEnabled $false

    Note

    It might take up to 240 minutes to disable single item recovery. Don't delete items in the Recoverable Items folder until this period has elapsed.

  4. Run the following command to prevent the Managed Folder Assistant from processing the mailbox. As previously explained, you can disable the Managed Folder Assistant only if a retention policy with a Preservation Lock is not applied to the mailbox.

    Set-Mailbox <username> -ElcProcessingDisabled $true

Step 3: Remove all holds from the mailbox

The last step before you can delete items from the Recoverable Items folder is to remove all holds (that you identified in Step 1) placed on the mailbox. All holds must be removed so that items won't be retained after you delete them from the Recoverable Items folder. The following sections contain information about removing different types of holds on a mailbox. See the More information section for tips about how to identify the type hold that might be placed on a mailbox. For more information, see How to identify the type of hold placed on an Exchange Online mailbox.

Caution

As previously stated, check with your records management or legal departments before removing a hold from a mailbox.

Litigation Hold

Run the following command in Exchange Online PowerShell to remove a Litigation Hold from the mailbox.

Set-Mailbox <username> -LitigationHoldEnabled $false

Note

Similar to disabling single item recovery, it might take up to 240 minutes to remove the Litigation Hold. Don't delete items from the Recoverable Items folder until this period has elapsed.

In-Place Hold

Run the following command in Exchange Online PowerShell to identify the In-Place Hold that's placed on the mailbox. Use the GUID for the In-Place Hold that you identified in Step 1.

Get-MailboxSearch -InPlaceHoldIdentity <hold GUID> | FL Name

After you identify the In-Place Hold, you can use the Exchange admin center (EAC) or Exchange Online PowerShell to remove the mailbox from the hold. For more information, see Create or remove an In-Place Hold.

Retention policies applied to specific mailboxes

Run the following command in to identify the retention policy that is applied to the mailbox. This command will also return any Teams conversation retention policies applied to a mailbox. Use the GUID (not including the mbx or skp prefix) for the retention policy that you identified in Step 1.

Get-RetentionCompliancePolicy <retention policy GUID without prefix> | FL Name

After you identify the retention policy, go to the Data lifecycle management > Microsoft 365 > Retention page in the compliance portal, edit the retention policy that you identified in the previous step, and remove the mailbox from the list of recipients that are included in the retention policy.

Organization-wide retention policies

Organization-wide, Exchange-wide, and Teams-wide retention policies are applied to every mailbox in the organization. They are applied at the organization level (not the mailbox level) and are returned when you run the Get-OrganizationConfig cmdlet in Step 1. Run the following command in to identify the organization-wide retention policies. Use the GUID (not including the mbx prefix) for the organization-wide retention policies that you identified in Step 1.

Get-RetentionCompliancePolicy <retention policy GUID without prefix> | FL Name

After you identify the organization-wide retention policies, go to the Data lifecycle management > Microsoft 365 > Retention page in the compliance portal, edit each organization-wide retention policy that you identified in the previous step, and add the mailbox to the list of excluded recipients. Doing this will remove the user's mailbox from the retention policy.

Important

After you exclude a mailbox from an organization-wide retention policy, it may take up to 24 hours to synchronize this change and remove the mailbox from the policy.

Retention labels

Whenever a user applies a label that's configured to retain content or retain and then delete content to any folder or item in their mailbox, the ComplianceTagHoldApplied mailbox property is set to True. When this happens, the mailbox is considered to be on hold, as if it was placed on Litigation Hold or assigned to a retention policy.

To view the value of the ComplianceTagHoldApplied property, run the following command in Exchange Online PowerShell:

Get-Mailbox <username> |FL ComplianceTagHoldApplied

After you've identified that a mailbox is on hold because a retention label is applied to a folder or item, you can use the Content search tool in the compliance portal to search for labeled items by using the Retention label condition. For more information, see:

  • The "Using Content Search to find all content with a specific retention label" section in Learn about retention policies and retention labels

    (Video) How to Create & Manage Retention Labels & Label Policies in Microsoft 365 | Microsoft Purview

  • The "Search conditions" section in Keyword queries and search conditions for Content Search.

For more information about labels, see Learn about retention policies and retention labels.

eDiscovery holds

Run the following commands in to identify the hold associated with an eDiscovery case (called eDiscovery holds) that's applied to the mailbox. Use the GUID (not including the UniH prefix) for the eDiscovery hold that you identified in Step 1. The second command displays the name of the eDiscovery case the hold is associated with; the third command displays the name of the hold.

$CaseHold = Get-CaseHoldPolicy <hold GUID without prefix>
Get-ComplianceCase $CaseHold.CaseId | FL Name
$CaseHold.Name

After you've identified the name of the eDiscovery case and the hold, go to the eDiscovery > eDiscovery page in the compliance center, open the case, and remove the mailbox from the hold. For more information about identifying eDiscovery holds, see the "eDiscovery holds" section in How to identify the type of hold placed on an Exchange Online mailbox.

Step 4: Remove the delay hold from the mailbox

After any type of hold is removed from a mailbox, the value of the DelayHoldApplied or DelayReleaseHoldApplied mailbox property is set to True. This occurs the next time the Managed Folder Assistant processes the mailbox and detects that a hold has been removed. This is called a delay hold and means the actual removal of the hold is delayed for 30 days to prevent data from being permanently deleted from the mailbox. (The purpose of a delay hold is to give admins an opportunity to search for or recover mailbox items that will be purged after a hold is removed.) When a delay hold is placed on the mailbox, the mailbox is still considered to be on hold for an unlimited duration, as if the mailbox was on Litigation Hold. After 30 days, the delay hold expires, and Microsoft 365 will automatically attempt to remove the delay hold (by setting the DelayHoldApplied or DelayReleaseHoldApplied property to False) so that the hold is removed. For more information about a delay hold, see the "Managing mailboxes on delay hold" section in How to identify the type of hold placed on an Exchange Online mailbox.

If the value of the DelayHoldApplied or DelayReleaseHoldApplied property is set to True, run one of the following commands to remove the delay hold:

Set-Mailbox <username> -RemoveDelayHoldApplied

Or

Set-Mailbox <username> -RemoveDelayReleaseHoldApplied

You must be assigned the Legal Hold role in Exchange Online to use the RemoveDelayHoldApplied or RemoveDelayReleaseHoldApplied parameter.

Step 5: Delete items in the Recoverable Items folder

Now you're ready to actually delete items in the Recoverable Items folder by using the New-ComplianceSearch and New-ComplianceSearchAction cmdlets in Security & Compliance PowerShell.

To search for items that are located in the Recoverable Items folder, we recommend that you perform a targeted collection. This means you narrow the scope of your search only to items located in the Recoverable Items folder. You can do this by running the script in the Use Content Search for targeted collections article. This script returns the value of the folder ID property for all the subfolders in the target Recoverable Items folder. Then you use the folder ID in a search query to return items located in that folder.

Here's an overview of the process to search for and delete items in a user's Recoverable Items folder:

  1. Run the targeted collection script that returns the folder IDs for all folders in the target user's mailbox. The script connects to Exchange Online PowerShell and Security & Compliance PowerShell in the same PowerShell session. For more information, see Run the script to get a list of folders for a mailbox.

  2. Copy the folder IDs for all subfolders in the Recoverable Items folder. Alternatively, you can redirect the output of the script to a text file.

    Here's a list and description of the subfolders in the Recoverable Items folder that you can search and delete items from:

    • Deletions: Contains soft-deleted items whose deleted item retention period has not expired. Users can recover soft-deleted items from this subfolder using the Recover Deleted Items tool in Outlook.

    • DiscoveryHolds: Contains hard-deleted items that have been preserved by an eDiscovery hold or a retention policy. This subfolder isn't visible to end users.

    • SubstrateHolds: Contains hard-deleted items from Teams and other cloud-based apps that have been preserved by a retention policy or other type of hold. This subfolder isn't visible to end users.

  3. Use the New-ComplianceSearch cmdlet (in Security & Compliance PowerShell) or use the Content search tool in the compliance center to create a content search that returns items from the target user's Recoverable Items folder. You can do this by including the FolderId in the search query for all subfolders that you want to search. For example, the following query returns all messages in the Deletions and eDiscoveryHolds subfolders:

    folderid:<folder ID of Deletions subfolder> OR folderid:<folder ID of DiscoveryHolds subfolder>

    For more information and examples about running content searches that use the folder ID property, see Use a folder ID or to perform a targeted collection.

    Note

    If you use the New-ComplianceSearch cmdlet to search the Recoverable Items folder, be sure to use Start-ComplianceSearch cmdlet to run the search.

  4. After you've created a content search and validated that it returns the items that you wan to delete, use the New-ComplianceSearchAction -Purge -PurgeType HardDelete command (in Security & Compliance PowerShell) to permanently delete the items returned by the content search that you created in the previous step. For example, you can run a command similar to the following command:

    New-ComplianceSearchAction -SearchName "RecoverableItems" -Purge -PurgeType HardDelete
  5. A maximum of 10 items per mailbox are deleted when you run the previous command. That means you may have to run the New-ComplianceSearchAction -Purge command multiple times to delete all the items that you want to delete in the Recoverable Items folder. To delete additional items, you first have to remove the previous compliance search purge action. You do this by running the Remove-ComplianceSearchAction cmdlet. For example, to delete the purge action that was run in the previous step, run the following command:

    Remove-ComplianceSearchAction "RecoverableItems_Purge"

    After you do this, you can create a new compliance search purge action to delete more items. You'll have to delete each purge action before creating a new one.

    To get a list of the compliance search actions, you can run the Get-ComplianceSearchAction cmdlet. Purge actions are identified by _Purge appended to the search name.

Verify that items were deleted

To verify that you've successfully deleted items from the Recoverable Items folder of a mailbox, use Get-MailboxFolderStatistics cmdlet in Exchange Online PowerShell to check the size and number of items in Recoverable Items folder. You can compare these statistics with the ones you collected in Step 1.

(Video) How to apply Retention Policies in "Office 365/Microsoft 365 Purview" | Microsoft Compliance Feature

Run the following command in to get the current size and total number of items in folders and subfolders in the Recoverable Items folder in the user's primary mailbox.

Get-MailboxFolderStatistics <username> -FolderScope RecoverableItems | FL Name,FolderAndSubfolderSize,ItemsInFolderAndSubfolders

Run the following command to get the size and total number of items in folders and subfolders in the Recoverable Items folder in the user's archive mailbox.

Get-MailboxFolderStatistics <username> -FolderScope RecoverableItems -Archive | FL Name,FolderAndSubfolderSize,ItemsInFolderAndSubfolders

Step 6: Revert the mailbox to its previous state

The final step is to revert the mailbox back to its previous configuration. This means resetting the properties that you changed in Step 2 and reapplying the holds that you removed in Step 3. This includes:

  • Changing the deleted item retention period back to its previous value. Alternatively, you can just leave this set to 30 days, the maximum value in Exchange Online.

  • Re-enabling single Item recovery.

  • Re-enabling the client access methods so that the owner can access their mailbox.

  • Reapplying the holds and retention policies that you removed.

  • Re-enabling the Managed Folder Assistant to process the mailbox.

Important

We recommend that you wait 24 hours after re-applying a hold or retention policy (and verifying that it's in place) before you re-enable the Managed Folder Assistant to process the mailbox.

Perform the following steps (in the specified sequence) in Exchange Online PowerShell.

  1. Run the following command to change the deleted item retention period back to its original value. This assumes that the previous setting is less than 30 days; for example, 14 days.

    Set-Mailbox <username> -RetainDeletedItemsFor 14
  2. Run the following command to re-enable single item recovery.

    Set-Mailbox <username> -SingleItemRecoveryEnabled $true
  3. Run the following command to re-enable all client access methods to the mailbox.

    Set-CASMailbox <username> -EwsEnabled $true -ActiveSyncEnabled $true -MAPIEnabled $true -OWAEnabled $true -ImapEnabled $true -PopEnabled $true
  4. Reapply the holds that you removed in Step 3. Depending on the type of hold, use one of the following procedures.

    Litigation Hold

    Run the following command to re-enable a Litigation Hold for the mailbox.

    Set-Mailbox <username> -LitigationHoldEnabled $true

    In-Place Hold

    Use the EAC (or Exchange Online PowerShell) to add the mailbox back to the In-Place Hold.

    Retention policies applied to specific mailboxes

    Use the compliance portal to add the mailbox back to the retention policy. Go to the Data lifecycle management > Microsoft 365 > Retention page in the compliance center, edit the retention policy, and add the mailbox back to the list of recipients that the retention policy is applied to.

    Organization-wide retention policies

    If you removed an organization-wide or Exchange-wide retention policy by excluding it from the policy, then use the compliance portal to remove the mailbox from the list of excluded users. Go to the Data lifecycle management > Microsoft 365 > Retention page in the compliance center, edit the organization-wide retention policy, and remove the mailbox from the list of excluded recipients. Doing this will reapply the retention policy to the user's mailbox.

    eDiscovery case holds

    Use the compliance portal to add the mailbox back the hold that's associated with an eDiscovery case. Go to the eDiscovery > Core page, open the case, and add the mailbox back to the hold.

  5. Run the following command to allow the Managed Folder Assistant to process the mailbox again. As previously stated, we recommend that you wait 24 hours after reapplying a hold or retention policy (and verifying that it's in place) before you re-enable the Managed Folder Assistant.

    (Video) Planning your Security Compliance with Microsoft Purview

    Set-Mailbox <username> -ElcProcessingDisabled $false
  6. To verify that the mailbox has been reverted back to its previous configuration, you can run the following commands and then compare the settings to the ones that you collected in Step 1.

    Get-Mailbox <username> | FL ElcProcessingDisabled,InPlaceHolds,LitigationHoldEnabled,RetainDeletedItemsFor,SingleItemRecoveryEnabled
    Get-CASMailbox <username> | FL EwsEnabled,ActiveSyncEnabled,MAPIEnabled,OWAEnabled,ImapEnabled,PopEnabled

More information

Here's a table that describes how to identify different types of holds based on the values in the InPlaceHolds property when you run the Get-Mailbox or Get-OrganizationConfig cmdlets. For more detailed information, see How to identify the type of hold placed on an Exchange Online mailbox.

As previously explained, you have to remove all holds and retention policies from a mailbox before you can successfully delete items in the Recoverable Items folder.

Hold typeExample valueHow to identify the hold
Litigation Hold
True
The LitigationHoldEnabled property is set to True.
In-Place Hold
c0ba3ce811b6432a8751430937152491
The InPlaceHolds property contains the GUID of the In-Place Hold that's placed on the mailbox. You can tell this is an In-Place Hold because the GUID doesn't start with a prefix.
You can use the Get-MailboxSearch -InPlaceHoldIdentity <hold GUID> | FL command in Exchange Online PowerShell to get information about the In-Place Hold on the mailbox.
Retention policies in the compliance portal applied to specific mailboxes
mbxcdbbb86ce60342489bff371876e7f224
or
skp127d7cf1076947929bf136b7a2a8c36f
When you run the Get-Mailbox cmdlet, the InPlaceHolds property also contains GUIDs of retention policies applied to the mailbox. You can identify retention policies because the GUID starts with the mbx prefix. If the GUID of the retention policy starts with the skp prefix, that indicates that the retention policy is applied to Skype for Business conversations.
To identity the retention policy that's applied to the mailbox, run the following command in Security & Compliance PowerShell:

Get-RetentionCompliancePolicy <retention policy GUID without prefix> | FL Name

Be sure to remove the mbx or skp prefix when you run this command.

Organization-wide retention policies in the compliance portal
No value
or
-mbxe9b52bf7ab3b46a286308ecb29624696 (indicates that the mailbox is excluded from an organization-wide policy)
Even if the InPlaceHolds property is empty when you run the Get-Mailbox cmdlet, there still might be one or more organization-wide retention policies applied to the mailbox.
To verify this, you can run the Get-OrganizationConfig | FL InPlaceHolds command in Exchange Online PowerShell to get a list of the GUIDs for organization-wide retention policies. The GUID for organization-wide retention policies applied to Exchange mailboxes starts with the mbx prefix; for example, mbxa3056bb15562480fadb46ce523ff7b02.
To identity the organization-wide retention policy that's applied to the mailbox, run the following command in Security & Compliance PowerShell:

Get-RetentionCompliancePolicy <retention policy GUID without prefix> | FL Name

If a mailbox is excluded from an organization-wide retention policy, the GUID for the retention policy is displayed in the InPlaceHolds property of the user's mailbox when you run the Get-Mailbox cmdlet; it's identified by the prefix -mbx; for example, -mbxe9b52bf7ab3b46a286308ecb29624696

eDiscovery case hold in the compliance portal
UniH7d895d48-7e23-4a8d-8346-533c3beac15d
The InPlaceHolds property also contains the GUID of any hold associated with an eDiscovery case in the compliance portal that might be placed on the mailbox. You can tell this is an eDiscovery case hold because the GUID starts with the UniH prefix.
You can use the Get-CaseHoldPolicy cmdlet in Security & Compliance PowerShell to get information about the eDiscovery case that the hold on the mailbox is associated with. For example, you can run the command Get-CaseHoldPolicy <hold GUID without prefix> | FL Name to display the name of the case hold that's on the mailbox. Be sure to remove the UniH prefix when you run this command.

To identity the eDiscovery case that the hold on the mailbox is associated with, run the following commands:

$CaseHold = Get-CaseHoldPolicy <hold GUID without prefix>

Get-ComplianceCase $CaseHold.CaseId | FL Name

FAQs

How do you clean recoverable items? ›

You can delete items in the Recoverable Items folder by using the New-ComplianceSearch and New-ComplianceSearchAction cmdlets in Security & Compliance PowerShell. To search for items that are located in the Recoverable Items folder, we recommend that you perform a targeted collection.

How do I permanently delete recoverable items in Outlook? ›

Permanently erase messages from Outlook.com

Warning: Items removed from your Recoverable items are permanently deleted and cannot be restored. Under Folders, select Deleted Items. At the top of the message list, select Recover items deleted from this folder. Select Empty folder.

How do I archive recoverable items? ›

Enable the archive mailbox and turn on auto-expanding archiving. You can enable an additional storage capacity for the Recoverable Items folder simply by enabling the archive mailbox and then turning on the auto-expanding archiving feature in Exchange Online.

How do I clean up my Discoveryhold folder? ›

Right-click “DiscoveryHolds” and select “Advanced” -> “Empty items and subfolders from folder…” Check the “Hard Deletion” box and click “OK”.

How do I permanently delete recoverable files? ›

To permanently delete files on Windows, send them to the Recycle Bin and then empty the Recycle Bin to delete them for good. Once the bin is empty, you can't recover the files unless you have data or file recovery software. And even that may not work, because recovery software is no guarantee.

What is the Recoverable Items folder and why is it important? ›

The Recoverable Items folder is indexed by Exchange Search and can be discovered by using In-Place eDiscovery or Content Search in the Microsoft Purview compliance portals. The Recoverable Items folder has its own storage quota. Exchange can prevent data from being purged from the Recoverable Items folder.

How do you permanently delete emails so they Cannot be recovered? ›

If you don't want a message to stay in your trash for 30 days, you can permanently delete it.
  1. On your computer, go to Gmail.
  2. On the left side of the page, click More.
  3. Scroll to Trash.
  4. Check the box next to messages you want to permanently delete. ...
  5. To delete all messages in your trash, click Empty Trash now.

Is permanently deleted data recoverable? ›

You can still recover permanently deleted files. When you delete a file or folder from your computer, it doesn't simply disappear from existence. Even if you immediately empty the Recycle Bin or the Trash folder, all your deletion does is earmark the space that the file takes up on your hard drive as vacant.

How long do deleted emails stay in recoverable items? ›

If you've permanently deleted an item in Microsoft Outlook or Outlook on the web (formerly known as Outlook Web App), the item is moved to a folder (Recoverable Items > Deletions) and kept there for 14 days, by default. You can change how long items are kept, up to a maximum of 30 days.

Why are deleted files recoverable? ›

Deleted files are still recoverable!

Although you can no longer see the file on the location it once was and your operating system no longer has it, a copy of it still exists in your hard drive. The file will remain there until another file replaces that file in the exact location.

Are deleted files recoverable? ›

Yes, files can be recovered after being deleted. The level of difficulty depends on how long ago the file was deleted, however, and you may need to use specialized tools if trying to recover data that has been corrupted.

Where is the Recoverable Items folder? ›

The Recoverable Items folder resides in the non-IPM subtree of each mailbox. This subtree isn't visible to users using Outlook, Outlook on the web, or other email clients.

What does it mean to clean up folder? ›

Empty folder empties the folder (Deleted items and Junk email) - messages are permanently deleted. Clean up Folder removes all redundant messages in the current folder and moves them to the "Cleanup" folder. These messages aren't deleted, just moved.

How do I purge a folder? ›

On the left side of the screen, click This PC. On the right side of the screen, locate and double-click the local disk (usually C: or D:). Double-click the folder containing the file you want to delete. Select the file or folder you want to delete, click File in the top menu bar, and select Delete.

How do you deep clean files? ›

You can manually remove unwanted files from your computer if technically sound. However, if you aren't, you need an optimizer tool.
...
  1. Disable Programs That Run On Startup. ...
  2. Disable Windows Tips and Tricks. ...
  3. Delete Temporary Files. ...
  4. Run Disk Cleanup Tool.
4 Jun 2022

How do I delete contents in Recoverable Items folder? ›

Here's the process:
  1. Step 1: Collect information about the mailbox.
  2. Step 2: Prepare the mailbox.
  3. Step 3: Remove all holds from the mailbox.
  4. Step 4: Remove the delay hold from the mailbox.
  5. Step 5: Delete items in the Recoverable Items folder.
  6. Step 6: Revert the mailbox to its previous state.
3 Oct 2022

What is the difference between deleting and wiping? ›

The difference between wiping and deleting lies in the fact that deleting data does not completely erase all traces of it. Indeed, wiping is much safer in maintaining the integrity and security of a company.

How does recover deleted items work? ›

When you recover items from the Recoverable Items folder, they are moved to the Deleted Items folder. After you recover an item, you can find it in your Deleted Items folder and then you can move it to another folder.

Is deleted cache recoverable? ›

You would simply get a file recover software like recuva or easus (or something more advanced) and point it at the chrome cache folder. Run it and see what it can recover and hope that the hard drive sectors were not over written with new cache data. How do I clear my cache on Google Chrome mobile?

What is a recoverable item? ›

recoverable item. An item that normally is not consumed in use and is subject to return for repair or disposal.

Are permanently deleted emails recoverable? ›

Is it possible to recover permanently deleted Gmail emails in a Gmail account? No. Once you delete your Gmail emails, they go to your Trash Bin, and stay there for 30 days. so if you have deleted them permanently from Trash Bin OR Google deleted them automatically after 30 days, then there is no way to recover them.

How do I permanently delete emails from the Deleted folder? ›

In the Folder pane, right-click the Deleted Items folder, and then click Empty Folder. You'll be prompted to confirm that you want to permanently delete the items. Click Yes.

How do you make sure emails are permanently deleted? ›

What to Know
  1. Select the message and press Shift+Delete. Select Yes to confirm.
  2. To turn off the confirmation message: Select File > Options > Advanced. Then clear the Prompt for confirmation check box.
  3. To permanently delete Deleted Items folder contents: Right-click the Deleted Items folder and select Empty Folder.
16 Dec 2020

How do you ensure deleted data Cannot be recovered? ›

To make sure that a single file can't be recovered, you can use a “file-shredding” application such as Eraser to delete it. When a file is shredded or erased, not only is it deleted, but its data is overwritten entirely, preventing other people from recovering it.

Can you recover deleted files after emptying the Recycle Bin? ›

Then you might be wondering if Recycle Bin recovery after empty is even possible at all. The answer will make you happy: yes, files deleted from the Recycle Bin can still be recovered because they remain physically present on the storage device until overwritten by new data.

Is anything deleted ever actually deleted? ›

Truth of the matter is that your data is never really deleted when you delete it from your computer manually. When you delete your files, they are being sent to the Recycle Bin, where they can be recovered at any time.

How long do items stay in deleted items? ›

The email messages stay in the Deleted Items folder or marked as deleted until you delete them by yourself. After this, they are moved to the Hidden Deleted Items folder. But, you can still recover the lost or deleted emails from Hidden Deleted Items folder within the next 30 days.

Are all emails retained forever? ›

Most federal and state email retention laws require email data to be retained for between 3 and 7 years, although there are exceptions and certain types of data may have do be retained for much longer, even indefinitely.

What files should not be deleted? ›

To prevent any miserable data loss in your Windows computer, avoid deleting these seven windows files and folders.
  • Program files folder. ...
  • WinSxS folder. ...
  • System32 folder. ...
  • Windows folder. ...
  • System volume information folder. ...
  • Swapfile. ...
  • Pagefile.
11 Aug 2021

What happens to permanently deleted files? ›

When you delete files from the recycle Bin or permanently delete them using the Shift + Delete command, the file name entry is removed from the Recycle Bin folder. The part of the disk where the file was located initially is then modified or overwritten but still contains the file data.

Is it always possible to restore a deleted file or folder? ›

Recovering deleted files is not always possible. Therefore, do not rely on being able to restore deleted files but think twice before deleting them.

Are deleted files on SSD recoverable? ›

Can SSD data be recovered? Yes, SSD data can be recovered—even from SSDs that have the TRIM command enabled, in many cases. The key is to begin the data recovery process as soon as possible using the best SSD recovery software application available.

Is just remove my files better than fully clean? ›

Hi, They both do basically the same, except selecting Clean The Drive will write zeros to the entire drive before reinstalling... Just Remove Files deletes the Files without writing zeros...

Does deleting a folder delete everything in the folder? ›

Remember, when you delete a folder, you're also deleting everything inside of it. Note: If you think you might need that folder (and its contents) later, back it up to a data file before you delete it. Right-click the folder you want to delete and click Delete Folder.

What is the difference between clean up folder and empty folder? ›

Empty Folder empties the folder (Deleted Items and Junk email), with the messages permanently deleted. You cannot easily recover them. Clean up Folder moves all redundant messages in the current folder to the designated "Cleanup" folder. These messages aren't deleted, just moved.

Why won't my folders delete? ›

Some files/folders cannot be deleted by you as a user because another user is marked as owner. As administrator you can set yourself as the owner which is called “taking ownership” in IT-lingo. To do this, start by right-clicking on the file or folder and selecting “Properties”.

What are the three ways to delete files and folder? ›

5 ways to delete files (temporarily or permanently) in Windows 10
  1. Delete or permanently delete files using keyboard shortcuts.
  2. Delete files using the right-click menu.
  3. Delete or permanently delete files from File Explorer's ribbon.
  4. Permanently delete files using PowerShell or Command Prompt.
25 Feb 2020

How do I mass delete files from a folder? ›

Select all files using Ctrl + A. Right click, choose cut. Move to the parent folder by first pressing back to exit the search and then another time to go to the parent folder.

What is the most efficient method of cleaning a file? ›

Using a File Card Brush to Clean a File

All you need to do is place the file card onto the file bristle side down, then push it sideways along the file in the direction of the teeth. This will then push any debris along the grooves between the teeth. This should then fall out of the file once it reaches the end.

What tool is used to clean files? ›

A file card, which is a brush with metal bristles, is used to clean the file.

What is meant by deep clean? ›

What is deep cleaning? Deep cleaning is not a daily task or a general tidy-up, it is a cleaning process which removes dirt, dust and other types of grime and bacteria that can build up in different areas over a period of time.

› summaries › clean-fol... ›

What is Intelligent Delete and Cleaning Folders? Dialog for Cleaning Folders FileBoss's, Intelligent Delete deletes all files (or the files that match the o...
When it comes to your computer, you are not the only culprit in terms of clutter. Windows comes with lots of files and folders you can do without. Getting rid o...
Essentially if you look at all the files in the folder thru code and compare the filename with the attachment.filename column and if it is not there , you can s...

How do you delete recoverable files on Iphone? ›

Remove files deleted from other apps

In Settings on iCloud.com, click Restore Files (in the Advanced section). Select each file you want to permanently remove or choose Select All. Click Delete.

How long do deleted emails stay in recoverable items? ›

If you've permanently deleted an item in Microsoft Outlook or Outlook on the web (formerly known as Outlook Web App), the item is moved to a folder (Recoverable Items > Deletions) and kept there for 14 days, by default. You can change how long items are kept, up to a maximum of 30 days.

How do you delete recoverable files on Android? ›

Put a file in trash
  1. On your Android phone or tablet, open the Google Drive app.
  2. At the bottom right, tap Files .
  3. Next to the file you want to delete, tap More. Remove.

What is the Recoverable Items folder in Outlook? ›

The Outlook Recoverable Items Folder

This is a hidden folder where you'll find items that have been deleted or emptied from the Deleted Items folder or permanently deleted from your inbox or another folder using Shift+Delete.

Is permanently deleted data recoverable? ›

You can still recover permanently deleted files. When you delete a file or folder from your computer, it doesn't simply disappear from existence. Even if you immediately empty the Recycle Bin or the Trash folder, all your deletion does is earmark the space that the file takes up on your hard drive as vacant.

Why are deleted files recoverable? ›

Deleted files are still recoverable!

Although you can no longer see the file on the location it once was and your operating system no longer has it, a copy of it still exists in your hard drive. The file will remain there until another file replaces that file in the exact location.

How long are deleted files recoverable? ›

The Recycle Bin will hold onto deleted files for 30 days, giving you time to restore items deleted accidentally.

Are permanently deleted emails recoverable? ›

Is it possible to recover permanently deleted Gmail emails in a Gmail account? No. Once you delete your Gmail emails, they go to your Trash Bin, and stay there for 30 days. so if you have deleted them permanently from Trash Bin OR Google deleted them automatically after 30 days, then there is no way to recover them.

Can a company recover permanently deleted emails? ›

Usually not, unless you give them reason to or they're a particularly bad workplace. If the emails were there for any length of time they could easily have been caught in the backup cycle and therefore be retrievable in the event that anyone had a reason to suspect you had deleted something that might be important.

Are emails ever truly deleted? ›

Your first attempt at deleting an email message rarely actually deletes it. Most email programs, such as Gmail, Yahoo or Outlook, simply move the deleted email to a trash folder that permanently erases the email only after a certain length of time.

Are deleted files on SSD recoverable? ›

Can SSD data be recovered? Yes, SSD data can be recovered—even from SSDs that have the TRIM command enabled, in many cases. The key is to begin the data recovery process as soon as possible using the best SSD recovery software application available.

Is factory reset data recoverable? ›

To recover data after factory reset Android, navigate to the "Backup and Restore" section under "Settings." Now, look for the "Restore" option, and choose the backup file you created before resetting your Android phone. Select the file and restore all of your data.

Can you recover deleted files after emptying the Recycle Bin Android? ›

Then you might be wondering if Recycle Bin recovery after empty is even possible at all. The answer will make you happy: yes, files deleted from the Recycle Bin can still be recovered because they remain physically present on the storage device until overwritten by new data.

Where is the Recoverable Items folder? ›

The Recoverable Items folder resides in the non-IPM subtree of each mailbox. This subtree isn't visible to users using Outlook, Outlook on the web, or other email clients.

Are deleted notes recoverable? ›

You can recover and edit notes you deleted in the last 30 days on iCloud.com or on your devices that are signed in with the same Apple ID. However, you can't recover notes you permanently removed. In Notes on iCloud.com, select Recently Deleted in the folder list on the left.

Where do deleted files go physically? ›

When you delete a file or folder, it goes into the Recycle bin, where you have a chance to restore it.

Videos

1. Find and retain cloud attachments with Microsoft Purview
(Microsoft Security)
2. Retention Vs Deletion! What really happens to your Data in Microsoft 365?
(Andy Malone MVP)
3. How Litigation Hold and Retention Hold work in Exchange Online
(Office 365 Concepts)
4. Demystifying Microsoft Purview with Peter Rising
(Cloud Conversations)
5. Expert insight webinar: Retention and deletion in Microsoft 365
(Cloud Essentials)
6. Managing information governance in the Microsoft 365 Compliance Center
(David Dalton)
Top Articles
Latest Posts
Article information

Author: Wyatt Volkman LLD

Last Updated: 12/22/2022

Views: 5672

Rating: 4.6 / 5 (46 voted)

Reviews: 85% of readers found this page helpful

Author information

Name: Wyatt Volkman LLD

Birthday: 1992-02-16

Address: Suite 851 78549 Lubowitz Well, Wardside, TX 98080-8615

Phone: +67618977178100

Job: Manufacturing Director

Hobby: Running, Mountaineering, Inline skating, Writing, Baton twirling, Computer programming, Stone skipping

Introduction: My name is Wyatt Volkman LLD, I am a handsome, rich, comfortable, lively, zealous, graceful, gifted person who loves writing and wants to share my knowledge and understanding with you.