I've been tasked with retrieving emails from a long-deleted Office 365 account that lost its license around two years ago. Unfortunately, there are no archives or backups to rely on. Is my only option to sift through the other 700 email accounts to find relevant emails from five years back and hope for the best? I'll likely need to explain my methods and the outcome later, possibly even in court. In previous cases, I had either access to an archive or the account still existed. Are there any tools or solutions to help retrieve emails from a hosted Exchange service? I have global admin access to the tenant, and I'm open to purchasing tools if they're reasonably priced.
6 Answers
You might want to check out Microsoft Purview for compliance searching, as long as retention policies were in place at the time the mailbox was deleted. If there really are no backups or existing retention policies, explaining that there’s nothing available is likely your best course.
Definitely consult your legal team. If you don’t have one in-house, ask your manager to set up a meeting with your outside counsel. Be honest about what you do and don't have and what tools you're working with. They’ll provide guidance on how to handle the request and communicate with the court.
Just be straightforward with your legal department about the deleted mailbox. They’ll know how to handle it from there. Remember, you're not the one making the legal decisions; you're just relaying the facts to them.
Right, just ensure you communicate this to your company's lawyer, not the opposing counsel.
In situations like these, engaging with legal is essential. Depending on your company's retention policies, if you only retain emails for a short period, that's likely your answer when facing subpoenas. Just make sure to document all attempts and data availability based on company policies for review by your legal team.
Don't forget to review the specific court order as well. Microsoft has e-discovery features that might help. It's your legal team who should guide you on the appropriate actions, not random advice from the internet!
It might be acceptable to say, "We don’t keep that data for ex-employees." Some companies have strict policies to delete emails older than a certain timeframe so they can't even be subpoenaed. But, it really depends on your company's retention policies and the regulations governing your industry. If there's no retention policy in place, you could potentially get away with saying you don't have those emails, but this can lead to complications if the court order specifies otherwise.
That's why it’s crucial to have a solid retention policy in place and to follow it strictly. You really don’t want to be caught in a situation where you could face legal penalties for not having the required data.
You also need to consider the exact wording of the court order. If there are related emails in existing accounts that were sent from the deleted one, you may still have to provide those.
Exactly! Your legal team may want to get Purview access to see what can be retrieved from the remaining mailboxes, but it's primarily their decision.