Jul 22 2017 08:08 AM
Need a way to restore an active users mailbox that is in Exchange Online. In short, user was compromised and all of their contacts were deleted. They are not in deleted items or recovery items even though the mailbox has retention tags enabled. I attempted to use eDiscovery to recover the items but eDiscovery is not paying nice when it comes to restoring Contacts. Exported the PST files (multiple) from eDiscovery and after review, it only appears to have a percentage of the person's contacts.
Followed the process of restoring a mailbox but it only appears to be available if the mailbox in a whole was deleted (soft/hard delete). How does one go about restoring a mailbox when the user is still active in the system?
If there is a better way to restore the contacts, that would be great as well. Thank you.
Jul 23 2017 11:29 AM
Retention tags in Exchange do not help with data recovery, they are used to delete/move data. Still, the deleted contacts should be recoverable for up to 14 days after the incident, 30 if you have increased the Single-Item recovery window to the maximum value. If you are not able to find them in the Deleted Items/Recover deleted items container, then eDiscovery is your only option. You can search for "kind:contacts" to include all contacts.
Again, this will only work for a limited time if the contacts have been deleted, unless you have put the mailbox on hold.
Jul 23 2017 12:32 PM
Aug 02 2017 06:22 AM
What solution are you using, if I might ask? I have learned from this situation not to depend on MS for recovery of data in their cloud.
Aug 04 2017 12:10 AM
Hi Jeff,
you can have a look here:
https://www.avepoint.com/products/office-365-services/office-365-backup/
All what you need ;)
Hope this helps and best regards
Rob