Complete Guide to recover deleted Gmail emails

Recover Deleted Gmail Emails

There might be scenarios where you would need to recover your deleted emails, may be because you deleted them by mistake, or you never thought you would need them back.

but….. now….. you might be asking, “Are deleted Gmail emails recoverable“?

The answer here really “depends” on whether you are using consumer Gmail (@gmail.com) account OR Google Workspace account, are you a regular user OR Google Workspace Admin, which Google Workspace plan you have subscribed to………

Let us see all these scenarios in details, and how they impact our ability to recover our deleted Gmail emails.


Recover deleted Gmail emails as a User


Recover Deleted Emails in Gmail as regular Gmail User:

When you delete Gmail emails, by default they go to your Gmail Trash Bin and stay there for 30 days, so if you are within 30 days range, you can restore them as shown below.

Note -: If you are using personal / consumer Gmail account, it is not possible to recover deleted Gmail emails if you permanently deleted them over 30 days ago.

Permanently deleted Gmail emails = You deleted from Gmail Trash Bin manually OR Google automatically deleted them after 30 days.

To recover deleted gmail emails within last 30 days, go to Trash Bin in your Gmail as shown below, select either the required ones OR all emails that you want to recover.

By default emails viewable in first page would be selected, if you want to restore all deleted Gmails, select all the conversations.

54. Go to Gmail Trash bin and select all emails
55. select all emails if you want to restore all deleted Gmail emails
  1. Click the move to icon.

  2. Click on Inbox.
56. Click move to, and then inbox to restore all deleted gmail emails

Gmail would ask you to confirm the bulk action, Click OK, and your emails would now be restored from Trash Bin to Gmail Inbox.

57. Confirm that you want to restore all deleted Gmail emails to inbox


Recover deleted Gmail emails as Google Workspace Admin


If you use Google Workspace, you have more options / flexibility to restore Gmail emails permanently deleted by your users.

Option 1: Restore Emails from within Google Workspace Admin Console

Available in all Google Workspace plans.

You can restore permanently deleted Gmail emails to your users right from Google Workspace Admin Console within 25 days of permanent deletion by user.

  1. To use this option, login to your Google Workspace Admin Console and search for the concerned user.
  2. Go to user’s details page.
  3. Click on “More”
  4. Click on “Restore Data” as shown in the screenshot below.
58. Go to Google Workspace Admin console and search for user for whom you want to restore delete gmail emails
  1. Enter the date range for which you want to restore deleted Gmail emails (within 25 days range).

  2. Select Gmail from the Application dropdown.

  3. Click on Restore.
59. Enter the date range and click on restore

Option 2 -: Restore Deleted Emails from Security Investigation Tool

Available only in Google Workspace Enterprise plan

Google Workspace Enterprise plan offers “Security Investigation Tool” where you can run investigations and then perform the respective action/s.

Assuming you are on Google Workspace Enterprise plan, let us investigate the emails permanently deleted by our user, and then restore them to user’s mailbox.

Notes -:
— Security investigation tool supports restoring permanently deleted emails within 30 days of permanent deletion.
— You should also have required privilege to access security investigation tool.

To start investigation, login to your Google Workspace Admin Console, and then go to Investigation tool under Security settings.

60. Go to Investigation tool from Google Workspace Admin console security

Investigation Details :

  1. Select “Gmail messages” as Source.
  2. Use AND for the conditions.
  3. Select your date criteria for restoring emails.
  4. Select your recipient.
  5. Select “Deleted” label (e.g deleted here = emails which are permanently deleted)
  6. Click on Search

61. Run a security investigation to find user's deleted Gmail emails

You should now see all the emails which are permanently deleted by this user within the date range you specified.

  1. Select either required or all the emails that you want to restore.

  2. Click on Actions menu as shown in the screenshot below.
62. Select the Gmail emails you want to restore and click on Actions

Click on “Restore Messages”.

63. Click on restore messages from security investigation tool

It would ask you for confirmation that you want to restore X messages to this user.

Click on “Restore”.

64. Confirm to Google that you want to restore this user's gmail emails

Your email restoring process should now start (along with an option to Abort the action if required).

65. Restore Gmail emails process will start

Security investigation tool now shows you the action results, and if everything goes fine, you should see “message/s was restored successfully”.

Important Notes-:

  1. These emails will be restored to user’s Trash Bin, and not to Inbox, because thats where these emails were before being permanently deleted.

  2. Are you asking why didn’t we restore directly to user’s inbox? good question, thats because it is not possible, you would see the error if you try to put them directly to Inbox.

So now, as we restored emails to user’s Gmail Trash Bin, we can either ask the user to restore them from their Bin OR run one more investigation (this time on Trash Bin), and then send them to user’s inbox.

66. User's Gmail emails will not be restored

Now, to restore emails from user’s Gmail Trash Bin to Inbox, let us run another investigation where everything remains same except the Label Name.

This time label name should be “Bin”, and then our action should be “Send to Inbox” as shown in the screenshot below.

67. Run the investigation to find gmail emails in trash

Confirm that you want to move these emails in bulk by clicking on “SEND TO INBOX”

68. Click on send to inbox from security investigation tool

Send to Inbox process should now be started.

69. Send to inbox process would now start

Congratulations, your user’s emails should now be available in his/her Gmail inbox.

70. Users deleted Gmail emails should now be sent to inbox

Option 3 – Restore Deleted Emails via Google Vault.

Available in Google Workspace Business and Enterprise Plans (and as add-on in Google Workspace basic plan).

Google Vault is an archiving and retention application which helps you retain your Google Workspace data based on the retention rules you define.

You can learn more about it in my “THE DEFINITIVE GUIDE TO GOOGLE VAULT“.

Assuming you already have a retention policy in place to retain your data (note, though Vault works retrospectively after you set it up or create/change retention policy, but only for data that isn’t permanently deleted at that time).

You should login to ediscovery.google.com, create a matter, and then run your search to find the deleted emails that you want to restore.

In the following example, am trying to restore emails for a given user from 01-May-2020 to 11-May-2020 which are permanently deleted (denoted by label^deleted).

Click on Search after putting your search criteria.

71. Run query in Google Vault to find permanently deleted Gmail emails

Now you should see the permanently deleted emails based on your Google Vault search criteria.

Click on “Export results” to export this data.

72. Click on Export results from Google Vault

Google Vault should now begin exporting your data, and it may take sometime depending on the size of the data.

73. Google Vault would not start the export
  1. Give your export a name.

  2. Select the data region (e.g none, United States, Europe) where your export result would be saved, and available for 15 days.

  3. Select the format (e.g Mbox or PST for emails), I would go with PST as it is easy to import it than Mbox).

  4. Click on Start Export.
74. Select the pst format and click on export in Google Vault

Click on “view X completed files” to expand your export results.

75. Click on export files in Google Vault

Your Mbox file would be in .zip format, click on download to save it to your local machine.

Note -: Depending on the size of your data, you might have multiple .zip files, as each file can be max 1 GB for PST.

76. Download the deleted files pst from Google Vault

You can now unzip your downloaded file to extract the pst file.

You can then use Google’s Google Workspace Migration for Microsoft Exchange to migrate this PST file to your user’s mailbox.

77. You should now have users deleted files pst


FAQs about Deleting & Restoring Gmail Emails


IS IT POSSIBLE TO RECOVER PERMANENTLY DELETED GMAIL EMAILS IN A GMAIL ACCOUNT?

No.

Once you delete your Gmail emails, they go to your Trash Bin, and stay there for 30 days.

so if you have deleted them permanently from Trash Bin OR Google deleted them automatically after 30 days, then there is no way to recover them.

HOW LONG WOULD THESE PERMANENTLY DELETED EMAILS BE AVAILABLE IN GOOGLE VAULT?

It depends on the retention period you defined in Google Vault.

E.g if you have created a retention policy to retain data indefinitely, then these would be available till the time you are a Google Vault customer.

CAN WE SIGN UP FOR GOOGLE VAULT NOW AND RECOVER THESE EMAILS?

It depends.

If the user permanently deleted these emails more than 25 days ago and either do not have Google Vault OR you did not set it up yet, then even if you sign up for Google Vault (or set it up now), you can not recover them.

I DO NOT SEE THE PERMANENTLY DELETED GMAIL EMAILS IN SECURITY INVESTIGATION TOOL, WHY?

As per Google’s documentation, there is upto 60 minutes latency for Gmail logs to appear in Security investigation tool.

So it might not show the emails permanently deleted within last 60 minutes, if thats the case, try again in one hour’s time.

DO I NEED SUPER ADMIN ROLE TO RECOVER DELETED EMAILS VIA GOOGLE VAULT OR SECURITY INVESTIGATION TOOL?

No, both Google Vault and Security Investigation tool offer delegated administration privileges, you should be able to leverage these tools to restore permanently deleted Gmail emails till the time you have delegated administrator role with these permissions.

Related Posts

....

....