User deleted all mail from Google Apps account using Outlook
A user using Google Apps Sync with Outlook on their desktop PC has just deleted all of the messages from theit Inbox and all their messages in subfolders (ie mail marked with labels in Gmail)
That has wiped clean Gmail too, so the mailbox has nothing in it
Google Apps support say that they maintain no further copy and that deletion can't be undone.
I don't have the machine in my possession yet, but will get it. Any ideas what might be possible? I presume Google Apps Sync created a PST file which held the data, while it's not in Trash or Deleted Items I doubt that the data file has shrunk to zero - so perhaps there's some way of extracting individual messages from a PST?
I have enabled a trial of Google Vault on GA support's advice, apparently it might index the deleted but not yet quite erased data.
That has wiped clean Gmail too, so the mailbox has nothing in it
Google Apps support say that they maintain no further copy and that deletion can't be undone.
I don't have the machine in my possession yet, but will get it. Any ideas what might be possible? I presume Google Apps Sync created a PST file which held the data, while it's not in Trash or Deleted Items I doubt that the data file has shrunk to zero - so perhaps there's some way of extracting individual messages from a PST?
I have enabled a trial of Google Vault on GA support's advice, apparently it might index the deleted but not yet quite erased data.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks folks. Vault, enabled about three hours after everything was deleted, had copied everything.
Downloaded the archive as an MBOX file from Vault, opened it with Thunderbird, connected back to the account in question via IMAP and uploaded the emails back to the account
I also see that there is an option in Gmail settings for what to do when deleting mail via IMAP, which Google support tells me affects Google Apps Sync for Outlook's behaviour too, so that deleted email is archived rather than deleted (ie, sent to All Mail). Obviously someone could still delete via All Mail in Gmail too, but in this instance, having that set would've been sufficient.
Downloaded the archive as an MBOX file from Vault, opened it with Thunderbird, connected back to the account in question via IMAP and uploaded the emails back to the account
I also see that there is an option in Gmail settings for what to do when deleting mail via IMAP, which Google support tells me affects Google Apps Sync for Outlook's behaviour too, so that deleted email is archived rather than deleted (ie, sent to All Mail). Obviously someone could still delete via All Mail in Gmail too, but in this instance, having that set would've been sufficient.
If you have a PST file of any size, Kernel PST Recovery will recover the E-Mails: http://www.kerneldatarecovery.com/pst-recovery.html