Solved

User deleted all mail from Google Apps account using Outlook

Posted on 2013-11-15
3
1,224 Views
Last Modified: 2015-03-02
A user using Google Apps Sync with Outlook on their desktop PC has just deleted all of the messages from theit Inbox and all their messages in subfolders (ie mail marked with labels in Gmail)

That has wiped clean Gmail too, so the mailbox has nothing in it

Google Apps support say that they maintain no further copy and that deletion can't be undone.

I don't have the machine in my possession yet, but will get it.  Any ideas what might be possible?  I presume Google Apps Sync created a PST file which held the data, while it's not in Trash or Deleted Items I doubt that the data file has shrunk to zero - so perhaps there's some way of extracting individual messages from a PST?

I have enabled a trial of Google Vault on GA support's advice, apparently it might index the deleted but not yet quite erased data.
0
Comment
Question by:RedLondon
3 Comments
 
LVL 14

Accepted Solution

by:
Allen Falcon earned 500 total points
Comment Utility
Vault will capture deleted but not yet missing data.  Be advised that Vault is NOT a backup/recovery tool .. it is designed to capture all email activity as an archive for ediscovery purposes.   I strongly recommend getting a Backupify trial going as well.

Through the web UI, you need to log in to the user's account and look in the Trash folder .. quickly, it sweeps data permanently off the system.  The messages may be in the mapped trash folder (no Deleted Items) in Outlook.

GASMO does not use PST files, it keeps a local cache, typically with 1 or 2 GB of the user's mail locally for performance.  Some users set it to 4GB or all mail, but this is rare due to performance issues with syncing all folders every time outlook starts.

In Outlook, if you have it set to empty deleted items up exit, deleted messages are permanently deleted and gone each time you close the software.  Depending on your settings, this may be the case here as well.

Get remote access to the computer ASAP (!!!!!) and see what is going on with the local cache.

Google does have some abilities to recover deleted content (with much less willingness to do so).  If you have a Google Apps Reseller, get them involved -- they should open a case in addition to (and referencing) your case number with Google.


---

We are a Google Apps Premier SMB Reseller.  We can provide you advice and guidance, like above.  We cannot get involved with Google on your behalf without you being a customer of ours.  I am not asking for your business.  Given your situation, I want to be up front about the scope of what we can do.
0
 
LVL 42

Expert Comment

by:Davis McCarn
Comment Utility
All versions of Outlook prior to 2010 only delete the E-Mails if the user compacts the PST manually.  Deleted E-Mails simply get a flag signifying don't show me anymore.
If you have a PST file of any size, Kernel PST Recovery will recover the E-Mails: http://www.kerneldatarecovery.com/pst-recovery.html
0
 
LVL 11

Author Comment

by:RedLondon
Comment Utility
Thanks folks.  Vault, enabled about three hours after everything was deleted, had copied everything.

Downloaded the archive as an MBOX file from Vault, opened it with Thunderbird, connected back to the account in question via IMAP and uploaded the emails back to the account

I also see that there is an option in Gmail settings for what to do when deleting mail via IMAP, which Google support tells me affects Google Apps Sync for Outlook's behaviour too, so that deleted email is archived rather than deleted (ie, sent to All Mail).  Obviously someone could still delete via All Mail in Gmail too, but in this instance, having that set would've been sufficient.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Get an idea of what you should include in an email disclaimer with these Top 5 email disclaimer tips.
Follow this checklist to learn more about the 15 things you should never include in an email signature from personal quotes, animated gifs and out-of-date marketing content.
This Micro Tutorial demonstrates in Google Sheets how to use the HYPERLINK function to create live links inside your spreadsheet.
By using UNIQUE function in Google Sheets, you can get around removing duplicates like in Microsoft Excel.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now