Why wouldn't you want to use E-Discovery?  If the mailbox is on Litigation hold before the user did the deletions and you pull a .pst of the mailbox using in-place eDiscovery & Hold you will get everything, even what was deleted.

Sounds good, thanks! How do I do that?

All of these items should be in the recoverable items folder:
https://technet.microsoft.com/en-us/library/ee364755(v=exchg.160).aspx

More information on recovering deleted items:
https://technet.microsoft.com/en-us/library/dd298021(v=exchg.160).aspx

Hope this helps!

Christopher

Open your Exchange Admin Center
on the left click Compliance Management, then click in-place eDiscovery & hold
1. Click the +     Create a name for this pull...you can give it the user's name if you like, then click Next
2. Click Specify Mailboxes to Search, find the mailbox and add it to the search, then click Next
3.  Include All content, click next
4. hold indefinitely, click Finish

After it does the pull you will refresh the page and it will show you how big the mailbox is sizewise and how many items.
From here you will click the down arrow and pull it all to a .pst file to a location of your choice.
Once the .pst is pulled down you may open the .pst in your outlook where you will see all the mail, deletions, purges, everything.

You will want to run the ediscovery in IE or Edge.   Using Google Chrome causes issues at times.

Hi FOX,

Thanks for your comment. However I do not have a down arrow icon above my search result. It seems my Exchange 2016 does not have this feature. Is that possible?

Is there any way for me to pull a PST?

Hi FOX,

I made myself a member of the Discovery Group and now I have that option.

Thanks!

UPDATE: I've extracted the mailbox from eDiscovery. However, after 30 minutes of review comparing folders to folders, I cannot locate any messages in the exported PST that are not also in the existing mailbox. My instinct tells me that no deleted mail has been recovered. Or at least there is no evidence that deleted email has been recovered.

If I enabled Litigation Hold on March 8th and the user deleted mail (and I know the user did delete email as I recovered some of it manually after she departed), would that mail have been returned to the original folders?

Is it possible that the deleted email is located in a special folder somewhere, and that I can extract that particular folder?

You can recover all the deleted mails by using Stellar Phoenix Mailbox Exchange Recovery and export to a PST. Try demo version from here: https://www.stellarinfo.com/edb-exchange-server-recovery.htm