Hello all.
I am experiencing an issue with a critical user who is currently in an ongoing litigation from 2013. Currently his O365 sent folder only is showing emails from 2015 on. He needs to be able to locate emails prior to 2015. When the original migration was done from their old exchange environment to O365 by default we took everything that was in the onprem exchange and sucked it into O365. However a year later we are being told there was more mail then what is currently listed. I found a link on Microsofts retention policy
https://docs.microsoft.com/en-us/exchange/security-and-compliance/messaging-records-management/default-retention-policy
This is a very confusing article. Because of O365 default retention policy that we are unable to get mail before 2015. Has anyone run across this? This is critical that they are able to retrieve sent messages prior. If he logs into portal.office.com the mail only goes back to 2015 so policy somehow kicked in I think when the migration was done and only did 5 years worth. But I have a feeling when the migration took place there was more than 5 years, so I am hoping perhaps email is sitting somewhere in MS cloud and can be retrieved prior to 2015. As always appreciate the help.
P.S. I am reading that after the retention policy date is exceeded email goes into an archive. Is this retrievable?
Now, if you have created/applied a custom policy, or the user simply deleted the messages, they might be lost forever. As a rule of thumb, if the user is under investigation, you should have put his mailbox on litigation/in-place hold the moment you were made aware of this, making sure that no message is lost.