Recover Deleted Gmail Emails

There might be scenarios where you would need to recover your deleted emails, may be because you deleted them by mistake, or you never thought you would need them back.

but….. now….. you might be asking, “Are deleted Gmail emails recoverable“?

The answer here really “depends” on whether you are using consumer Gmail (@gmail.com) account OR Google Workspace account, are you a regular user OR Google Workspace Admin, which Google Workspace plan you have subscribed to………

Let us see all these scenarios in details, and how they impact our ability to recover our deleted Gmail emails.

Recover deleted Gmail emails as a User

Recover Deleted Emails in Gmail as regular Gmail User:

When you delete Gmail emails, by default they go to your Gmail Trash Bin and stay there for 30 days, so if you are within 30 days range, you can restore them as shown below.

Note -: If you are using personal / consumer Gmail account, it is not possible to recover deleted Gmail emails if you permanently deleted them over 30 days ago.

Permanently deleted Gmail emails = You deleted from Gmail Trash Bin manually OR Google automatically deleted them after 30 days.

To recover deleted gmail emails within last 30 days, go to Trash Bin in your Gmail as shown below, select either the required ones OR all emails that you want to recover.

By default emails viewable in first page would be selected, if you want to restore all deleted Gmails, select all the conversations.

1. Click the move to icon.
   
   
2. Click on Inbox.

Gmail would ask you to confirm the bulk action, Click OK, and your emails would now be restored from Trash Bin to Gmail Inbox.

Recover deleted Gmail emails as Google Workspace Admin

If you use Google Workspace, you have more options / flexibility to restore Gmail emails permanently deleted by your users.

Option 1: Restore Emails from within Google Workspace Admin Console

Available in all Google Workspace plans.

You can restore permanently deleted Gmail emails to your users right from Google Workspace Admin Console within 25 days of permanent deletion by user.

1. To use this option, login to your Google Workspace Admin Console and search for the concerned user.
2. Go to user’s details page.
3. Click on “More”
4. Click on “Restore Data” as shown in the screenshot below.

1. Enter the date range for which you want to restore deleted Gmail emails (within 25 days range).
   
   
2. Select Gmail from the Application dropdown.
   
   
3. Click on Restore.

Option 2 -: Restore Deleted Emails from Security Investigation Tool

Available only in Google Workspace Enterprise plan

Google Workspace Enterprise plan offers “Security Investigation Tool” where you can run investigations and then perform the respective action/s.

Assuming you are on Google Workspace Enterprise plan, let us investigate the emails permanently deleted by our user, and then restore them to user’s mailbox.

Notes -:
— Security investigation tool supports restoring permanently deleted emails within 30 days of permanent deletion.
— You should also have required privilege to access security investigation tool.

To start investigation, login to your Google Workspace Admin Console, and then go to Investigation tool under Security settings.

Investigation Details :

1. Select “Gmail messages” as Source.
2. Use AND for the conditions.
3. Select your date criteria for restoring emails.
4. Select your recipient.
5. Select “Deleted” label (e.g deleted here = emails which are permanently deleted)
6. Click on Search

You should now see all the emails which are permanently deleted by this user within the date range you specified.

1. Select either required or all the emails that you want to restore.
   
   
2. Click on Actions menu as shown in the screenshot below.

Click on “Restore Messages”.

It would ask you for confirmation that you want to restore X messages to this user.

Click on “Restore”.

Your email restoring process should now start (along with an option to Abort the action if required).

Security investigation tool now shows you the action results, and if everything goes fine, you should see “message/s was restored successfully”.

Important Notes-:

1. These emails will be restored to user’s Trash Bin, and not to Inbox, because thats where these emails were before being permanently deleted.
   
   
2. Are you asking why didn’t we restore directly to user’s inbox? good question, thats because it is not possible, you would see the error if you try to put them directly to Inbox.

So now, as we restored emails to user’s Gmail Trash Bin, we can either ask the user to restore them from their Bin OR run one more investigation (this time on Trash Bin), and then send them to user’s inbox.

Now, to restore emails from user’s Gmail Trash Bin to Inbox, let us run another investigation where everything remains same except the Label Name.

This time label name should be “Bin”, and then our action should be “Send to Inbox” as shown in the screenshot below.

Confirm that you want to move these emails in bulk by clicking on “SEND TO INBOX”

Send to Inbox process should now be started.

Congratulations, your user’s emails should now be available in his/her Gmail inbox.

Option 3 – Restore Deleted Emails via Google Vault.

Available in Google Workspace Business and Enterprise Plans (and as add-on in Google Workspace basic plan).

Google Vault is an archiving and retention application which helps you retain your Google Workspace data based on the retention rules you define.

You can learn more about it in my “THE DEFINITIVE GUIDE TO GOOGLE VAULT“.

Assuming you already have a retention policy in place to retain your data (note, though Vault works retrospectively after you set it up or create/change retention policy, but only for data that isn’t permanently deleted at that time).

You should login to ediscovery.google.com, create a matter, and then run your search to find the deleted emails that you want to restore.

In the following example, am trying to restore emails for a given user from 01-May-2020 to 11-May-2020 which are permanently deleted (denoted by label^deleted).

Click on Search after putting your search criteria.

Now you should see the permanently deleted emails based on your Google Vault search criteria.

Click on “Export results” to export this data.

Google Vault should now begin exporting your data, and it may take sometime depending on the size of the data.

1. Give your export a name.
   
   
2. Select the data region (e.g none, United States, Europe) where your export result would be saved, and available for 15 days.
   
   
3. Select the format (e.g Mbox or PST for emails), I would go with PST as it is easy to import it than Mbox).
   
   
4. Click on Start Export.

Click on “view X completed files” to expand your export results.

Your Mbox file would be in .zip format, click on download to save it to your local machine.

Note -: Depending on the size of your data, you might have multiple .zip files, as each file can be max 1 GB for PST.

You can now unzip your downloaded file to extract the pst file.

You can then use Google’s Google Workspace Migration for Microsoft Exchange to migrate this PST file to your user’s mailbox.

FAQs about Deleting & Restoring Gmail Emails

IS IT POSSIBLE TO RECOVER PERMANENTLY DELETED GMAIL EMAILS IN A GMAIL ACCOUNT?

No.

Once you delete your Gmail emails, they go to your Trash Bin, and stay there for 30 days.

so if you have deleted them permanently from Trash Bin OR Google deleted them automatically after 30 days, then there is no way to recover them.

‍

HOW LONG WOULD THESE PERMANENTLY DELETED EMAILS BE AVAILABLE IN GOOGLE VAULT?

It depends on the retention period you defined in Google Vault.

E.g if you have created a retention policy to retain data indefinitely, then these would be available till the time you are a Google Vault customer.

‍

CAN WE SIGN UP FOR GOOGLE VAULT NOW AND RECOVER THESE EMAILS?

It depends.

If the user permanently deleted these emails more than 25 days ago and either do not have Google Vault OR you did not set it up yet, then even if you sign up for Google Vault (or set it up now), you can not recover them.

‍

I DO NOT SEE THE PERMANENTLY DELETED GMAIL EMAILS IN SECURITY INVESTIGATION TOOL, WHY?

As per Google’s documentation, there is upto 60 minutes latency for Gmail logs to appear in Security investigation tool.

So it might not show the emails permanently deleted within last 60 minutes, if thats the case, try again in one hour’s time.

‍

DO I NEED SUPER ADMIN ROLE TO RECOVER DELETED EMAILS VIA GOOGLE VAULT OR SECURITY INVESTIGATION TOOL?

No, both Google Vault and Security Investigation tool offer delegated administration privileges, you should be able to leverage these tools to restore permanently deleted Gmail emails till the time you have delegated administrator role with these permissions.