This guide, 'Recovering Evidence From Deleted Microsoft 365 User Accounts', is for UK lawyers, in-house counsel and investigators.
Guide · 17 pages · 23 min read · Published 2026-08-31
This guide, 'Recovering Evidence From Deleted Microsoft 365 User Accounts', is for UK lawyers, in-house counsel and investigators. It addresses the challenges of recovering evidence from deleted Microsoft 365 user accounts, particularly concerning leavers. The guide covers the lifecycle of a deleted account, including soft deletion, inactive state, and hard deletion, and what survives where, such as mailbox, One Drive, Teams, and audit logs. It details preservation and collection before and after the clocks run, and reconstruction from the rest of the estate when an account is gone. It also examines leaver processes, preservation duties, and legal consequences, offering worked examples, common mistakes, and questions to ask.
Read this guide on your phone, browse guides by topic or go back to the full PDF library.
17 pages · 23 min read
This guide, 'Recovering Evidence From Deleted Microsoft 365 User Accounts', is for UK lawyers, in-house counsel and investigators.
Published by Computer Forensics Lab on 2026-08-31. Original material of the practice, free to read, cite and download. See every guide's author and source.
Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the wording shown here, including any later corrections.
DELETEDM365ACCOUNTS · A GUIDE FOR UK LAWYERS Recovering Evidence from Deleted Microsoft 365 User Accounts Soft Deletion, Inactive Mailboxes, Retention and the Leaver Who Left Before the Hold COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES DELETED-ACCOUNT RECOVERY
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the leaver process is a deletion engine 03 The lifecycle of a deleted account: soft deletion, inactive state, hard deletion 04 What survives where: mailbox, One Drive, Teams, audit logs and licences 05 Preservation and collection before and after the clocks run 06 When the account is gone: reconstruction from the rest of the estate 07 Leaver processes and preservation duties: the legal consequences 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ADELETEDMICROSOFT365ACCOUNTPASSESTHROUGH RECOVERABLESTATESWITHCLOCKSATTACHED: KNOWTHESTATE, ACTINSIDETHE CLOCK, ANDWHENTHECLOCKHASRUN, RECONSTRUCTFROMTHEESTATETHEUSER COULD NOT TAKE WITH THEM
§ 02 · FIRST PRINCIPLES The problem in plain English: the leaver process is a deletion engine
§ 03 · THELIFECYCLE The lifecycle of a deleted account: soft deletion, inactive state, hard deletion
§ 04 · WHATSURVIVESWHERE What survives where: mailbox, One Drive, Teams, audit logs and licences
§ 05 · BEATINGTHECLOCKS Preservation and collection before and after the clocks run
§ 06 · AFTERTHECLOCKS When the account is gone: reconstruction from the rest of the estate
§ 07 · THELEGALFRAME Leaver processes and preservation duties: the legal consequences
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE MAILBOX RETENTION DIRECTORY SOFT- DELETED / COUNTERPARTS + BACKUPS RESTORED SHARED STORES + DEVICES USER INACTIVE ONEDRIVE AUDIT / (HOLD) STAGE LAYER
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THERESTOREONDAYTWENTY - SIX EXAMPLE2 · THECUSTODIANREBUILTFROMEVERYONEELSE EXAMPLE3 · THELEAVERPROCESSTHATRANAFTERTHELETTER
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider ANDPOLICIES
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The deleted-account checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions IT deleted the account last week. Is the data gone? What is an inactive mailbox and how do we get one? The account was hard-deleted a year ago with no hold. What now? Our leaver process deleted a relevant account after the dispute began. How bad is it? Doesn't UK GDPR require us to delete leavers' data? Can we tell whether the opponent's deleted custodian is really unrecoverable?
§ 14 · REFERENCE Glossary Sources and authoritative references 31 · CPR Part 35: justice.gov.uk, Part DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
19 pages · 26 min read
17 pages · 25 min read
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
