{"id":18653,"date":"2022-03-30T09:36:09","date_gmt":"2022-03-30T09:36:09","guid":{"rendered":"https:\/\/www.backupassist.com\/blog\/?p=18653"},"modified":"2022-03-31T01:42:49","modified_gmt":"2022-03-31T01:42:49","slug":"can-you-bypass-recoverable-items","status":"publish","type":"post","link":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items","title":{"rendered":"Is it possible for a user to delete emails without a trace in Microsoft 365? Can a user bypass Recoverable Items?"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">TL;DR summary&nbsp;<\/h2>\n\n\n\n<p>We ran some experiments to see if it\u2019s possible to permanently delete emails without a trace. Here\u2019s what we found:&nbsp;<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Ordinary users cannot delete items \u201cwithout a trace.\u201d&nbsp;<\/li><li>Microsoft 365 in its default configuration is sufficient. You don\u2019t need to turn on Journaling or use any of the Enterprise features like Legal Hold.&nbsp;<\/li><li>A good backup solution for Microsoft 365, like <a rel=\"noreferrer noopener\" href=\"https:\/\/www.backupassist.com\/365\/overview\" target=\"_blank\">BackupAssist 365<\/a>, can capture deleted emails when configured to back up the Recoverable Items folder.&nbsp;<\/li><\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Why are people confused about this?&nbsp;<\/h2>\n\n\n\n<p>It\u2019s clear that if you run one of these kinds of solutions:&nbsp;<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Journaling in Exchange Online&nbsp;<\/li><li>Legal Hold&nbsp;<\/li><\/ol>\n\n\n\n<p>then every incoming and outgoing email to any mailbox will be captured. If you run a mail archiver on your mail gateway, then additionally, emails coming in and out of the domain will be captured there.&nbsp;<\/p>\n\n\n\n<p>However, what if you\u2019re not running any of these kinds of solutions? Is there a grey area here?&nbsp;<\/p>\n\n\n\n<p><strong>This article assumes you haven\u2019t turned on those enterprise features, and you\u2019re running Microsoft 365 (Office 365) in its default configuration. <\/strong>Is it still possible for your users to delete items without a trace?&nbsp;<\/p>\n\n\n\n<p>There is confusion about this topic because there are webpages that say this is possible. For instance, the article <a href=\"https:\/\/it.tufts.edu\/book\/export\/html\/1566\" target=\"_blank\" rel=\"noreferrer noopener\">Securely Deleting Email<\/a> published by Tufts University suggests that it\u2019s possible to securely delete and purge emails from your account, such that \u201cthey can no longer be recovered.\u201d It also gives instructions on how to purge your items from the Recoverable Items folder.&nbsp;<\/p>\n\n\n\n<p>This creates the impression that Recoverable Items can be bypassed.&nbsp;<\/p>\n\n\n\n<p>We ran through their process and gathered the results.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Our experiments and the results&nbsp;<\/h2>\n\n\n\n<p>We followed this process to examine whether the \u201csecurely deleting email\u201d procedure can work:&nbsp;<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Create a test email from an external domain.&nbsp;<\/li><li>Follow the instructions outlined in the Tufts University guide.&nbsp;<\/li><li>Configure BackupAssist 365 to back up the Recoverable Items folder.&nbsp;<\/li><li>Inspect the backup to see if the item, which should no longer exist, was captured in the backup.&nbsp;<\/li><\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Step 1:<\/strong> a test email was sent from an external domain to an account called \u201cbill.gates@rarenerds.com\u201d&nbsp;<\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/image.png\"><img loading=\"lazy\" decoding=\"async\" width=\"452\" height=\"246\" src=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/image.png\" alt=\"\" class=\"wp-image-18654\" style=\"width:226px;height:124px\" srcset=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/image.png 452w, https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/image-300x163.png 300w\" sizes=\"auto, (max-width: 452px) 100vw, 452px\" \/><\/a><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Step 2<\/strong>: we log in as <a href=\"mailto:bill.gates@rarenerds.com\" target=\"_blank\" rel=\"noreferrer noopener\">bill.gates@rarenerds.com<\/a> and follow the steps.&nbsp;<\/h3>\n\n\n\n<ol class=\"wp-block-list\"><li>Delete the email from Inbox. It now ends up in the Deleted Items folder.&nbsp;&nbsp;<\/li><\/ol>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-2a.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"366\" height=\"314\" src=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-2a.jpg\" alt=\"\" class=\"wp-image-18663\" style=\"width:275px;height:236px\" srcset=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-2a.jpg 366w, https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-2a-300x257.jpg 300w\" sizes=\"auto, (max-width: 366px) 100vw, 366px\" \/><\/a><\/figure><\/div>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\"><li>Delete the email from Deleted Items. It now ends up in Recoverable Items folder.&nbsp;<\/li><\/ol>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><a href=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-3a.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"358\" height=\"206\" src=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-3a.jpg\" alt=\"\" class=\"wp-image-18662\" style=\"width:358px;height:206px\" srcset=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-3a.jpg 358w, https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-3a-300x173.jpg 300w\" sizes=\"auto, (max-width: 358px) 100vw, 358px\" \/><\/a><\/figure><\/div>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\"><li>Delete the email from Recoverable Items. It is now \u201cpermanently deleted.\u201d&nbsp;<\/li><\/ol>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-4a.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"674\" height=\"458\" src=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-4a.jpg\" alt=\"\" class=\"wp-image-18661\" style=\"width:506px;height:344;\" srcset=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-4a.jpg 674w, https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-4a-300x204.jpg 300w\" sizes=\"auto, (max-width: 674px) 100vw, 674px\" \/><\/a><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Step 3:<\/strong> configure BackupAssist 365 to back up the mailbox and then run the backup.&nbsp;<\/h3>\n\n\n\n<p>You can <a href=\"https:\/\/www.backupassist.com\/365\/downloads\" target=\"_blank\" rel=\"noreferrer noopener\">download BackupAssist 365<\/a> and follow the instructions given to set up a backup of Microsoft 365. Here are our pointers:&nbsp;<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Make sure you check the \u201cDownload recoverable items\u201d checkbox when configuring the backup.&nbsp;&nbsp;<\/li><\/ol>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-5a.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"877\" height=\"668\" src=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-5a.jpg\" alt=\"\" class=\"wp-image-18660\" style=\"width:700px;height:533px;\" srcset=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-5a.jpg 877w, https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-5a-300x229.jpg 300w, https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-5a-768x585.jpg 768w\" sizes=\"auto, (max-width: 877px) 100vw, 877px\" \/><\/a><\/figure><\/div>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\"><li>Run the backup. You\u2019ll get a backup report showing the result \u2013 clearly here, 1 item was downloaded.<\/li><\/ol>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-6a.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"736\" height=\"652\" src=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-6a.jpg\" alt=\"\" class=\"wp-image-18659\" style=\"width:700px;height:620px;\" srcset=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-6a.jpg 736w, https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-6a-300x266.jpg 300w\" sizes=\"auto, (max-width: 736px) 100vw, 736px\" \/><\/a><\/figure><\/div>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\"><li>You can see in the progress information, 1 item was downloaded from Recoverable Items \/ Purges folder.&nbsp;<\/li><\/ol>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-7a.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"904\" height=\"534\" src=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-7a.jpg\" alt=\"\" class=\"wp-image-18658\" style=\"width:700px;height:413px;\" srcset=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-7a.jpg 904w, https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-7a-300x177.jpg 300w, https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-7a-768x454.jpg 768w\" sizes=\"auto, (max-width: 904px) 100vw, 904px\" \/><\/a><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Step 4:<\/strong> inspect the PST file.&nbsp;&nbsp;<\/h3>\n\n\n\n<p>If we open the backup PST file created by BackupAssist 365, we can see the purged item is correctly backed up.&nbsp;<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-8a.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"1000\" height=\"558\" src=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-8a.jpg\" alt=\"\" class=\"wp-image-18657\" style=\"width:700px;height:391px;\" srcset=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-8a.jpg 1000w, https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-8a-300x167.jpg 300w, https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-8a-768x429.jpg 768w\" sizes=\"auto, (max-width: 1000px) 100vw, 1000px\" \/><\/a><\/figure><\/div>\n\n\n\n<p>You can see clearly that the test email was eventually backed up and stored in the backup PST file, created by BackupAssist 365.&nbsp;<\/p>\n\n\n\n<p>There was no way for <a href=\"mailto:bill.gates@rarenerds.com\" target=\"_blank\" rel=\"noreferrer noopener\">bill.gates@rarenerds.com<\/a> to circumvent a good backup strategy!&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Out of scope: malicious action by the administrator&nbsp;<\/h2>\n\n\n\n<p>We have not examined the case where there is malicious action by the administrator. This is out of scope, because of the complexities of what an administrator can do \u2013 such as deleting the entire tenant, deleting the backups, and so on.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion&nbsp;<\/h2>\n\n\n\n<p>As demonstrated by our experiment, following the Tufts University guide does not cause emails to vanish without a trace. <strong>An ordinary user cannot \u201csecurely delete email\u201d and bypass company backup policies.<\/strong>&nbsp;<\/p>\n\n\n\n<p>Even Microsoft 365 in its default configuration will enable you to capture purged items via backup software such as BackupAssist 365.&nbsp;<\/p>\n\n\n\n<p>This will be very reassuring for business owners and corporate HR, who need to protect themselves from malicious employee action.&nbsp;<\/p>\n\n\n\n<p><strong>However, if you do not perform backups of Microsoft 365, then items will eventually disappear.<\/strong> Recoverable Items only stay there up to the Deleted Item retention time, which is <a href=\"https:\/\/docs.microsoft.com\/en-us\/exchange\/recipients\/user-mailboxes\/deleted-item-retention-and-recoverable-items-quotas?view=exchserver-2019\" target=\"_blank\" rel=\"noreferrer noopener\">14 days by default<\/a>. So, for a permanent copy of these deleted and purged items, we recommend using a backup solution for Microsoft 365, such as BackupAssist 365. BackupAssist 365 will also <a href=\"https:\/\/www.backupassist.com\/blog\/microsoft-365-backups-what-happens-to-the-backup-data-of-old-users-once-theyve-left-the-company-and-their-accounts-are-deleted\" target=\"_blank\" rel=\"noreferrer noopener\">retain backup data for users that have been deleted<\/a>, making it ideal for keeping historic data.&nbsp;<\/p>\n\n\n\n<p>If protecting your company from nefarious activities is a priority, then you can download a <a href=\"https:\/\/www.backupassist.com\/365\/downloads\" target=\"_blank\" rel=\"noreferrer noopener\">free 30 day trial of BackupAssist 365<\/a> and thwart such activities today!&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If nefarious employees want to cover their tracks, it might be tempting to delete incoming emails as soon as they\u2019re received, or outgoing emails as soon as they\u2019re sent. But will this actually work? Is it possible to bypass the Recoverable Items feature in Exchange Online?<\/p>\n","protected":false},"author":17,"featured_media":18671,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-18653","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Is it possible for a user to delete emails without a trace in Microsoft 365? Can a user bypass Recoverable Items? - Cyber Resilience Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Is it possible for a user to delete emails without a trace in Microsoft 365? Can a user bypass Recoverable Items? - Cyber Resilience Blog\" \/>\n<meta property=\"og:description\" content=\"If nefarious employees want to cover their tracks, it might be tempting to delete incoming emails as soon as they\u2019re received, or outgoing emails as soon as they\u2019re sent. But will this actually work? Is it possible to bypass the Recoverable Items feature in Exchange Online?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items\" \/>\n<meta property=\"og:site_name\" content=\"Cyber Resilience Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-03-30T09:36:09+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-03-31T01:42:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-bg.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1500\" \/>\n\t<meta property=\"og:image:height\" content=\"572\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Linus Chang\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Linus Chang\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items\"},\"author\":{\"name\":\"Linus Chang\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/#\/schema\/person\/e3b9b8dd4c91aac329df23310ea033be\"},\"headline\":\"Is it possible for a user to delete emails without a trace in Microsoft 365? Can a user bypass Recoverable Items?\",\"datePublished\":\"2022-03-30T09:36:09+00:00\",\"dateModified\":\"2022-03-31T01:42:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items\"},\"wordCount\":830,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-bg.jpg\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items\",\"url\":\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items\",\"name\":\"Is it possible for a user to delete emails without a trace in Microsoft 365? Can a user bypass Recoverable Items? - Cyber Resilience Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-bg.jpg\",\"datePublished\":\"2022-03-30T09:36:09+00:00\",\"dateModified\":\"2022-03-31T01:42:49+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#primaryimage\",\"url\":\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-bg.jpg\",\"contentUrl\":\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-bg.jpg\",\"width\":1500,\"height\":572},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.backupassist.com\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Is it possible for a user to delete emails without a trace in Microsoft 365? Can a user bypass Recoverable Items?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/#website\",\"url\":\"https:\/\/www.backupassist.com\/blog\/\",\"name\":\"Cyber Resilience Blog\",\"description\":\"Protect Your Cloud Data with BackupAssist\",\"publisher\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.backupassist.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/#organization\",\"name\":\"Cyber Resilience Blog\",\"url\":\"https:\/\/www.backupassist.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2019\/09\/BA-Logo-Full-Logo.svg\",\"contentUrl\":\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2019\/09\/BA-Logo-Full-Logo.svg\",\"caption\":\"Cyber Resilience Blog\"},\"image\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/#\/schema\/person\/e3b9b8dd4c91aac329df23310ea033be\",\"name\":\"Linus Chang\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2ec8afa11de6866934a194c35c8d592faf45ced0ee666b40654a1752103bae17?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2ec8afa11de6866934a194c35c8d592faf45ced0ee666b40654a1752103bae17?s=96&d=mm&r=g\",\"caption\":\"Linus Chang\"},\"url\":\"https:\/\/www.backupassist.com\/blog\/author\/nithiyananda-soosai\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Is it possible for a user to delete emails without a trace in Microsoft 365? Can a user bypass Recoverable Items? - Cyber Resilience Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items","og_locale":"en_US","og_type":"article","og_title":"Is it possible for a user to delete emails without a trace in Microsoft 365? Can a user bypass Recoverable Items? - Cyber Resilience Blog","og_description":"If nefarious employees want to cover their tracks, it might be tempting to delete incoming emails as soon as they\u2019re received, or outgoing emails as soon as they\u2019re sent. But will this actually work? Is it possible to bypass the Recoverable Items feature in Exchange Online?","og_url":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items","og_site_name":"Cyber Resilience Blog","article_published_time":"2022-03-30T09:36:09+00:00","article_modified_time":"2022-03-31T01:42:49+00:00","og_image":[{"width":1500,"height":572,"url":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-bg.jpg","type":"image\/jpeg"}],"author":"Linus Chang","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Linus Chang","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#article","isPartOf":{"@id":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items"},"author":{"name":"Linus Chang","@id":"https:\/\/www.backupassist.com\/blog\/#\/schema\/person\/e3b9b8dd4c91aac329df23310ea033be"},"headline":"Is it possible for a user to delete emails without a trace in Microsoft 365? Can a user bypass Recoverable Items?","datePublished":"2022-03-30T09:36:09+00:00","dateModified":"2022-03-31T01:42:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items"},"wordCount":830,"commentCount":0,"publisher":{"@id":"https:\/\/www.backupassist.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#primaryimage"},"thumbnailUrl":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-bg.jpg","inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items","url":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items","name":"Is it possible for a user to delete emails without a trace in Microsoft 365? Can a user bypass Recoverable Items? - Cyber Resilience Blog","isPartOf":{"@id":"https:\/\/www.backupassist.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#primaryimage"},"image":{"@id":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#primaryimage"},"thumbnailUrl":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-bg.jpg","datePublished":"2022-03-30T09:36:09+00:00","dateModified":"2022-03-31T01:42:49+00:00","breadcrumb":{"@id":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#primaryimage","url":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-bg.jpg","contentUrl":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2022\/03\/rev-735-bg.jpg","width":1500,"height":572},{"@type":"BreadcrumbList","@id":"https:\/\/www.backupassist.com\/blog\/can-you-bypass-recoverable-items#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.backupassist.com\/blog"},{"@type":"ListItem","position":2,"name":"Is it possible for a user to delete emails without a trace in Microsoft 365? Can a user bypass Recoverable Items?"}]},{"@type":"WebSite","@id":"https:\/\/www.backupassist.com\/blog\/#website","url":"https:\/\/www.backupassist.com\/blog\/","name":"Cyber Resilience Blog","description":"Protect Your Cloud Data with BackupAssist","publisher":{"@id":"https:\/\/www.backupassist.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.backupassist.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.backupassist.com\/blog\/#organization","name":"Cyber Resilience Blog","url":"https:\/\/www.backupassist.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.backupassist.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2019\/09\/BA-Logo-Full-Logo.svg","contentUrl":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2019\/09\/BA-Logo-Full-Logo.svg","caption":"Cyber Resilience Blog"},"image":{"@id":"https:\/\/www.backupassist.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.backupassist.com\/blog\/#\/schema\/person\/e3b9b8dd4c91aac329df23310ea033be","name":"Linus Chang","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.backupassist.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/2ec8afa11de6866934a194c35c8d592faf45ced0ee666b40654a1752103bae17?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2ec8afa11de6866934a194c35c8d592faf45ced0ee666b40654a1752103bae17?s=96&d=mm&r=g","caption":"Linus Chang"},"url":"https:\/\/www.backupassist.com\/blog\/author\/nithiyananda-soosai"}]}},"_links":{"self":[{"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/posts\/18653","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/comments?post=18653"}],"version-history":[{"count":8,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/posts\/18653\/revisions"}],"predecessor-version":[{"id":18674,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/posts\/18653\/revisions\/18674"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/media\/18671"}],"wp:attachment":[{"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/media?parent=18653"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/categories?post=18653"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/tags?post=18653"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}