Exchange Online : Recover email for "ex-employee" with Purview/eDiscovery

I had a scenario where we had an employee that had left and then returned months later, now under usual Exchange operations the email would have been deleted in the 14-30 day window after the account was disabled/deleted.

This scenario requires Litigation Hold to be enabled which means the following is true:

Emails are preserved even if the user or admin attempts to delete them

The hold overrides normal retention policies and prevents permanent deletion

Items remain recoverable through eDiscovery tools regardless of the mailbox's active status

If you do not have litigation hold enabled its game over, the mailbox data has gone, but if you do have litigation hold enabled you can continue on with this post.

Flowchart for Blog Post

A good flowchart is worth a thousand words.

Obtain the PST file

You will need eDiscovery (under Solutions > e-Discovery) frim this URL  https://purview.microsoft.com/ediscovery then you need Cases:

When in Cases, you will need to create a new one:

You then need to give that case a name:

That will then create a new case, we need to click on that case:

Then we need to create a new search, this will look for content lined to the mailbox:

This will then require a name as before, so I will use "Search Data" as below:

Then we need to add a data source as below, for from that search choose under Data Source, the + icon then Add Data Source.....

Then we need to find our user "James Bond" and you will notice the account is "inactive" as the account has been disabled so that is all good, put a tick in the box and then click manage:

You will then see the source listed under Sources like this : 

We need all the contents of the mailbox in in the query so you can leave the query blank and then choose "Run Query" as below:

That query should take a few moments to run then in the statistics option this will confirm the volume of data as below:

Now we need the export the data with the export button:

When you click export you will need to give it a name and then choose "indexed items that match your search query" which if you remember was everything:

Then finally under export options untick "separate PST files" so you just get one and then click export:

This will hand this to the process manager which is the final tab on the same page:

You then need to wait for the process manager to report the data has been exported as below:

Then when you click on the Export task you can select the "PST" files and then click download to get the data locally:

When you click the download this will download the PST files in the form of a zip file and the download will not be quick it can take some time.

Import PST file (to Target Mailbox)

When you have a time all the relevant files, these files should be downloaded to the folder of your choice - we now need to upload these files to the target mailbox, this will also be Purview but from the Solutions>Data Lifecycle Management>Import from this URL : https://purview.microsoft.com/datalifecyclemanagement/import

Then from here we will need a new import with the New import job option:

Then it needs a name which can only be in lowercase with numbers, once you have a name click next:

We want to upload data, so choose that an next:

Then we need to complete the upload using AZCopy then we also need to complete a mappings file which you can get a sample mapping files from the URL here as a sample

First we need to upload the data with AZCopy, so get the URL from the link on that website by clicking the button, then you will need to get AZCopy to upload the file, lets go though this now.

AZCopy Upload

We now need to copy or upload the files

Exchange.001.pst
Exchange.002.pst
Exchange.003.pst

Using AZCopy and the SAS URL with this command:

azcopy copy "C:\temp\out\*" "<sas-url>" --include-pattern="*.pst"

This will then copy all the PST files from that folder to the SAS URL location as you can see here:

Wait for the summary to say all has been transferred, as below:

Then we can move on to the mapping file.

Mapping File

This also required a mappings file, which will need to be in the format of CSV with the data correct, so in this case of our example that would look like this:

Note: If you are uploading to Exchange Online please do not specify the attribute FilePath, this will cause errors simply leave it blank and put a comma

Workload,FilePath,Name,Mailbox,IsArchive,TargetRootFolder
Exchange,,Exchange.001.pst,james.bond@bythepowerofgreyskull.com,FALSE,
Exchange,,Exchange.002.pst,james.bond@bythepowerofgreyskull.com,FALSE,
Exchange,,Exchange.003.pst,james.bond@bythepowerofgreyskull.com,FALSE,

This will then need to be saved as that CSV file from say notepad with UTF8 encoding

You can then see that file in with all the PST files as well:

The you need to provide that file on the mapping screen upload the CSV and then validate, it should show green as below, if you can an error you need to correct those errors.

Then on the final screen you can review you information and then submit that job as below:

Once submitted the job you will get a confirmation as below:

Then from the main "import" screen you will now see that job in "Analysis in process" as below:

This will take some time dependant on the data then when this is completed you will see "analysis completed" but that is not complete, you now need to import the data to the mailbox.

Next but a tick in the import and then choose "Import to Office 365" as below:

You will then see a badly rendered graph of the data, here we want "No, I want to import everything"

You will then get to the review where you need to Submit for import:

This will then confirm the job has been submitted as below:

The import will now change to import in progress as below:

If you click on the "dataimport" job you will see the import status per PST file as below:

You will also need to give this some time to import the data, do not sit their clicking refresh, check back hourly this is not quick at all, it will end up reporting all is well as below:

When the import has completed you will then have your restore completed into Exchange Online,