How to Restore Deleted Outlook Emails After a Hack
If your Outlook account was compromised, deleted messages may still be recoverable through Microsoft 365 retention tools, the Deleted Items folder, or your admin settings.
The key is to act fast, because recovery options shrink as time passes and attackers keep changing mailbox rules.
What happens when hackers delete Outlook emails?
Attackers often delete messages to hide evidence, disrupt business operations, or remove security alerts from Microsoft, banks, and other services.
In Exchange Online and Outlook.com, deleted mail may move through several stages: Deleted Items, Recoverable Items, and permanent removal based on retention policies.
Understanding this path matters because the recovery method depends on where the email was deleted from and whether you still have access to the account.
- Deleted Items: Regular deleted mail that users can restore quickly.
- Recoverable Items: Messages that can often be restored after emptying Deleted Items.
- Purged mail: Email removed from recoverable storage, subject to retention and legal hold settings.
First secure the account before trying to recover mail
Before you restore anything, stop the attacker from deleting more messages or altering mailbox settings.
If you skip this step, recovered mail may disappear again within minutes.
Immediate security steps
- Change the Microsoft account password immediately.
- Enable two-factor authentication, preferably with Microsoft Authenticator.
- Sign out of all sessions and revoke unknown devices.
- Check for suspicious forwarding rules and inbox rules.
- Review recovery email addresses and phone numbers for changes.
- Scan your device for malware or keyloggers.
If this is a work account, contact your Microsoft 365 administrator or IT security team right away.
Admins can often trace mailbox activity, remove malicious rules, and restore deleted data more effectively than end users can.
How to restore deleted Outlook emails after a hack from Deleted Items
The simplest recovery path is the Deleted Items folder.
If the hacker only used standard deletion, the messages may still be there.
Outlook on the web
- Open Outlook and go to Deleted Items.
- Select the messages you want back.
- Choose Restore or move them to the original folder.
Outlook desktop app
- Open the Deleted Items folder.
- Right-click the message and choose Move or drag it back to Inbox.
- If the item is missing, use the recovery option if available.
This step is fast, but it only works if the mail was not permanently purged.
Restore mail from the Recoverable Items folder
When Outlook or Exchange users empty Deleted Items, messages may still remain in the Recoverable Items area for a limited time.
This is often the most useful step after a hack because attackers commonly assume emptying Deleted Items is enough.
For Outlook on the web
- Open Deleted Items.
- Select Recover items deleted from this folder.
- Choose the messages and select Restore.
For Outlook desktop
In Microsoft Outlook for Windows, the command may appear as Recover Deleted Items From Server when connected to Microsoft 365 or Exchange.
If you see it, open the recoverable list, select the emails, and restore them.
Recovery is limited by retention settings.
In many Microsoft 365 environments, deleted items remain recoverable for a default period unless an administrator changed the policy.
Check for malicious mailbox rules and forwarding
Hackers frequently create hidden rules that auto-delete messages, forward mail externally, or mark security notifications as read.
If you restore email but ignore these rules, the attacker can immediately remove the mail again.
What to inspect
- Inbox rules that delete or move messages.
- Forwarding addresses you do not recognize.
- Automatic replies that expose account information.
- Blocked senders or safe sender lists changed without permission.
In Outlook on the web, review Settings > Mail > Rules and Forwarding.
In Microsoft 365, administrators should also check transport rules, audit logs, and sign-in history through the Microsoft Entra admin center and Microsoft Purview.
Ask your Microsoft 365 admin to recover permanently deleted emails
If emails are missing from Deleted Items and Recoverable Items, an administrator may still be able to recover them depending on the tenant’s retention configuration, litigation hold, or eDiscovery policies.
This is especially important for business accounts where deleted mail may be preserved in compliance archives.
Admins can use tools such as:
- Microsoft Purview eDiscovery for searching preserved content.
- Exchange Admin Center for mailbox recovery settings.
- PowerShell for mailbox and retention investigation.
- Audit logs to identify who deleted or moved messages.
If the account is under retention or hold, deleted mail may still be recoverable even after the visible folders are empty.
Can you restore Outlook emails after a hack without admin access?
Yes, but only up to the limits of the mailbox and service settings.
Personal Outlook.com users can often recover mail from Deleted Items or the recoverable folder without admin help.
However, once mail is permanently removed or retention has expired, recovery becomes difficult or impossible without Microsoft support or organizational backup systems.
If you are using a work account and do not have admin rights, gather evidence and escalate quickly.
Note message subjects, approximate deletion times, suspicious login locations, and any mailbox changes you found.
What to do if the account was used to send phishing emails
Hackers may use a compromised Outlook account to send spam or phishing messages to your contacts.
That creates a second problem: even if you recover deleted mail, the account may be flagged or blocked for abusive activity.
- Warn contacts not to open suspicious email from your address.
- Check Sent Items and Deleted Items for unauthorized messages.
- Review Microsoft security alerts and recent sign-in activity.
- Reset passwords on any accounts linked to the compromised mailbox.
This matters because attackers often target password reset emails, financial alerts, and cloud service notifications immediately after taking over a mailbox.
How to reduce the chance of losing Outlook emails again
Once the mailbox is stable, tighten your security and backup posture.
Outlook is not a substitute for a separate backup system, and Microsoft retention settings are not the same as a user-controlled archive.
- Use a unique password stored in a password manager.
- Keep MFA enabled for Microsoft 365, Outlook.com, and related apps.
- Review mailbox rules monthly.
- Export critical mail or use a compliant backup solution if your organization allows it.
- Monitor sign-in alerts and unusual mailbox activity.
- Keep devices patched and protected with reputable endpoint security.
For organizations, combine Microsoft 365 retention, Purview policies, and backup software that supports Exchange Online restore workflows.
When to contact Microsoft Support
Contact Microsoft Support if you cannot access the account, the mailbox was compromised on a personal Outlook.com account, or recovery options are missing even though deletion was recent.
For business tenants, Microsoft 365 admins should open support cases when mailbox corruption, retention issues, or service-side problems appear likely.
Have the following ready:
- Approximate time the hack was discovered.
- Example message subjects or senders.
- Screenshot of missing folders or suspicious rules.
- Sign-in history and location data.
- Whether the account is personal, family, or Microsoft 365 business.
Those details can speed up diagnosis and improve the chance of restoring deleted Outlook emails after a hack.