Restoring Deleted Google Workspace

• deleted G Suite emails can be recovered within <60 days. After they’re deleted emails are placed in the Trash label where Google keeps them for 30 days unless the Trash is emptied earlier. After they’re removed from the Trash, Google keeps them additionally for 30 days
• deleted Google Drive, Shared Drives files, and (entire) Shared Drives can be recovered within <55 days. The retention workflow is essentially the same as for email messages
• users can restore deleted Contacts and Calendar events within 30 days after the deletion
• deleted G Suite user accounts (including G Suite administrator accounts) can be recovered by G Suite admins within 20 days
• there are no built-in G Suite tools to recover deleted G Suite domains (entire organizational accounts), but in some cases, Google may be able to help recover them.

Organizations that use Google Vault or 3rd party G Suite backup tools are typically able to restore some or all data beyond the standard retention limits – see the last section for Google Vault and backup tools overview.

First 30 Days

Users can restore G Suite emails and files deleted from (Shared) Drives themselves within 30 days after deletion. They need to open the Trash label/folder, find the lost item and click restore.

Next 25 Days

G Suite admins can restore files/emails within 25 after the items were removed from trashed automatically, or if the trash folder/label was emptied manually. Admins should:

1. Log in as an admin and go to the G Suite Admin panel
2. Go to Admin console -> “Users”
3. Find the user in the list and click “More” -> “Restore data” after you located the user.
4. You cannot search for or preview individual files. Instead, you need to select the date from when you want to restore (either a range or a single date). All deleted files/messages in the date range will be restored.
5. Specify the data (Drive or Gmail) and click “Restore”

Final 5 days

Administrators can use G Suite Email Audit API to restore emails deleted from Trash <30 days ago, therefore adding 5 extra days to the 25 days limit in the Admin panel.

The Audit API does not enable searching and downloading individual email messages. Instead, administrators need to download (export) entire user mailbox accounts in mbox format, with deleted email messages included in the export.

Below is a short description of the key steps to export deleted Gmail messages using Audit API (detailed G Suite Email Audit API instructions are available here.

1. Upload an encryption key to your domain
2. Request a mailbox export using Audit API
3. Check the status of the export request via Audit API. The mailbox export preparation can take up to 10 days depending on the export size. When the export is ready you will receive “Done” status along with the link you should use to download the file.
4. Download the encrypted mailbox export file and decrypt it.
5. Open the decrypted mbox file to access email messages

Audit API only allows to restore missing Gmail messages (not Drive files).

Recovery Beyond 55-60 days limit

Google states that they don’t keep email messages and Drive files deleted more than 55-60 days ago (30 days in Trash and 25-30 days in Admin panel/Audit API recovery).

There are (rare) cases where Google is able to help organizations recover deleted data beyond the official time limits. See section #5 for more details.

1. Sign in Admin Panel using an admin account
2. Go to Apps -> G Suite -> Drive and Docs

1. Use Deleted Status filter to show only deleted Shared Drives

1. Select the Shared Drive you want to restore and click Restore. Make sure you specify the time period from the date (or before) the Shared Drive was deleted and today (the day when you execute the restore)

Shared Drives deleted 25+ days ago will not be visible in the list of deleted Drives, and the standard recovery does not allow restoring them (check section #5 for alternative options).

1. Sign in Admin Panel using an admin account
2. Head to Users List
3. Add a “Recently Deleted” filter to see deleted users that can be restored

1. Select the user(s) and click restore

According to Google, G Suite user data is permanently deleted at the end of the 20 days period and cannot be recovered.

See the last section in this post for a description of your options for recovering G Suite data deleted beyond the “official” recoverable period.

1. Go to the G Suite Contacts app
2. Select Undo changes option in the top right corner

1. Select the date & time they need to roll back (before the lost contacts were deleted)

Similarly to contacts, you can recover deleted G Suite calendar events can within 30 days.

After 30 days from their deletion (or earlier if the Trash bin is emptied), the calendar events are deleted permanently and cannot be recovered using the standard methods.

To restore deleted G Suite calendar events:

1. Open the trash folder in the G Suite Calendar app

1. Select the event and click recover

No Versioning

Only the most recent versions of files/email versions can be recovered. For example, if a Docx document file was accidentally overwritten, there will be no way to restore the right version in G Suite admin panel.

No Way to Confirm Restore

Administrators need to be in communication with users to check whether files and/or messages appeared in the user’s Gmail/Drive and confirm the recovery. Restoring large amounts of data may take some time (a few hours) and the admin has no tools to check if the recovery is completed or is still in progress.

No Individual Items Recovery

The administrator has no search or preview options – all items from a selected date range are recovered in bulk, and individual files/messages recovery is unavailable.

Only in-place Recovery

Drive files and messages are restored to their original locations and you cannot specify an alternative location for the restored data. This means that some of the files/messages that you’re not trying to recover may be replaced. We recommend making a copy of users’ files/messages before attempting a recovery.

Based on Afi customers’ experience & Afi research, less than 10% of G Suite customers that try to recover lost data beyond the standard retention time were able to do so with the help of Google support.

In this section, we describe the 2 main options that may help recover data when the standard recovery methods don’t work.

Google Support: Time Is of the Essence

One approach is to reach out to Google support and request data recovery.

Quick support reaction is critical because the changes that Google still has the deleted data are higher in the first days after the data loss.

Unfortunately, in most cases, G Suite customers experience a 2-3 days response time, which is often too long.

In one example an organization’s G Suite account was deleted by Google, without prior notification. In response to the recovery request a G Suite community product export mentions that the recovery of permanently deleted G Suite domain data is not possible 24 hours after the deletion.

Google Support: Contact via Phone

G Suite support is notoriously hard to reach via phone. Below is the list of Google Workspace support phone numbers that you can use.

Google Support: Contact via Chat and Twitter

In this example, Google deleted a G Suite account because a company failed to respond to an email from Google asking for confirmation of domain ownership.

After their Google Workspace domain got deleted, the company was unable to speak to a live support person over the phone and instead contacted Google via G Suite support chat (requires another active G Suite account), as well as via the official G Suite Twitter account (see below).

It is not clear whether the Twitter message or support chat was more effective, but the company’s G Suite data was successfully restored by Google in 10 days.

Suing Google Over Lost Data

Even if the G Suite support is unable to react quickly, or communicate internally with Google infrastructure and operations teams, your data may still be recoverable for some time after the expiration of the official retention periods.

You can attempt to force Google to recover your G Suite data by getting a court subpoena. There is one known case where a startup tried to recover their data in court, after failing to restore it via Google support.

A California-based Musey Inc. accidentally deleted their G Suite domain on June 9th, 2019. Here is the summary of the events:

• Musey contacted Google support on June 9th, 2019 within 1 hour after the accident. The support rep assured them that Google will look into the problem, which lead Musey to believe that the issue will be resolved.
• Over 3 days following the initial request Google did not take any steps to recover the data and provided no feedback
• Musey team tried to get an update from the Google support team, repeatedly sending chat support requests and calling the G Suite support line
• Approx. 10 days (June 19th, 2019) after the initial request Google sent Musey admin an email confirming that the data was erased and no recovery is possible
• 9 days later (on June 28th, 2019) Musey filed a request for an injunction, in an attempt to subpoena their G Suite data

Unfortunately for Musey, the court didn’t rule in their favor, Google did not restore their G Suite data and the company eventually went out of business (the website is no longer live).

Google Vault

Google Vault enables infinite retention of all G Suite email messages, Drive files and Meet/Chats messages (deleted or modified).

To have the protection in place, you need to configure Vault retention policies specifying which applications to backup, up, and for how long the data should be retained.

Important limitations of Google Vault recovery include:

• Gmail messages missing from retention policies (users report that Vault fails to retain <1% of G Suite Gmail deleted emails)
• deleted data cannot be recovered from deleted G Suite users (Vault erases data when users are deleted from G Suite)
• no versions are retained (only the last states of files can be recovered), leaving a significant gap (Vault will not help in case of accidental overwrites or ransomware)
• no folder structure is preserved for (Shared) Drives, complicating the recovery process and making it impractical in case of medium to large amounts of data stored in 100s or 1000s directories.

See our other blog post describing the pros and cons of using Google Vault as a G Suite data recovery option.

Third-party G Suite backup tools

There are approximately 20 G Suite backup providers that enable different levels of restore precision and flexibility. Key differences between the options include:

• The granularity of browse and restore (ability to search and preview individual lost items before restoring)
• Completeness of restored items (sharing and access permissions, labels, and directory structures)
• User self-service search & recovery, granular administrator, and support staff roles with different access level

Check our other posts to learn more about how you can use Google Vault to recover Gmail messages and Drive files or compare the most popular 3rd party G Suite backup tools.