Restoring Deleted Google Workspace

Restoring Deleted Google Workspace
User Accounts, Emails & Files

At a Glance

  • Deleted Google Workspace (G Suite) user accounts and data can be recovered within 30-60 days with standard Google recovery tools (the recovery window depends on the data type)
  • To recover deleted Google Workspace emails and files beyond the standard recovery window limits, you may try to contact Google support, obtain a subpoena or get in touch with the Google infrastructure team

Google Workspace includes basic data recovery capabilities that can help you restore deleted emails, users, files, and Shared Drives even if you don’t have a third-party backup solution or active Google Vault policies.

In this blog post, we describe restoring options available for Google Workspace data, focusing on the built-in “bare” G Suite recovery tools (without third-party backup). If you’d like to learn about third-party Google Workspace backup & recovery tools, check out this blog post.

G Suite Standard Recovery

In short, the chances of restoring G Suite data using standard Google recovery heavily depend on how much time has passed since the items were deleted/lost. With standard G Suite recovery you are limited to 30-60 days before data is permanently deleted:

  • deleted G Suite emails can be recovered within <60 days. After they’re deleted emails are placed in the Trash label where Google keeps them for 30 days unless the Trash is emptied earlier. After they’re removed from the Trash, Google keeps them additionally for 30 days
  • deleted Google Drive, Shared Drives files, and (entire) Shared Drives can be recovered within <55 days. The retention workflow is essentially the same as for email messages
  • users can restore deleted Contacts and Calendar events within 30 days after the deletion
  • deleted G Suite user accounts (including G Suite administrator accounts) can be recovered by G Suite admins within 20 days
  • there are no built-in G Suite tools to recover deleted G Suite domains (entire organizational accounts), but in some cases, Google may be able to help recover them.
Partial recovery using built-in G Suite tools is possible within <60 days of deletion
G Suite deleted data recovery limits

Organizations that use Google Vault or 3rd party G Suite backup tools are typically able to restore some or all data beyond the standard retention limits – see the last section for Google Vault and backup tools overview.

Restore G Suite Emails & Drive Files

As discussed above, the maximum “standard” recovery period for email messages and Drive files is 60 days.

G Suite emails can be recovered within 60 days, Drive files can be recovered within 55 days
G Suite files and emails recovery limits
First 30 Days

Users can restore G Suite emails and files deleted from (Shared) Drives themselves within 30 days after deletion. They need to open the Trash label/folder, find the lost item and click restore.

Next 25 Days

G Suite admins can restore files/emails within 25 after the items were removed from trashed automatically, or if the trash folder/label was emptied manually. Admins should:

  1. Log in as an admin and go to the G Suite Admin panel
  2. Go to Admin console -> “Users”
  3. Find the user in the list and click “More” -> “Restore data” after you located the user.
  4. You cannot search for or preview individual files. Instead, you need to select the date from when you want to restore (either a range or a single date). All deleted files/messages in the date range will be restored.
  5. Specify the data (Drive or Gmail) and click “Restore”
Final 5 days

Administrators can use G Suite Email Audit API to restore emails deleted from Trash <30 days ago, therefore adding 5 extra days to the 25 days limit in the Admin panel.

The Audit API does not enable searching and downloading individual email messages. Instead, administrators need to download (export) entire user mailbox accounts in mbox format, with deleted email messages included in the export.

Below is a short description of the key steps to export deleted Gmail messages using Audit API (detailed G Suite Email Audit API instructions are available here.

  1. Upload an encryption key to your domain
  2. Request a mailbox export using Audit API
  3. Check the status of the export request via Audit API. The mailbox export preparation can take up to 10 days depending on the export size. When the export is ready you will receive “Done” status along with the link you should use to download the file.
  4. Download the encrypted mailbox export file and decrypt it.
  5. Open the decrypted mbox file to access email messages

Audit API only allows to restore missing Gmail messages (not Drive files).

Recovery Beyond 55-60 days limit

Google states that they don’t keep email messages and Drive files deleted more than 55-60 days ago (30 days in Trash and 25-30 days in Admin panel/Audit API recovery).

There are (rare) cases where Google is able to help organizations recover deleted data beyond the official time limits. See section #5 for more details.

Recover deleted Shared (Team) Drives

Shared Drives cannot be deleted unless they are empty (Shared Drive delete button is greyed out if it has files). Therefore admins/users first delete Shared Drives files (moving them to the trash) and then they can delete Shared Drives themselves. When Shared Drive is deleted, the Trash folder is also removed. To restore the data you need to recover the deleted Shared Drive, and all its files deleted <25 days ago will be restored as well (files deleted 25+ days ago won’t be recovered).G Suite Shared Drives deleted within 25 days can be restored in the Admin panel using the following steps:

  1. Sign in Admin Panel using an admin account
  2. Go to Apps -> G Suite -> Drive and Docs
G Suite emails can be recovered within 60 days, Drive files can be recovered within 55 days
View G Suite drives list
  1. Use Deleted Status filter to show only deleted Shared Drives
G Suite emails can be recovered within 60 days, Drive files can be recovered within 55 days
Filter deleted Shared drives
  1. Select the Shared Drive you want to restore and click Restore. Make sure you specify the time period from the date (or before) the Shared Drive was deleted and today (the day when you execute the restore)
G Suite emails can be recovered within 60 days, Drive files can be recovered within 55 days
Recover deleted G Suite shared drive

Shared Drives deleted 25+ days ago will not be visible in the list of deleted Drives, and the standard recovery does not allow restoring them (check section #5 for alternative options).

Recover deleted G Suite user accounts

G Suite user accounts deleted within 20 days can be restored in the Admin panel. The process is the same for regular G Suite users as well as for deleted administrator G Suite accounts recovery:

  1. Sign in Admin Panel using an admin account
  2. Head to Users List
  3. Add a “Recently Deleted” filter to see deleted users that can be restored
You need to select the filter to see deleted users that can be restored
Filter deleted G Suite users
  1. Select the user(s) and click restore
You need to select the filter to see deleted users that can be restored
Recover deleted G Suite user

According to Google, G Suite user data is permanently deleted at the end of the 20 days period and cannot be recovered.

See the last section in this post for a description of your options for recovering G Suite data deleted beyond the “official” recoverable period.

Recover deleted Contacts & Calendars

Deleted Contacts can be restored back within 30 days after they are deleted. Users can roll back their contact list to a specific state within the last 30 days, which will restore any contacts deleted between now and the restored state. At the same time, the rollback will delete contacts created between the 2 states. There is no single contact recovery option available in “bare” G Suite. To roll back the state of the contact list in order to recover deleted G Suite contacts users need to:

  1. Go to the G Suite Contacts app
  2. Select Undo changes option in the top right corner
You need to select the filter to see deleted users that can be restored
Recover deleted G Suite contacts
  1. Select the date & time they need to roll back (before the lost contacts were deleted)

Similarly to contacts, you can recover deleted G Suite calendar events can within 30 days.

After 30 days from their deletion (or earlier if the Trash bin is emptied), the calendar events are deleted permanently and cannot be recovered using the standard methods.

To restore deleted G Suite calendar events:

  1. Open the trash folder in the G Suite Calendar app
You need to select the filter to see deleted users that can be restored
Recover deleted G Suite Calendar
  1. Select the event and click recover

Built-in Recovery Limitations

The built-in G Suite recovery available in the Admin panel has important limitations, in addition to the limited retention period.

No Versioning

Only the most recent versions of files/email versions can be recovered. For example, if a Docx document file was accidentally overwritten, there will be no way to restore the right version in G Suite admin panel.

No Way to Confirm Restore

Administrators need to be in communication with users to check whether files and/or messages appeared in the user’s Gmail/Drive and confirm the recovery. Restoring large amounts of data may take some time (a few hours) and the admin has no tools to check if the recovery is completed or is still in progress.

No Individual Items Recovery

The administrator has no search or preview options – all items from a selected date range are recovered in bulk, and individual files/messages recovery is unavailable.

Only in-place Recovery

Drive files and messages are restored to their original locations and you cannot specify an alternative location for the restored data. This means that some of the files/messages that you’re not trying to recover may be replaced. We recommend making a copy of users’ files/messages before attempting a recovery.

G Suite Data Recovery Beyond Standard Limits

The chances of restoring the data beyond G Suite retention time periods are small. But organizations that lost critical data must be willing to take the smallest chances.

Less than 10% of Google Workspace (G Suite) customers that try to recover lost data beyond the standard retention are able to get their data back

Based on Afi customers’ experience & Afi research, less than 10% of G Suite customers that try to recover lost data beyond the standard retention time were able to do so with the help of Google support.

In this section, we describe the 2 main options that may help recover data when the standard recovery methods don’t work.

Google Support: Time Is of the Essence

One approach is to reach out to Google support and request data recovery.

Quick support reaction is critical because the changes that Google still has the deleted data are higher in the first days after the data loss.

Unfortunately, in most cases, G Suite customers experience a 2-3 days response time, which is often too long.

In one example an organization’s G Suite account was deleted by Google, without prior notification. In response to the recovery request a G Suite community product export mentions that the recovery of permanently deleted G Suite domain data is not possible 24 hours after the deletion.

Google Product Expert: once a G Suite account/domain is deleted… [data] is purged after 24h and is lost forever.

Google Support: Contact via Phone

G Suite support is notoriously hard to reach via phone. Below is the list of Google Workspace support phone numbers that you can use.

Google G Suite customer global service support phone number is +1 (646) 257 4500, and it is available 24/7. Below is the list of all English-speaking G Suite support service phone numbers that you can try to reach.

Country Phone number Hours Language
Australia 1800-726-151 24/7 English
Canada 1-877-355-5787 24/7 English
Czech Republic 800-500-361 24/7 English
Denmark 80-603-148 24/7 English
Hong Kong 307-13746 24/7 English
Ireland 1800-812-105 24/7 English
Israel 1-809-303156 24/7 English
Malaysia 1-800-887-774 24/7 English
New Zealand 0800-957-854 24/7 English
Poland 800-702-429 24/7 English
Romania 0800-896-723 24/7 English
Singapore 1800-415-5514 24/7 English
South Africa 0800-000-773 24/7 English
United Arab Emirates 8000-444-8847 24/7 English
United Kingdom 0800-169-0455 24/7 English
United States 1-877-355-5787 24/7 English
Google Support: Contact via Chat and Twitter

In this example, Google deleted a G Suite account because a company failed to respond to an email from Google asking for confirmation of domain ownership.

After their Google Workspace domain got deleted, the company was unable to speak to a live support person over the phone and instead contacted Google via G Suite support chat (requires another active G Suite account), as well as via the official G Suite Twitter account (see below).

One customer was able to get in touch with Google support via the official G Suite account twitter.com/gsuite

It is not clear whether the Twitter message or support chat was more effective, but the company’s G Suite data was successfully restored by Google in 10 days.

Suing Google Over Lost Data

Even if the G Suite support is unable to react quickly, or communicate internally with Google infrastructure and operations teams, your data may still be recoverable for some time after the expiration of the official retention periods.

You can attempt to force Google to recover your G Suite data by getting a court subpoena. There is one known case where a startup tried to recover their data in court, after failing to restore it via Google support.

A California-based Musey Inc. accidentally deleted their G Suite domain on June 9th, 2019. Here is the summary of the events:

  • Musey contacted Google support on June 9th, 2019 within 1 hour after the accident. The support rep assured them that Google will look into the problem, which lead Musey to believe that the issue will be resolved.
  • Over 3 days following the initial request Google did not take any steps to recover the data and provided no feedback
  • Musey team tried to get an update from the Google support team, repeatedly sending chat support requests and calling the G Suite support line
  • Approx. 10 days (June 19th, 2019) after the initial request Google sent Musey admin an email confirming that the data was erased and no recovery is possible
  • 9 days later (on June 28th, 2019) Musey filed a request for an injunction, in an attempt to subpoena their G Suite data

Unfortunately for Musey, the court didn’t rule in their favor, Google did not restore their G Suite data and the company eventually went out of business (the website is no longer live).

Vault & Backup Tools

Organizations that use Google Vault and cloud backup tools should generally be able to restore lost data without the 30-60 days retention limits.

Google Vault

Google Vault enables infinite retention of all G Suite email messages, Drive files and Meet/Chats messages (deleted or modified).

To have the protection in place, you need to configure Vault retention policies specifying which applications to backup, up, and for how long the data should be retained.

Important limitations of Google Vault recovery include:

  • Gmail messages missing from retention policies (users report that Vault fails to retain <1% of G Suite Gmail deleted emails)
  • deleted data cannot be recovered from deleted G Suite users (Vault erases data when users are deleted from G Suite)
  • no versions are retained (only the last states of files can be recovered), leaving a significant gap (Vault will not help in case of accidental overwrites or ransomware)
  • no folder structure is preserved for (Shared) Drives, complicating the recovery process and making it impractical in case of medium to large amounts of data stored in 100s or 1000s directories.

See our other blog post describing the pros and cons of using Google Vault as a G Suite data recovery option.

Third-party G Suite backup tools

There are approximately 20 G Suite backup providers that enable different levels of restore precision and flexibility. Key differences between the options include:

  • The granularity of browse and restore (ability to search and preview individual lost items before restoring)
  • Completeness of restored items (sharing and access permissions, labels, and directory structures)
  • User self-service search & recovery, granular administrator, and support staff roles with different access level

Check our other posts to learn more about how you can use Google Vault to recover Gmail messages and Drive files or compare the most popular 3rd party G Suite backup tools.

 

 

 

 

 

 

 

 

 

 

 

 

 

 afi.ai vs. other Google Workspace backups

No Failures

Afi intelligently retries and reschedules backups to prevent backup failures

(Very) Fast

Based on new architecture, Afi is 2-3x faster than most G Suite backup solutions

No Ransomware

Protection based on AI detection engine and preemptive snapshots

Full-Text Search

Afi is the only cloud G Suite backup with full-text Gmail search for email contents.

10+ other unique features

  • Fresh UI with instant preview and instant direct download
  • Most granular roles (super admin’s rights can be limited)
  • Free retention for archived (deleted) G Suite users

Ready to try Afi? It only takes 1 min.