How does BackupAssist 365 retain deleted items in Exchange mailbox backups?

TL;DR summary 

1. Microsoft 365 / Office 365 provides a default retention policy of 14 days, but it can be configured to a maximum of 30 days.  
2. BackupAssist 365 provides a special folder, called “Historical Items”, where deleted items are stored. 
3. BackupAssist 365 will deduplicate deleted items, so only the last copy is retained. 
4. Restoring from Historical Items is straightforward. 

What retention policy does Microsoft 365 provide? 

Microsoft outlines the options for retaining deleted items in this informative article – Change how long permanently deleted items are kept for an Exchange Online mailbox. 

The key points for administrators are: 

1. Permanently deleted items are kept for 14 days by default, and for up to 30 days if you configure it. 
2. These items can be retrieved from the Recoverable Items > Deletions folder in each user’s mailbox. 
3. To retain items beyond this time, you can activate In-Place Hold and Litigation Hold – which requires an Exchange Online Plan 2 license. 
4. In addition to these retention options, backups are the best option for retaining deleted items. 

BackupAssist 365 and its special Historical Items folder 

Let’s say a user permanently deletes an email that was received last week. You’d go to the Historical Items folder in the PST backup and retrieve it from there. 

Under the Historical Items folder, you’ll see the original folder structure for each deleted item. 

Here’s a simple example, complete with screenshots. (Click the screenshot to see it in full screen.) 

1	Email is received into user’s mailbox Inbox.
2	Backup runs – that email is copied into the backup Inbox.
3	Email is hard deleted from user’s mailbox Inbox.
4	Backup runs – and BackupAssist detects the change. It moves the email from the backup’s inbox to the folder Historical Items\Inbox.

How does deleted item deduplication work? 

We’ll only retain items in Historical Items if no other copy of the item exists in the backup. Here are some examples: 

An item is moved to Historical Items: 

1. The last copy (or only copy) of an item is deleted. It gets moved to Historical Items. 

An item is not moved to Historical Items: 

1. An item is moved from one folder to another. Because it now exists in a different folder, it is not moved to Historical Items. 
2. An item is duplicated (for example, using drag and drop in Outlook while holding the Control key), and the duplicates are deleted. Because there’s still at least one copy of the item, it is not moved to Historical Items. 

Restoring from Historical Items 

Nothing special needs to be done to restore from Historical Items. To get items back, simply: 

1. Create a copy of your backup PST file. 
2. On the copy, remove the “Read only” flag on that PST. 
3. Open the PST in Outlook. 
4. Find your item and drag it across to your restore destination.