G Suite applications contain some of the most critical organizational data, including email messages, files and contacts. And since Google Apps is a cloud platform, its customers rarely face data availability problems due to hardware failures. But they can still lose data due to user errors, ransomware and intentional deletions.
So, what can you do if you lost G Suite files / contacts / emails, or lost an entiere user account? In short, your chances of getting back the data depend on how much time has passed since the items were lost. If you rely on standard Google data backup tools (whereas deleted items are placed in Trash for 30 days, and deleted accounts' information is kept for 20 days), you are limited to the 20-30 days to discover the data is missing and restore it before the items are premanently deleted by Google.
If you use additional archiving and data protection tools, such as Google Vault or 3rd party G Suite backup tools, then you should be able to restore some or all lost data (depending on the tool) for extended periods of time.
How to recover data from deleted G Suite account?
Goolge keeps data from deleted G Suite user accounts for 20 days. According to Google, after that period all data is permanently deleted and cannot be restred. See the last section in this post for description of your options for recovering G Suite data deleted beoynd standard recoverable period.
Many organizations use 3rd party backup tools in order to escape the 20 days limitation. Tools like Spanning or Backupify allow you to retain and restore data for extended periods of time, by keeping a reserve copy of your G Suite data in a secondary cloud storage. For more details check our posts about 3rd party G Suite backup tools and about using Google Vault as backup solution .
In short, most archiving and backup tools allow you to restore deleted G Suite user acconts, with the exception of Google Vault. It enables permanent data retention and ediscovery for existing users. But if a user account is deleted in G Suite, Google also removes all the associated data from Google Vault, making it useless for recovering deleted user accounts' data.
How to recover items deleted within 25 days?
G Suite Admin can restore Drive or Gmail data using G Suite Admin panel for up to 25 days after deletion from user’s Trash (aka permanent deletion). In addition, administrators can use audit API to restore data deleted in the past 30 days (adding 5 extra days to the limit imposed in Admin panel). Below is a short summary of steps Admins need to take to restore lost G Suite data (more details here):
- Go to Admin console -> “Users”
- Find the user in the list and click “More” -> “Restore data” after you located the user.
- You cannot search for or preview individual files. Instead, you need to select the date from when you want to restore (either a range or a single date). All deleted files/messages in the date range will be restored.
- Specify the data (Drive or Gmail) and сlick “Restore”
What data you can't restore with native Google tools
There is a few limitations that you need to be prepared to deal with:
No Recovery of Contacts
Standard G Suite tools do not allow recovery of permanently deleted Contacts (see below for extra options). Deleted Contacts are stored in Trash for 30 days. Past 30 days there are no standard ways to get them back.
No Individual Items Recovery
As already mentioned, you can only select a date from when you want to restore (all) the items, but not individual files/messages.
Original Items Get Overwritten
Drive files and messages are restored to their original locations and you cannot specify alternative location for the restored data. This means that some of the files/messages that you’re not trying to recover may be replaced. We recommend to make a copy of user’s files/messages before attempting the recovery.
No Way to Confirm Restore
Administrator needs to be in communication with the user in order check whether files and/or messages appear in user’s Gmail/Drive and confirm the recovery. Restoring large amounts of data may take some time (a few hours) and the administrator alone will not be able to see whether the recovery is complete or still in progress.
No Recovery of Folder Structures
You can restore only original files/messages, but not folder structures. If you have large number of files in an elaborate folder structure, you may need to spend some time re-creating the folders.
How to recover items deleted 25-30 days ago?
If the data is deleted from trash from 25 to 30 days ago, administrator needs to use Audit API to restore it. Here is a short summary of actions an administrator needs to take to restore lost data using Audit API (more details here):
- Administrators cannot search or download individual lost messagess. She needs to download an entire user mailbox account.
- Administrator should first create an encrypted copy of the mailbox which takes from few hours to days depending on the mailbox size.
- When the encrypted copy is ready, administrator will receive URLs to the mailbox files which she needs to download and decrypt
- In order to download the files, the administer needs to create an encryption key. This key can be generated using GPG (available at www.gnupg.org).
- Administrator should request the creation of a copy of a user's mailbox using the following script:
- Once the mailbox is copied and prepared for export, the response returns a status of COMPLETED along with the list of encrypted mailbox files as HTTP URLs. Use this set of URLs to download the mailbox files.
- Obtain the downloaded mailbox files — After downloading the encrypted files, the administrator decrypts the mailbox files using the domain's private key.
Recovery trough Audit API has the same limitations as the recovery using Admin Panel. In addition, Audit API only allows to restore missing Gmail messages. Lost Drive files cannot be restored using Audit API.
What can you do if you need to recover G Suite data permanently deleted over 30 days ago?
Google declares that you cannot restore permanently deleted (=deleted from user’s trash) after 30 days using native Google recovery features. You will thus need to try other alternatives that go beoynd standard tools
If your data is extremely important, you can make a case for emergency recovery measures. Since the timing of the recovery attempt is very important, you may need to follow up on your emails (primary method of communication for G Suite support).
Google G Suite customer global service number (24/7) is +1 (646) 257 4500, and below is the list of all English support numbers that you can try to reach if the global line doesn't work for you.
|Czech Republic|| 800-500-361||24/7||English|
|United Arab Emirates||8000-444-8847||24/7||English|
Importantly, the emergency data recovery request should be considered a last resort and your chances of restoring lost data are rather low. In our experience we’ve only seen one case in which an organization was able to convey the critical importance of lost data (results of a scientific research) and Google infrastructure team took extra steps to recover their missing data.
How can you recover G Suite data with Google Vault or a 3rd party backup tool?
You should be able to restore lost data regardless of when it was lost if you're using most of G Suite backup tools. Depending on which solution you employ, you will have different levels of flexibility. Key differences between the options are summarized below and include:
- Granularity of browse and restore (ability to search and preview individual lost items before restoring)
- Completeness of restored items (sharing and access permissions, labels and directory structures)
- User self-service search & recovery, granular administrator and support staff roles with different access level
Check our other posts to learn more how you can use Google Vault to recover Gmail messages and Drive files, or compare most popular 3rd party G Suite backup tools.