Restoring Deleted Google Workspace User Accounts, Emails & Files

In short, the chances of restoring G Suite data using standard Google recovery heavily depend on how much time has passed since the items were deleted/lost.

With standard G Suite recovery you are limited to 30-60 days before data is permanently deleted:

• deleted G Suite emails can be recovered within <60 days. After they're deleted emails are placed in the Trash label where Google keeps them for 30 days unless the Trash is emptied earlier. After they're removed from the Trash, Google keeps them additionally for 30 days
• deleted Google Drive, Shared Drives files and (entire) Shared Drives can be recovered within <55 days. The retention workflow is essentially the same as for email messages
• users can restore deleted Contacts and Calendar events within 30 days after the deletion
• deleted G Suite user accounts (including G Suite administrator accounts) can be recovered by G Suite admins within 20 days
• there are no built-in G Suite tools to recover deleted G Suite domains (entire organizational accounts), but in some cases Google may be able to help recover them.

Organizations that use Google Vault or 3rd party G Suite backup tools are typically able to restore some or all data beyond the standard retention limits - see the last section for Google Vault and backup tools overview.

As discussed above, the maximum “standard” recovery period for email messages and Drive files is 60 days.

First 30 Days

Users can restore G Suite emails and files deleted from (Shared) Drives themselves within 30 days after deletion. They need to open the Trash label/folder, find the lost item and click restore.

Next 25 Days

G Suite admins can restore files/emails within 25 after the items were removed from trashed automatically, or if the trash folder / label was emptied manually. Admins should:

1. Log in as an admin and go to G Suite Admin panel
2. Go to Admin console -> “Users”
3. Find the user in the list and click “More” -> “Restore data” after you located the user.
4. You cannot search for or preview individual files. Instead, you need to select the date from when you want to restore (either a range or a single date). All deleted files/messages in the date range will be restored.
5. Specify the data (Drive or Gmail) and click “Restore”

Final 5 days

Administrators can use G Suite Email Audit API to restore emails deleted from Trash <30 days ago, therefore adding 5 extra days to the 25 days limit in Admin panel.

The Audit API does not enable to search and download individual email messages. Instead, administrators need to download (export) entire user mailbox accounts in mbox format, with deleted email messages included in the export.

Below is a short description of the key steps to export deleted Gmail messages using Audit API (detailed G Suite Email Audit API instructions are available here.

1. Upload an encryption key to your domain
2. Request a mailbox export using Audit API
3. Check the status of the export request via Audit API. The mailbox export preparation can take up to 10 days depending depending on the export size. When the export is ready you will receive “Done” status along with the link you should use to download the file.
4. Download the encrypted mailbox export file and decrypt it.
5. Open the decrypted mbox file to access email messages

Audit API only allows to restore missing Gmail messages (not Drive files).

Recovery Beyond 55-60 days limit

Google states that they don’t keep email messages and Drive files deleted more than 55-60 days ago (30 days in Trash and 25-30 days in Admin panel/Audit API recovery).

There are (rare) cases where Google is able to help organizations recover deleted data beyond the official time limits. See section #5 for more details.

Shared Drives cannot be deleted unless they are empty (Shared Drive delete button is greyed out if it has files). Therefore admins / users first delete Shared Drives files (moving them to trash) and then they can delete Shared Drives themselves.

When Shared Drive is deleted, the Trash folder is also removed. To restore the data you need to recover the deleted Shared Drive, and all its files deleted <25 days ago will be restored as well (files deleted 25+ days ago won’t be recovered).

G Suite Shared Drives deleted within 25 days can be restored in Admin panel using the following steps:

1. Sign in Admin Panel using an admin account
2. Go to Apps -> G Suite -> Drive and Docs

1. Use Deleted Status filter to show only deleted Shared Drives

1. Select the Shared Drive you want to restore and click Restore. Make sure you specify the time period from the date (or before) the Shared Drive was deleted and today (the day when you execute the restore)

Shared Drives deleted 25+ days ago will not be visible in the list of deleted Drives, and the standard recovery does not allow to restore them (check section #5 for alternative options).

G Suite user accounts deleted within 20 days can be restored in Admin panel. The process is the same for regular G Suite users as well as for deleted administrator G Suite accounts recovery:

1. Sign in to Admin Panel using an admin account                     
2. Head to Users List
3. Add “Recently Deleted” filter to see deleted users that can be restored

1. Select user(s) and click restore

According to Google, G Suite user data is permanently deleted at the end of the 20 days period and cannot be recovered.

See the last section in this post for description of your options for recovering G Suite data deleted beyond the “official” recoverable period.

Deleted Contacts can be restored back within 30 days after they are deleted.

Users can roll back their contact list to a specific state within last 30 days, which will restore any contacts deleted between now and the restored state. At the same time, the roll back will delete contacts created in between the 2 states.

There is no single contact recovery option available in “bare” G Suite.

To roll back the state of the contact list in order to recover deleted G Suite contacts users need to:

1. Go to the G Suite Contacts app
2. Select Undo changes option in the top right corner

1. Select date & time they need to roll back (before the lost contacts were deleted)

Similarly to contacts, you can recover deleted G Suite calendar events can within 30 days.

After 30 days from their deletion (or earlier if the Trash bin is emptied) the calendar events are deleted permanently and cannot be recovered using the standard methods.

To restore deleted G Suite calendar events:

1. Open the trash folder in the G Suite Calendar app

1. Select the event and click recover

The built-in G Suite recovery avialable in Admin panel has important limitations, in addition to the limited retention period.

No Versioning

Only the most recent versions of files/email versions can be recovered. For example, if a docx document file was accidentaly overwritten, there will will be no way to restore the right version in G Suite admin panel.

No Way to Confirm Restore

Administrators need to be in communication with users to check whether files and/or messages appeared in user’s Gmail/Drive and confirm the recovery. Restoring large amounts of data may take some time (a few hours) and the admin has no tools to check if the recovery is completed or is still in progress.

No Individual Items Recovery

Administrator has no search or preview options - all items from a selected date range are recovered in bulk, and individual files/messages recovery is unavailable.

Only in-place Recovery

Drive files and messages are restored to their original locations and you cannot specify alternative location for the restored data. This means that some of the files/messages that you’re not trying to recover may be replaced. We recommend to make a copy of users' files/messages before attempting a recovery.

The chances of restoring the data beyond G Suite retention time periods are small. But organizations that lost critical data must be willing to take the smallest chances.

Based on Afi customers’ experience & Afi research, less than 10% of G Suite customers that try to recover lost data beyond the standard retention time were able to do so with the help of Google support.

In this section we describe the 2 main options that may help recover data when the standard recovery methods don't work.

Google Support: Time Is of the Essence

One approach is to reach out to Google support and request data recovery.

Quick support reaction is critical, because the changes that Google still has the deleted data are higher in the first days after the data loss.

Unfourtenately, in most cases G Suite customers experience 2-3 days response time, which is often too long.

In one example an organization's G Suite account was deleted by Google, without prior notification. In response to the recovery requst a G Suite community product export mentions that the recovery of permanently deleted G Suite domain data is not possible after 24 hour after the deletion.

Google Support: Contact via Phone

G Suite support is notorioustly hard to reach via phone. Below is the list of Google Workspace support phone numbers that you can use.

Google Support: Contact via Chat and Twitter

In this example Google deleted a G Suite account because a company failed to respond to an email from Google asking for confirmation of the domain ownership.

After their Google Workspace domain got deleted, the company was unable to speak to a live support person over phone and instead contacted Google via G Suite support chat (requires another active G Suite account), as well as via the official G Suite twitter account (see below).

It is not clear whether the twitter message or support chat was more effective, but the company's G Suite data was succesfully restored by Google in 10 days.

Suing Google Over Lost Data

Even if the G Suite support is unable to react quickly, or communicate internally with Google infrastructure and operations teams, your data may still be recoverable for some time after the expiration of the official retention periods.

You can attempt to force Google to recover your G Suite data by getting a court subpoena. There is one known case where a startup tried to recover their data in court, after failing to restore it via Google support.

A California-based Musey Inc. accidentaly deleted their G Suite domain on June 9th 2019. Here is the summary of the events:

• Musey contacted Google support on June 9th 2019 within 1 hour after the accident. The support rep assured them that Google will look into the problem, which lead Musey to belive that the issue will be resolved.
• Over 3 days following the initial request Google did not take any steps to recover the data, and provided no fedback
• Musey team tried to get an update from Google support team, repeatedly sending chat support requests and calling the G Suite support line
• Approx. 10 days (June 19th 2019) after the initial request Google sent Musey admin an email confirming that the data was erased and no recovery is possible
• 9 days later (on June 28th 2019) Mysey filed a request for injunction, in an attempt to subpena thieir G Suite data

Unfourtenately for Musey the court didn't rule in their favour, Google did not restore their G Suite data and the company eventually went out of business (the website is no longer live).

Organizations that use Google Vault and cloud backup tools should generally be able to restore lost data without the 30-60 days retention limits.

Google Vault

Google Vault enables infinite retention of all G Suite email messages, Drive files and Meet/Chats messages (deleted or modified).

To have the protection in place, you need to configure Vault retention policies specifying which applications to backup, and for how long the data should be retained.

Important limitations of Google Vault recovery include:

• Gmail messages missing from retention policies (users report that Vault fails to retain <1% of G Suite Gmail deleted emails)
• deleted data cannot be recovered from deleted G Suite users (Vault erases data when users are deleted from G Suite)
• no versions are retained (only last states of files can be recovered), leaving a significant gap (Vault will not help in case of accidental overwrites or ransomware)
• no folder structure is preserved for (Shared) Drives, complicating the recovery process and making it impractical in case of medium to large amount data stored in 100s or 1000s directories.

See our other blog post describing pros and cons of using Google Vault as a G Suite data recovery option.

Third-party G Suite backup tools

There are approximately 20 G Suite backup providers that enable different level of restore precision and flexibility. Key differences between the options include:

• Granularity of browse and restore (ability to search and preview individual lost items before restoring)
• Completeness of restored items (sharing and access permissions, labels and directory structures)
• User self-service search & recovery, granular administrator and support staff roles with different access level

Check our other posts to learn more how you can use Google Vault to recover Gmail messages and Drive files, or compare most popular 3rd party G Suite backup tools.

 afi.ai vs. other Google Workspace backups

No Failures

Afi intelligently retries and reschedules backups to prevent backup failures

(Very) Fast

Based on new architecture, Afi is 2-3x faster than most G Suite backup solutions

No Ransomware

Protection based on AI detection engine and preemptive snapshots

Full Text Search

Afi is the only cloud G Suite backup with full text Gmail search for email contents.

10+ other unique features

• Fresh UI with instant preview and instant direct download
• Most granular roles (super admin's rights can be limited)
• Free retention for archived (deleted) G Suite users

Download datasheet  Start free trial now