What do we do if a chat channel or shared mailbox was auto-deleted before its retention period was up?

Discovering that a chat channel or shared mailbox was destroyed before its retention period elapsed is a records-disposition incident. The destruction was unauthorized, even if a system performed it automatically, because the content had not reached the end of its approved retention. Treat it seriously, act quickly, and document everything.

Stop the bleeding first

• Identify the scope: which channel or mailbox, what date range, who the custodians were, and roughly what content existed.
• Pause any related auto-deletion or auto-expiration policies so you do not lose additional records while you investigate.
• Check for active legal holds. If the content was under hold or relevant to litigation, FOIA, or an investigation, escalate immediately to legal/counsel, as spoliation concerns may apply.

Attempt recovery

Many platforms retain deleted content for a limited window before it is purged permanently.

• Check platform recovery features such as recoverable-items or retention “holds,” soft-delete folders, and admin recycle bins.
• Look for backups, journaling archives, eDiscovery exports, or copies held by other custodians or recipients.
• Engage IT and the platform’s support channels promptly; recovery windows are often short, so move before they close.

Document the incident

If some or all content cannot be recovered, record what happened in writing:

• What was lost, the approved retention requirement it failed to meet, the cause (misconfigured policy, default expiration, human error), and the date discovered.
• What recovery steps were attempted and their results.

This creates an accountable trail and supports any required reporting. In federal contexts, unauthorized destruction of records may need to be reported through your agency’s records officer and to the National Archives.

Prevent recurrence

• Reconcile retention rules across platforms so messaging and mailbox settings reflect your actual records schedule rather than vendor defaults.
• Disable or lengthen aggressive auto-expiration on content that may be a record until disposition is properly authorized.
• Test disposition changes before applying them broadly, and require sign-off for policies that delete content.
• Confirm legal-hold settings reliably override automatic deletion.

The core principle is that authorized disposition, not a default timer, governs when records may be destroyed. Build controls so retention requirements are enforced and exceptions are caught early.

For related guidance, see the email and messaging topic hub.