What should we do if a server crash or disaster wiped out email records before they were captured into our archive?

A crash or disaster that wipes out email before it reaches your archive is a serious event, but it is recoverable in many cases and manageable in all of them. The goal is to restore what you can, document what you cannot, and close the gap that allowed unprotected records to exist in the first place.

Act quickly to recover what you can

Email rarely lives in only one place. Before assuming records are gone, check every layer where copies may persist:

• Backups and snapshots — system, mailbox, or storage-level backups taken before the failure.
• Server and journaling logs — message tracking or journaling may hold copies or evidence of message content.
• Sender and recipient mailboxes — counterparties inside and outside your organization may still hold the same messages.
• Mobile devices, local caches, and exports — cached or downloaded copies on endpoints.

Move fast. Backup windows expire, caches clear, and forensic recovery becomes harder with time. Pause routine deletion that could overwrite remaining traces.

Document the loss honestly

If records cannot be fully recovered, treat the gap as a record in its own right. Create a written account of what was lost, the date range and accounts affected, the cause, the recovery steps taken, and the outcome. This documentation supports accountability, audits, legal discovery, and any required reporting. Inventories of unrecoverable losses are part of sound recordkeeping, and authoritative guidance treats reliable, complete records as a core objective. See email and messaging records for related guidance.

Notify the right people

Loss of records can carry legal, regulatory, and litigation-hold consequences. Inform your records officer, legal counsel, IT security, and any compliance or privacy stakeholders. If the lost email was subject to a hold or an open request, escalate immediately so obligations are met.

Close the gap so it does not recur

A loss before capture usually signals that email was not being captured promptly or systematically. Strengthen prevention:

• Capture email into a managed repository at or near the point of creation, not weeks later.
• Maintain tested, redundant backups with verified restore procedures.
• Build email into your business-continuity and disaster-recovery plans.
• Apply retention and disposition consistently so records of value are protected throughout their lifecycle.

The lasting fix is treating email as a record from the moment it is created, so a single system failure never sits between a message and its preservation.