Deleted on Date - what does it mean?

Dear Matthew Coffin

Thank you for inquiry and welcome to Microsoft Q&A.

In Exchange Online, when a user deletes emails (e.g., hundreds from Inbox), they first move to the Deleted Items folder as a soft delete, with "Deleted On" set to that timestamp. Purging from there (hard delete) moves them to the Recoverable Items folder (Deletions subfolder), updating "Deleted On" to the purge time. For bulk actions, all items typically share the same or nearly identical "Deleted On" timestamp, so you'd expect hundreds to appear together in recovery views filtered by date/time.

If you're only seeing 4 items in the expected period during recovery:

• Deletions may not have been truly bulk/simultaneous (e.g., done in batches over minutes, spreading timestamps).
• You're viewing the wrong stage: Items in Deleted Items use initial delete time; recovered items use purge time, check if most are still in Deleted Items.
• Filter too narrow: Micro-delays in processing could spread timestamps slightly; expand your time range.
• Other factors: Client-specific batching, policies/holds moving items, or indexing delays.

This confirms bulk deletions should cluster by "Deleted On." To troubleshoot the issue:

• Check Deleted Items directly and sort by "Deleted On."
• Use PowerShell:

    Get-RecoverableItems -Identity ******@domain.com -FilterStartTime "YYYY-MM-DDTHH:MM:SSZ" -FilterEndTime "YYYY-MM-DDTHH:MM:SSZ"
  

• Review audit logs in Microsoft Purview for exact events.

I hope this information can resolve your concern, in case further help is needed please just comment below. I more than happy to assist.

If the answer is helpful, please click "Accept Answer" and kindly upvote. It will help others who might be facing a similar issue find the solution more easily.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.