Does email archiving capture deleted email?

Only if it was captured first. An archive that polls a mailbox keeps mail still in Trash or Deleted Items, but not mail permanently deleted before a scan listed it. Journaling copies mail at send, and a retention rule, once set, keeps the deleted mail it covers. Each has limits.

What this means for your firm

• Say in your policies which mechanism you rely on and what it does not cover, with the scope and start date of any rule or journal.
• Suspend a departing employee’s account rather than deleting it: deleting starts a 20-day Google or 30-day Microsoft clock, and those are recovery windows, not an archive.
• Capture early: a first backfill reaches only mail that still exists in the mailbox, so connect before a mailbox has years of deletions.

Turret reads each mailbox every 60 minutes and archives sent and received mail, including what sits in Trash or Deleted Items.

Six questions about how your firm keeps and reviews email: take the SEC email-readiness self-check. A self-check of your own practices, not legal advice.

What the rule asks for

Originals of written communications received and copies of those sent, kept "so as to reasonably safeguard them from loss, alteration, or destruction" (Rule 204-2(a)(7); 204-2(g)(3)(i))

Gmail Trash

A deleted message stays 30 days, then Google permanently deletes it and the user can no longer recover it; Google documents a further administrator restore window that begins 30 days after deletion (Google Workspace help)

Microsoft Recoverable Items

A deleted item is kept 14 days by default, up to 30 if an administrator changes it, then removed from Exchange Online (Microsoft Learn)

Departing user's account

Google restores a deleted account up to 20 days; Microsoft retains a deleted mailbox 30 days (Google Workspace help; Microsoft Learn)

Google Vault

Retains nothing until retention rules are set; once set, deleted mail the rule covers is kept (Google Vault help)

It captures deleted email that the archive had already copied. A polling archive also captures deleted email still in the mailbox when its next scan runs.

The question matters because of the rule text. Advisers Act Rule 204-2(a)(7) requires an adviser to keep:

Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given;

17 CFR 275.204-2(a)(7)(i). Items (ii) through (iv) follow.

Which emails fall inside "relating to" is not always clear message by message. Archiving the whole mailbox avoids sorting in-scope mail from the rest. The rule also says how electronic records must be held:

To maintain and preserve the records, so as to reasonably safeguard them from loss, alteration, or destruction;

17 CFR 275.204-2(g)(3)(i).

To limit access to the records to properly authorized personnel and the Commission (including its examiners and other representatives);

17 CFR 275.204-2(g)(3)(ii).

The rule names no capture method. It does require a second copy: the adviser must "Separately store, for the time required for preservation of the original record, a duplicate copy of the record on any medium allowed by this section." (17 CFR 275.204-2(g)(2)(iii)). How that copy is made, and how soon, is left to the firm.

Journaling. Journaling sends a copy of each message to an archive when it is sent, so the copy exists before any later delete. Google describes the Gmail version this way: "a journal copy is sent when the user clicks Send." Google lists Frontline Plus, Enterprise Standard and Enterprise Plus, and Education Plus as the supporting editions; Business editions are not listed. For Exchange Online, Microsoft says: "You can't designate an Exchange Online mailbox as a journaling mailbox." It also says: "some organizations might need to use a third-party solution to receive a copy of emails." On Gmail, journaling needs a listed edition, a correct setup and a destination that receives the copies. Where any of those is missing, no copy is made.

Retention or hold in the platform. Google Vault is the Google example. Its documentation says: "The data is kept even if users delete messages and files or empty their trash." It also says: "Vault doesn't retain data until you set up retention rules." So a retention rule keeps the deleted mail it covers, from the point it is set. Microsoft's counterpart is Purview; this page does not cover its settings. The mechanism fails where no rule was set, or where a rule's scope leaves mail out. Whether Vault alone is enough for a small firm is a separate question, covered in Is Google Vault enough for SEC Rule 204-2?.

Polling through the provider's API. The archive reads each mailbox on a schedule, through the provider's own interface, and stores a copy of what it finds. Mail still in Trash or Deleted Items when a scan runs is copied like any other. Mail already purged into Gmail's administrator restore window, or into Microsoft's Recoverable Items, is not read. An archived copy is not edited when the mailbox copy is later deleted. The copy is made at the next scan, not at send.

When a user deletes a Gmail message, it stays in Trash for 30 days. Google's help page says that after 30 days the message is permanently deleted and "You can't recover the message." Google also documents an administrator restore window for permanently deleted mail. It begins 30 days after the deletion, and once it closes the message "can't be restored by an admin or by Google."

For a polling archive, the Trash period is what makes capture possible. A message deleted today is still in the mailbox for a month, so any scan in that time can list it. Gmail's in:anywhere search operator is documented as "Find emails across Gmail. This includes emails in Spam and Trash." The gap is the other case: the message is permanently deleted, through "Delete forever" or the 30-day purge, before any scan lists it. A polling archive does not have that message.

The Google Workspace email archiving page covers Gmail capture in more detail.

Among the ways Microsoft lists for an item to reach the Recoverable Items folder is this one: "A user deletes an item or empties all items from the Deleted Items folder." Microsoft also says its default retention policy for Exchange Online "doesn't include a default tag to automatically delete content from the Deleted items folder."

For items in Recoverable Items, Microsoft gives the default deleted item retention period for Exchange Online as 14 days, with a maximum of 30, and says: "When the deleted item retention period expires, the item is removed from Exchange Online." The Microsoft 365 email archiving page covers which folders a polling archive reads.

Deleting an account removes a whole mailbox at once, and the recovery windows are short. Google says: "You can restore a user account (including administrator accounts) up to 20 days after deleting it." It adds: "After 20 days, the data is gone and you can't restore it." Microsoft says Exchange Online "retains the mailbox and all its contents until the deleted mailbox retention period expires, which is 30 days. After 30 days, the mailbox is permanently deleted and can't be recovered."

On Google Workspace, when Turret sees a mailbox move from active to suspended, it queues one final archive pass over that mailbox's sent and received mail. It cannot fetch mail Google has already purged.

• Decide the gap you can accept. Polling leaves mail permanently deleted between scans. Journaling depends on edition and setup. A retention rule depends on what it covers and from when. The rule text does not pick one; that choice is a judgment for your CCO and counsel.
• Capture early. A backfill when you first connect reaches only mail that still exists in the mailbox, so connect before an adviser's mailbox has years of deletions in it.
• Write down what is covered. Say in your policies which mechanism you rely on and what it does not cover. If you add a Vault or Purview retention rule or a journal alongside an archive, record which one, its scope and its start date.
• Suspend rather than delete. When an employee leaves, suspend the account instead of deleting it. Deleting starts the 20-day Google or 30-day Microsoft clock, and those are recovery windows, not an archive.
• Treat the archive as a second copy, not as a block on deletion. No archive here stops an employee deleting mail in the mailbox. If preventing deletion matters to your supervision program, that is an access and policy question as well as a tooling one.

Turret is a polling archive, not a journal. Every 60 minutes it reads each Google Workspace or Microsoft 365 mailbox and archives sent and received mail. On Gmail that includes Trash, and excludes spam, drafts and chats; a sent message moved to Trash is still captured. On Microsoft 365 it reads Deleted Items and most other folders, but not Junk Email, Drafts, Outbox, Recoverable Items or the online-archive mailbox. Retention is 7 years, while you subscribe. Pattern review covers outbound mail only. Attachments are archived with their name, type and size, but the text inside them is not scanned.

If a polling archive fits the gap you accept, start a free trial. To look first, see the demo.

Sources opened October 17, 2026.

1. Advisers Act Rule 204-2, 17 CFR 275.204-2(a)(7), (g)(2)(iii), (g)(3): eCFR and Cornell LII
2. Google Workspace Admin help, Restore a user's permanently deleted email
3. Gmail help, Delete or recover messages (Trash, 30 days)
4. Gmail help, Search operators (in:anywhere)
5. Google Workspace Admin help, Restore a recently deleted user
6. Google Vault help, How retention works and Vault overview
7. Google Workspace Admin help, Integrate Gmail with a third-party archiving solution
8. Microsoft Learn, Journaling in Exchange Online
9. Microsoft Learn, Recoverable Items folder in Exchange Online
10. Microsoft Learn, Default retention policy in Exchange Online
11. Microsoft Learn, Delete or restore mailboxes in Exchange Online