Recover deleted Gmail and Drive files: the real windows

To recover deleted Gmail messages you have two windows: 30 days while the message sits in the user's Trash, then an additional 25 days in which an administrator can pull it back with the Admin console's Restore data tool. Google is explicit that the 25-day period starts 30 days after the message was deleted, so Gmail gives you roughly 55 days in total. Google Drive uses the same two numbers and behaves differently: the admin's 25 days start when the trash is emptied. A user tidying up their Drive trash on Monday can therefore burn up to a month of your recovery runway without knowing it. Here is exactly how each clock runs, and where both of them stop.

How to recover deleted Gmail past the Trash

The Gmail path is the more forgiving of the two, and it is worth knowing precisely because the second stage is invisible to the user who deleted the message.

1. Days 0–30: the user's Trash. A deleted message stays in Trash for 30 days and the user restores it themselves. After 30 days it is permanently deleted from the Trash and neither the user nor an admin can recover it from there.
2. Days 30–55: the Admin console. Once the Trash window closes, an administrator gets an additional 25 days using the Restore data tool — you pick a date range within the last 25 days and select Gmail as the data type. Google states this 25-day period starts 30 days after a message was deleted, not from the day it was sent or received, so it applies to mail of any age.
3. After day 55: gone. When the additional 25 days end, Google's own documentation is blunt — the messages are permanently deleted and cannot be restored by an administrator or by Google.

The useful consequence: in Gmail, a user emptying their Trash early does not shorten your administrative window, because that window is anchored to the deletion date rather than to the emptying event.

In Drive, the 25 days start when the trash is emptied

Drive is where the assumption breaks. Google's wording is that an administrator "can recover deleted items from Google Drive within 25 days after a user empties their trash", and separately that Drive permanently deletes anything left in the trash for more than 30 days.

Read those two sentences together and the range is wide:

• The user empties their trash on day 2. Permanent deletion happens then, so your admin window runs out around day 27 — not day 55.
• Nobody touches it. Drive auto-purges at day 30, and the admin's 25 days run from there, giving you something close to Gmail's 55.

Same product family, same two numbers, completely different exposure depending on a housekeeping habit you do not control. Three further limits matter before you rely on the Drive path at all:

• It restores by date range, not by file. Google states the restoration recovers all files removed during the selected range and that you cannot restore individual files or folders. Recovering one spreadsheet means bringing back everything deleted around it.
• It cannot touch data still in the trash. Items sitting in the user's trash are explicitly excluded, so the two stages do not overlap — you use one or the other.
• Some data is simply out of scope, including anything permanently deleted more than 25 days ago, and files that would push the user or organisation past its storage limits.

The windows at a glance

What was deleted	Native window	Who restores it
A Gmail message	30 days in Trash, then 25 more days	The user, then an admin via Restore data
A file in My Drive	30 days in trash, then 25 days from the moment it is emptied	The user, then an admin by date range
A file in a shared drive	30 days in the shared drive trash	A Manager, Content manager or Contributor
A deleted user's account and data	20 days from deletion	An admin, who must also transfer file ownership

Shared drives and departing users run on other clocks

Shared drives keep deleted files in their own trash for 30 days, and only members with Manager, Content manager or Contributor access can restore them. Viewers and Commenters cannot — which is worth checking against how your teams are actually permissioned, because the person who notices a missing file is often not the person able to bring it back.

Deleted users are the sharper trap. You have up to 20 days after deleting a user to restore the account and its data, and restoring the account is not sufficient on its own: unless you transfer ownership of their files to an active user, Google deletes those files 20 days later anyway. Files in shared drives are owned by the team rather than the individual, so they survive offboarding — which is a good argument for where working documents should live in the first place. We walk through that process in detail in restoring a deleted Google Workspace user.

Google Vault preserves, it does not restore

Vault is the usual answer when someone asks what happens past 55 days, and it is the wrong shape for the question. Google's own documentation states plainly that "Vault isn't a data archive" — retention rules and holds keep data from being purged, but when a rule expires the data goes and does not come back.

More to the point for a recovery conversation: you cannot restore Vault data into the user's account. The workflow is search, then export, and exports are removed from Vault after 15 days. What you get is a file somebody has to reassemble by hand into a mailbox or a Drive folder. That is a legal-discovery capability being used as a restore, and it is why we treat retention and backup as separate things in does Google Workspace back up your data?

Where the native windows run out

Discovery is slower than deletion. Every window above counts from the deletion, not from the moment anyone notices. A quiet insider deletion or an attacker working deliberately slowly spends the whole allowance before a ticket exists. Ransomware that reaches synced Drive files, or a compromised account deleting mail in bulk, produces exactly this pattern — and the 25-day stage is the one nobody is watching.

Overwrites are not deletions. Trash catches things that were deleted. It does nothing for a file encrypted or rewritten in place, because nothing left its folder. Drive version history is the fallback, and it is not a substitute for a restore point.

Scale. Pulling one message back is trivial. Reconstructing a department's mail and thousands of Drive files, with sharing and folder structure intact, using a date-range bulk restore that cannot select individual files, is a different exercise entirely.

Evidence. Frameworks such as NIS2 expect recovery you have tested and can demonstrate. "We rely on the trash" describes a default, not a control.

What actually closes the gap

If 25 days of admin grace — possibly 25 days from a moment a user chose — is thinner than your obligations, what you are looking for is an independent copy on retention terms you set:

• Your retention window, not a fixed 55 days, so a discovery six months late is still recoverable
• Point-in-time restore of a mailbox or a Drive as it stood before a specific change
• Granular restore of one message, file or folder without bulk-restoring everything around it
• Structure, sharing and permissions preserved, so restored content is usable rather than a pile of exported files
• Anomaly detection on mass-delete activity, so the clock starts when it happens rather than when someone complains
• Restore logs you can hand an auditor for NIS2, ISO 27001 and GDPR conversations

We are independent and we do not run your tenant: we help you choose the solution that fits your Workspace and your compliance position, and we get it deployed with guided onboarding. You own it and operate it afterwards, so getting your data back never depends on us. Our Google Workspace backup and recovery page sets out the coverage workload by workload, and the equivalent Microsoft clocks are in the OneDrive and SharePoint recycle bin.

If you cannot say today whether a mailbox emptied six weeks ago is still recoverable, that is the question an assessment answers — a short, practical review of the windows you are relying on and what a real restore would actually take.