Sending, receiving, and organizing email in Outlook.com
If old messages were modified by the attacker or a connected external app, there is no supported way in Outlook.com to automatically reverse those message contents back to their original state.
What can still be done:
- Check whether the original messages were moved or deleted.
- Open Deleted Items and use Recover items deleted from this folder if available.
- Also check Archive and Junk Email.
- Check for mailbox rules that may still be changing or hiding mail.
- In Outlook.com, go to Rules settings and review any Inbox or Sweep rules.
- Delete or edit anything unfamiliar.
- A compromised account can have rules that forward mail or move it to folders like Junk Email, Notes, or RSS Subscriptions.
- Review recent sign-in activity.
- Check the Microsoft account Recent activity page for unfamiliar sign-ins, locations, or devices.
- If the account was temporarily blocked or still shows unusual activity, use the Sign-in Helper to unblock it.
- Strengthen the account after recovery.
- Change the password.
- Remove old app passwords and create new ones if app passwords were used.
- Enable multifactor authentication.
- Add recovery security info such as an alternate email address and phone number.
If the affected emails are not in Deleted Items, Recover deleted items, Archive, or Junk Email, and only the altered versions remain, those original contents are not recoverable through the supported Outlook.com steps in the available guidance.
References: