[tacticalogic]

I manage Exchange servers. As soon as we’re notified that a person’s email is being subpoenaed for legal discover, that mailbox is placed on “legal hold”, and nothing in it can be deleted until the hold is removed.

[john316]

I manage Exchange servers.....

So you would know that it is no picnic but you could:
1. Spin up small VM
2. Restore mailstore until you get about where you need to be data wise
3. start trying to recover emails

This could be done since most Gub agencies require a pretty standard grandfather, father, son retention all a backups for DR purposes. In other words they would have 3 genenerations of backups for daily, weekly, monthly, anual, and DR sets.