Featured image of post Microsoft Forms Data Recovery: Going Down The Rabbit Hole

Microsoft Forms Data Recovery: Going Down The Rabbit Hole

If you need to recover deleted responses of Microsoft Forms, then this post is for you...

Intro

Let me start by saying, that hopefully you’ll never need to go down this rabbit hole. But if you’re like me, you may be interested in the content anyway.

A couple of weeks ago, I worked on a support request from a user who needed to recover some accidentally deleted responses of a Microsoft Form. The first place I was looking for answers was the Forms recycle bin. This however will only include your deleted forms but unfortunately it doesn’t contain deleted responses of active forms.

Ā The good thing is that the restore process will also bring back the responses.

How would you even know if responses of a form got deleted?

I have a test form with 3 responses. On first sight, there’s no indication that some of the responses were actually deleted.

Forms will only display responses which haven’t been deleted.

But once I click on View results I can see that the number of the first respondent that is shown is actually 2 and not 1.

This is how you know if a form has deleted responses.

The response IDs will also be visible if you download a copy of the responses as an Excel file.

How can responses be deleted?

In most cases, responses are deleted unintentionally by accident. Responses can be deleted from the View results menu in Responses.

Click the three dots ()…) and then Delete response to delete a specific response.

There will be a warning that the response will be permanently deleted.

Spoiler alert: That’s not 100% true…

Sync Responses to Excel

At the time I had to recover the responses for the user, the option to sync responses to Excel wasn’t available yet, as this feature was only introduced recently in the fashion of a public preview. Even if it was already available, it would have only saved me all of the trouble and investigation work, if the user had clicked it before the responses were deleted.

From your form’s responses, you can either download a copy of a static Excel file or you can Open results in Excel.

Previously, Forms only allowed us to download a static copy of the current data.

Downloading a copy will only include the current responses but obviously not add any new responses. To view new responses in Excel, you had to download a new copy after more respondents filled out your form.

A common workaround was to create a Power Automate flow to automatically save all responses to either an Excel file or a SharePoint list. With the most recent update to Forms, that’s not necessary anymore. At least not for basic scenarios.

Opening the results in Excel will automatically create an Excel file in your OneDrive which is then also automatically updated every time somebody submits a new response to your form.

Each user will only see this message once.

A new tab will open with the newly created Excel sheet.

The Excel file will include all responses and also show a hint that this workbook is synced with Forms.

After setting up the sync, the form will show the linked Excel file instead of the button Open results in Excel.

Based on my testing, only newly added responses will be synced to the Excel file. If you delete a response from Forms, it will stay in Excel, which is not necessarily a bad thing. But even if deleted responses would be removed from the Excel as well, we could still get the data back through OneDrive’s version history.

Therefore, I advise every form creator to start syncing the responses to Excel Online immediately after the form has been created. This will ensure that no response data can get lost.

Now let’s look at your options in case you or a user didn’t sync or download a static copy of the responses before they were deleted.

Where are Form responses stored?

You might think that they’re stored in OneDrive or SharePoint but that’s not the case. Form responses are stored in the Exchange Online Mailbox of the user who created the form. I was only able to find all of this information because of this LinkedIn post by Andrew Chomik. The post includes another link which leads here.

This is what it says in the Microsoft Learn article:

Forms and responses to a form are stored in files that are attached to email messages and stored in a hidden folder in the mailbox of the user who created the form. Forms created before April 2020 are stored as a PDF file. Forms created after 2020 are stored as a JSON file. Responses to a form are stored in a CSV file. When you export content from Forms in a PST file, this data is located in theĀ ApplicationDataRootĀ folder in a subfolder named with the following globally unique identified (GUID):Ā c9a559d2-7aab-4f13-a6ed-e7e9c52aec87.

How do we access the forms data stored in Exchange Online?

At first I tried to get the data by using Exchange Online PowerShell but that turned into a dead end rather quickly. Since this all happened a couple of weeks ago, I don’t remember exactly how I discovered the tool MFCMAPI but somehow I found this and it helped me solve my issue.

This tool only works if Outlook is installed on the same system you’re running it from. Furthermore, the user who created the form for which you want to restore responses needs to be signed into Outlook (Classic). Outlook doesn’t need to be running for MFCMAPI to work though.

If you don’t want to perform this task on an end user’s machine, you can grant yourself temporary full access to the user’s mailbox so that you can use MFCMAPI on your own machine.

Use MFCMAPI to export form responses

To be able to see the forms data in a mailbox, you need to enable two options in MFCMAPI first. Click on Tools and then Options to open the settings.

Open MFCMAPI settings

Scroll down and make sure that Use the MDB_ONLINE flag when calling OpenMsgStore and Use the MAPI_NO_CACHE flag when calling OpenEntry are both enabled.

Without these options enabled you won’t see forms data.

You can find more info on how to use MFCMAPI here.

Next, click on Session and then Logon.

MFCMAPI Session Logon

Select the correct Outlook profile.

Select the correct Outlook profile

In my case, I’m signed into Outlook using the account called Olivia but the Forms data is actually stored in Emma Dupont’s* mailbox. Olivia has full access to Emma’s Mailbox and can thus use MFCMAPI on her machine.

Double click the mailbox to open it. This will open a new window.

Open mailbox in MFCMAPI

Expand the Root Container and then expand ApplicationDataRoot.

Find the ApplicationDataRoot folder

Look for the folder c9a559d2-7aab-4f13-a6ed-e7e9c52aec87 and expand it as well. In there, you will see the IDs of the user’s Forms. Identify the Form Id by comparing it to the one shown in the URL on forms.office.com.

Find the correct form Id

Once you’ve identified the correct form, double click the Id to open it in a new window.

This will display all data linked to the selected form.

Remember that in the beginning of this blog post I mentioned, that the first response which is available in Forms had the Id 2? The other two responses which are available in Forms are 3 and 5. This means that 1 and 4 are missing from Forms because they were deleted.

Let’s see if we can find them in MFCMAPI…

Export deleted form responses

In the bottom half of MFCMAPI, sort the Name column ascending and look for the name 0x3662001F and select it. Then click on any of the items in the top half of the window. Now you can use the arrow keys to cycle through all items. For all items which store a form response, the value in 0x3662001F will hold a number, which corresponds to the response Id. In this case, I’ve found the response 4.

Identify the deleted form response

To export the response data, select the entry in the upper half of the window and right-click to select Attachments, Save all attachments…

Save the attachment

Save the CSV file to your PC in a folder of your choice.

Now you can open and view the response in Excel.

Forms response recovered through MFCMAPI in Excel

Repeat these steps for all the deleted response Ids that you need to recover.

Summary

It’s noteworthy that you can also create a support request at Microsoft if you really need to recover deleted responses of Forms. The experience I had with that approach wasn’t the greatest. It took me weeks of emailing back and forth with the support engineer until they were finally able to restore the data. I also had to provide a UTC timestamp for the point in time as well as a written and signed consent letter to confirm that Microsoft is allowed to perform the restore. The fact that the restore was performed by a backend engineer and the support engineer only acted as a middleman didn’t help either.

If you go down that route, it also means that all responses that were submitted after the restore point will be lost. If you want to keep all the responses, you’’ll have to wait for Microsoft to perform the restore, download a copy of the restored data and then ask them to restore the form a second time to the most recent version before the initial restore was performed.

I’m not a 100% certain anymore but I believe that they can only perform a restore if the data was deleted less than 30 days ago.

The response I recovered through MFCMAPI in this blog post was submitted/received/deleted on March 25th, 2024. So, even though the response was deleted almost 2 months ago, it’s still available in mailbox. I also spot-checked some mailboxes of other users and they all seemed to contain all the data of all forms ever created by these users. Because of this, I’m fairly confident that all Forms related data is stored in a user’s mailbox forever.

Timestamp of the deleted/recovered response

Because the process to get Microsoft to restore the Forms data took so long, I started my own investigation in parallel and actually managed to restore the data myself before Microsoft was able to complete the restore. That being said, if you need to restore a lot of deleted responses it will be a lot of additional work to export all the responses one by one from MFCMAPI and then merge all the recovered CSV files with the rest of your responses again. If Microsoft performs the restore, you can simply download a copy of the restored data from Forms again.

In case of data loss in Forms, taking a look through MFCMAPI is a great way of quickly recovering the data yourself. Especially if you only need to restore a handful of responses. I only recommend to contact Microsoft support in a last resort type of scenario.

To avoid a situation like this, I recommend to make users aware of the new “Sync results to Excel” feature and train them to always start syncing any new form right after it has been created. After all, this feature is a huge improvement to Forms as it’s not necessary to create your own Power Automate flow to achieve a similar result anymore.

If this blog post has made your day because you were able to recover some precious Forms data, please consider supporting my work by making a donation on my GitHub Sponsors Profile.

Licensed under CC BY-NC-SA 4.0
comments powered by Disqus
Hosted on GitHub Pages
Built with Hugo
Theme Stack designed by Jimmy