Every SharePoint recovery conversation eventually runs into the recycle bin's rules, and most of them are learned the hard way. This is the short, accurate version.
Two bins, one clock
First-stage (site) recycle bin. Where items go when a user deletes them from a library or list. A user sees the items they deleted. A site collection administrator sees everyone's.
Second-stage (site collection) recycle bin. Where items go when they are deleted from the first-stage bin: a user tidies their bin, a script calls delete on a bin item, or someone clicks Empty recycle bin. Only site collection administrators can open it.
One retention period: 93 days, counted from the moment the item was deleted from its original location. Moving to the second stage does not restart it. On day 93 the item is purged from whichever bin it is in.
There is a second limit people rarely hit: the second-stage bin may use up to 200% of the site's storage quota. If it fills, the oldest items are purged early.
What "empty recycle bin" really does
- A user emptying their view of the site bin moves their items to the second stage. Nothing is lost yet.
- A site collection admin emptying the second-stage bin permanently deletes those items. There is no third bin.
- Some third-party clean-up scripts and some migration tools clear both. Ask before assuming the 93 days apply.
After 93 days
Microsoft keeps backups of SharePoint content for a further 14 days after purge, but those are whole-site-collection restores performed by Microsoft support on request. They roll the entire site collection back to the backup point, overwriting everything done since. Useful after a disaster; not a way to get one file back.
Things that look like the recycle bin but aren't
- Version history protects edits, not deletions. A deleted file's versions go with it to the bin and come back with it.
- Restore this library rolls a whole library back up to 30 days. It uses the recycle bin and version history underneath, which is why it cannot reach anything purged.
- Preservation Hold Library exists only if a retention policy applies to the site. It keeps copies of edited and deleted content outside the recycle bins, for as long as the policy says.
- Deleted sites have their own recycle bin in the SharePoint admin centre, also 93 days.
Permissions cheat-sheet
| Who | First-stage bin | Second-stage bin |
|---|---|---|
| Site member / visitor | own deletions only | no |
| Site owner (Full Control) | own deletions only | no |
| Site collection administrator | everyone's | yes |
| SharePoint admin (tenant) | can make themselves site collection admin | yes, after that |
The row that surprises people is the site owner. Full Control on the site does not make you a site collection admin, and it is the site collection admin who sees everyone's deletions and the second stage.
Why this matters for recovery tools
Any tool that promises to "find deleted files" is bound by the same rules: it can only search both bins if it runs as (or on behalf of) a site collection admin, and it can only find items inside the 93 days. Undelete365 runs under the signed-in user's own permissions, so a site collection admin sees both stages and everyone's deletions in one search, and a normal user sees exactly what SharePoint would show them. It contains no permanent-delete code path, which is the other thing worth checking in anything you point at a recycle bin.