Firstly apologies for the long post. I have a user ranting on about a bunch of e-mail that "mysteriously" disappeared from a shared mailbox. Naturally, I've been summoned to investigate. At this stage of my analysis I can't rule out the possibility that one of 3 users have inadvertently moved the missing e-mail from the mailbox into a PST file (albeit either manually or automatically via Outlook 2003's AutoArchive). I've tried using Outlook's Deleted Item Recovery add-in to find out if the e-mail was deleted but suffice there is nothing available to recover (which makes me think that the content was moved not deleted).
Before I trawl through any PST filess located on each user PC I was wondering if there is any way to query Exchange to determine what specific "actions" were taken around the specific point in time prior to the e-mail disappearing, i.e. if e-mail A is moved from a mailbox to a PST, is the specific move transaction logged on the server somewhere? Also, does Outlook 2003's AutoArchive contain any client/server side logging functionality? Ultimately I can restore a mailstore backup to a recovery storage group to retrieve the missing e-mail, but I've been specifically asked by management to tell them why and how the content was originally moved/deleted. Environment is Exchange 2003, native mode AD Hope that makes some degree of sense. Thanks in advance for any help/pointers. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
