Just a note on shared mailboxes, if someone has deleted the emails in question, then the deleted emails will show in their Outlooks deleted items folder, not the deleted items folder of the shared mailbox.
On Mon, Dec 15, 2008 at 10:29 AM, cs <[email protected]> wrote: > Firstly apologies for the long post. > > I have a user ranting on about a bunch of e-mail that "mysteriously" > disappeared from a shared mailbox. Naturally, I've been summoned to > investigate. At this stage of my analysis I can't rule out the possibility > that one of 3 users have inadvertently moved the missing e-mail from the > mailbox into a PST file (albeit either manually or automatically via Outlook > 2003's AutoArchive). I've tried using Outlook's Deleted Item Recovery add-in > to find out if the e-mail was deleted but suffice there is nothing available > to recover (which makes me think that the content was moved not deleted). > > Before I trawl through any PST filess located on each user PC I was > wondering if there is any way to query Exchange to determine what specific > "actions" were taken around the specific point in time prior to the e-mail > disappearing, i.e. if e-mail A is moved from a mailbox to a PST, is the > specific move transaction logged on the server somewhere? Also, does Outlook > 2003's AutoArchive contain any client/server side logging functionality? > > Ultimately I can restore a mailstore backup to a recovery storage group to > retrieve the missing e-mail, but I've been specifically asked by management > to tell them why and how the content was originally moved/deleted. > > Environment is Exchange 2003, native mode AD > > Hope that makes some degree of sense. Thanks in advance for any > help/pointers. > > > > > > -- Sherry Abercrombie "Any sufficiently advanced technology is indistinguishable from magic." Arthur C. Clarke ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
