If the mail was moved, it *should* be available via deleted item recovery. The server has to do a copy operation to the pst, then does a delete operation on the messages in the original location. I've used this before to recover when someone had archived all their mail to a pst and deleted it, but then found the pst was corrupted when they took it home.
So, if they were moved from the inbox to a pst, you have to enable the DumpsterAlwaysON reg key to recover deleted items from any mailbox, but messages should then be available to restore. -Bonnie From: cs [mailto:[email protected]] Sent: Monday, December 15, 2008 8:30 AM To: NT System Admin Issues Subject: Exchange auditing Firstly apologies for the long post. I have a user ranting on about a bunch of e-mail that "mysteriously" disappeared from a shared mailbox. Naturally, I've been summoned to investigate. At this stage of my analysis I can't rule out the possibility that one of 3 users have inadvertently moved the missing e-mail from the mailbox into a PST file (albeit either manually or automatically via Outlook 2003's AutoArchive). I've tried using Outlook's Deleted Item Recovery add-in to find out if the e-mail was deleted but suffice there is nothing available to recover (which makes me think that the content was moved not deleted). Before I trawl through any PST filess located on each user PC I was wondering if there is any way to query Exchange to determine what specific "actions" were taken around the specific point in time prior to the e-mail disappearing, i.e. if e-mail A is moved from a mailbox to a PST, is the specific move transaction logged on the server somewhere? Also, does Outlook 2003's AutoArchive contain any client/server side logging functionality? Ultimately I can restore a mailstore backup to a recovery storage group to retrieve the missing e-mail, but I've been specifically asked by management to tell them why and how the content was originally moved/deleted. Environment is Exchange 2003, native mode AD Hope that makes some degree of sense. Thanks in advance for any help/pointers. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
