0

I'm running Exchange Server 2013 CU4 (I know, I'm going to update this after hopefully fixing this issue) on Server 2008 and have one user that has discovered they're missing a couple emails from December.

Both emails had attachments.

Where I found the emails: - Our SPAM firewall, both emails were delivered. - Our backup server, both emails were in the users Inbox and I can restore them.

Where I didn't find the emails: - Inbox in Outlook on her PC, Outlook Web Access, iPhone, or iPad - The Outlook Deleted Items. - The Recover Deleted Items. - Any searches I did using Exchange Powershell New-MailboxSearch.

The user doesn't have any rules or other accounts setup in Outlook 2010.

The user connects to her Exchange Inbox using Outlook 2010, an iPhone and an iPad. I've verified that emails deleted from all three end up in her Deleted Items or the Recover Deleted Items.

As part of trying to figure out what's going on, I'm trying to find a scenario where emails deleted/removed from the Inbox will not show in the Recover Deleted Items.

Looking forward to your guys input.

-Dennis

Dennis
  • 3
  • 2
  • They could have also deleted them from the 'Recover Deleted items folder' wouldn't be the first user to blame email for not getting something completed on time – Drifter104 Jan 18 '16 at 09:56
  • If the user knew about the 'Recover Deleted Items folder' before this happened then I'd add that to my list of possibilities, but she didn't. Also, this user is one of those who never empties the Deleted Items and has over 3000 emails in the Deleted Items. – Dennis Jan 18 '16 at 19:07
  • That doesn't mean anything, you can selectively delete a single email, delete it from deleted items and then purge it from recovery folder. That said you may be able to recover even then depending on your setup https://technet.microsoft.com/en-GB/library/ff660637(v=exchg.150).aspx – Drifter104 Jan 18 '16 at 22:37

2 Answers2

1

Usually, I find one of these two has occurred;

  • The user has dragged it into another mailbox, or PST that they have access to
  • Someone with access to this user's mailbox has dragged it into another mailbox, or PST that they have access to

Check what mailboxes they have access to, and who has access to theirs.

Stephen Sennett
  • 156
  • 3
0

This is almost always a user error, or a device error. I have seen iOS do this loads of times. The implementation of ActiveSync on iOS is very poor, causes a lot of issues.

I wouldn't wait to update the server, you are very badly out of date, and should be planning the update as soon as possible.

Sembee
  • 2,854
  • 1
  • 7
  • 11
  • I wish I could prove it was one of her Apple products that caused the issue... At least then I'd have solved the problem... I'm going to be updating my server this coming weekend. – Dennis Jan 18 '16 at 19:09
  • The problem is proving it, because what it does is not logged. You cannot retrospectively log. If it happens regularly, then disabling the devices can prove it. You could also see if the OS was updated around the time the content disappeared. – Sembee Jan 18 '16 at 23:25