Link to home
Start Free TrialLog in
Avatar of Pau Lo
Pau Lo

asked on

missing email

We have received a copy of a users mailbox for an investigation, I beleive the exchange admin used export-mailbox command as it came in a PST format. We also have the exchange tracking logs for the past 30 days. There is an entry in the tracking logs of an email sent by a specific user, but the email is not in the PST file. The PST file contains a folder "recoverable items" which I thought would include all mail/calendar entries deleted in the previous 30 days. So even if they'd deleted the email it should be in there. But it isnt? Can anyone provide a theory why that would be. The mailbox was provided within 5 days of this email showing as being sent in the tracking logs, so well within the 30 days that anything deleted should be shown in recoverable items. Completely baffled!
Avatar of Pau Lo
Pau Lo

ASKER

one other thing I noticed, is this email is only shown in the edge transport server logs.2 rows, one SEND event, and one RECEIVE event. both the email addresses are "external" email addresses.
ASKER CERTIFIED SOLUTION
Avatar of Will Szymkowski
Will Szymkowski
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial