HELP!  Tons of Emails disappeared from Public Folders - also Calendar Entries and Contacts

Posted on 2009-04-16
Last Modified: 2012-05-06
I need some help, and maybe more than just technical...
I will try to keep this as brief as possible, without sounding as dumb as I feel right now.

A few days ago an employee called and said a bunch of entries from our Public Calendar had disappeared.  Basically anything before January 29, 2009 was GONE.

Then yesterday, another call from another employee saying that all that Public Contacts were gone (there were like 2500)!

And now today, I come to find that SEVERAL of my Public Folders are EMPTY!  They are not ones that receive mail, they are more like filing cabinets - so for instance my 2006, 2007 and 2008 folders - where we keep emails for ongoing matters that began in those years - they are completely EMPTY!!!!

I have NO idea what is going on - but it  is freaking me out!

Two things I did recently that may come into play:
1.  I thought that I personally had screwed up the Calendar by playing with the new Desktop Manager for Blackberry that allows you to sync your berry to a Public Folder...I thought perhaps I hit a wrong button and started a two-way sync that overwrote the older calendar months with "blanks" from my berry.  I tried recovering this info - pfdavadmin, the "recover deleted items" function, the OWA method - which hasnt seemd to work for me at all...but either that wasnt what happened, or it happened a couple weeks ago before I reset my retention policy to 30 days instead of 7.  This led to my posting Question ID 24319142.

2. I recently ran Office2003 SP3 on all my client computers.  We were experiencing a number of buggy issues that the update said it would address - and we were also in need of the 2009 calendar Holidays.

I dont know if either of  those had anything to do with it...but it seems as though stuff either is disappearing on a continuous basis, or else I (or someone who doesnt want to fess up to it) did something not realizing it, and now I am worried it may be too late.  Because some of these folders are only for storing items and arent accessed all the time - I cannot say for sure when the items disappeared - and whether my retention was 7 days or 30 when they did...

I need HELP to look in all places possible - to check all logs possible to see if I can even find a trace of when the items were deleted.
Could Public Folders get archived by an employee by mistake?  Where would the info go?
If someone deleted from a Public Folder - can I use any outlook Workstation to use "recover deleted  items" or do i have to figure out who may have deleted the info - and how do I do that?
Anyway - help...

Yes, I have backup to Tape ran over the weekend - although I fear that may be a backup of what  I am looking at now.
And I have a backup server in a colo that replicates this one in case it goes down - so thats no good because it looks as though it has been doing its job and the same folders are empty there.

I am sure there are plenty of other questions - so fire away...any and all help is appreciated!!!  I am a little scatterbrained as you can imagine - but this is my priority for  the day!  So i will be here hoping for help and praying for resolution.
Question by:mmorocco
    LVL 65

    Expert Comment

    The only thing that can remove content from public folders is age limits on the folders themselves, so check those.
    If those haven't been set, then someone has deleted the content, either on purpose or in error.

    If you have DIR enabled on the public folder store, then you can recover deleted content. You will need to make the registry change in Outlook to enable the option for other folders.


    Author Comment

    I have the ability/option in outlook to use the Recover Deleted items.  It shows up on my Tools menu - but when I choose any of the folders that are empty - nothing shows up in the recover window.

    Does this registry change do anything different?  Or is it only to allow the ability to use the recover deleted items function if it is not there?
    LVL 65

    Expert Comment

    The registry change allows you to do recover deleted items from any folder. By default you only get the option when you are looking at the deleted items folder. It is know as the Dumpster Always on key.


    Author Comment

    OK, just wanted to check if this was something I didnt have.  I do have that menu item and ability with any folder, even Public ones.
    Unfortunately, NOTHING shows up when I use that function.
    I have also tried the OWA trick that I saw here on EE - but the way i read it that only is intended for a WHOLE Folder, not for items deleted from inside a folder - and there is nothing to be found there either.

    I have done my best to scour my server and network.  I do NOT know yet how this happened.  What I do know is that there does not appear to by rhyme or reason that I can make of it.

    Some folders are empty, yet, there are newer ones and older ones that are not.
    Some folders just appear to have had items prior to a certain age deleted
    Yet that date does not match other folders that are missing emails.

    At the moment I am trying to turn my focus toward what to do next to recover and "put humpty back together again" because sooner or later, while some of these folders are not accessed often, they will be (murphy's law) just when I dont want to them to be.
    So i am trying not to dwell on the how it happened or where it went, but what I am going to do now.  Though, if I dont know what or how it happened - i cannot guarantee it will not continue.  So i do need to try and figure it out at some point.

    But I am weighing options of restoring my Store to a virtual installation and opening it and seeing what I have in my most recent backups.  But I believe that could be time consuming, to install virtual machine, configure it to mimic my environment, then do the restore, etc etc.
    I am looking into any 3rd party software that may allow me to just restore, open and view/select items from the DB itself without restoring to exchange.

    Sorry - off-track - that is for my next post I assume.

    So thank you thus far Simon, please do come back at me with anything you can think of...?
    LVL 65

    Expert Comment

    I am pretty sure that if the content has been deleted by a user, then you would need to find which user it was for the recover deleted items method to work.

    For public folder restores you will need to use a recovery server otherwise it is an all or nothing affair when recovering back to the production system. It can take a while to setup a server, most of an afternoon in my experience, as I usually build a completely isolated environment to do the recovery in. Take a few more hoops to jump through to get the data back.

    Otherwise you are looking at something like OnTrack Power Controls to look at the database files to extract the data.


    Author Comment

    Oh how i wish that were true.  I have checked most all users whoI even think could have done this, and they all show the same 1 or 2 emails in the "recover" box.  So no luck there.

    Yes, I was saddened to find out the difference between restoring a mailbox and public  folder store.  I am currently debating between finding a box to do the restore on - I only have 2 servers, 1 is production and 1 is backup.  and yes, i believe i need to basically mimic my environment in order for the restore to work properly if I am not mistaken.
    The restore would be coming from Tape.  I was thinking about imaging my server now (LiveState - or whatever they call it these days - any recommendations?), and throwing that image onto a Virtual Machine, and doing the restore there.  Do you think I would have to install the virtual server on a server? or could I do it on a workstation?  
    Well-i guess i need to hook the TapeDrive up to, my workstation would need a scsi, right?

    Yes, I am familiar with the OnTrack product also.

    There is one other slow, painful, manual option I am working on - which is trying to basically merge any and every pst, archive folder, and any mail i can find anywhere from the last few years (one of the folders that is now empty was a 2006 Correspondence File).  My boss has always been wierd about email - and so most everyone's mailbox forwards to one or another public folder - and so much of the content that was within the now empty folders once was sent to or existed in someone's personal folder.
    So, I am first thinking about trying put humpty back together again without going through all those restore hoops - and then once I have gone through everything and sorted it back out - if I find any gaping holes in my history - I will then turn to the restore...expect to see another post about that if/when that time comes.

    I think I have said many  a time that I am self-taught, and learning everyday - i have gone through some serious stuff (p'd off employee who pulled all 4 drives from running server and hid them for 3 days - had to do complete restore from tape) and am always trying to learn, just while keeping up - luckily the field i work in is mostly with people who are often at least a fwe years behind the times - so I do okay most days...and so this whole task is an opporunity, but not under the ideal circumstances...i keep running into that alot...things i would like to do for fun and learning in off-time (install and configure virtual server and exchange etc etc) are not the kind of stuff i wish i had to in order to save my butt.  Trial by Fire i suppose.

    One last question and then i will be quiet - is there a tool out there that i can use to merge or import a bunch of PSTs into one giant mailbox?  
    I have and will be using Exmerge to get whats on the server now...but what about backed up/archived PSTs from past years and gone employees?  If I have a bunch of PSTs in a folder on my network, is there any other choice other than creating an outlook profile and importing each one, and then dumping everything into one inbox???

    Thanks all - if you've got advice please keep it comin...

    Author Comment

    Seriously though!!!! Come on?!?!
    There are folders that are totally empty - I know they had stuff in them I put it  in myself...

    but then I have 3 folders who have emails ONLY going back to 3/18/09.  In ALL 3 of these Folders - and maybe more - they only go back to 3/18/09.

    Then I have at least 1 other folder that does not go back any further than 1/29/09.
    And guess what - that is the same day that ALL CALENDAR entries prior to then disappeared recently - which is what started this snowball.

    But then other folders go back into 2008.  And then others are totally empty...

    I mean - okay, I can understand if someone deleted entire folders on me, or something happened where they got deleted - but to selectively go into multiple folders and delete anything prior to certain dates???

    there has to be an explanation, no???

    this HAS TO BE SOME KIND OF CLUE to something...

    thx in advance for listening...but i am back and forth between moving forward and figuring out the cause...
    LVL 65

    Expert Comment

    You can use exmerge to import older archive files. You just need to rename the files to match the alias. If the user has multiple PST files then you will need to run the process more than once, renaming the file each time.

    I presume that you have checked the age limit wasn't set on the public folder to ensure that the data hasn't removed that way.


    Author Comment

    Wow, now I really don't know whats going on.

    You would presume that Simon, wouldn't you.  Because who wouldn't check the Age Limits?  And who would have them set on folders that are clearly meant to archive information?

    Well, I have 2 excuses, 1 is I have a newborn at home...and 2 is I have a newborn at home - and I trusted checking into this to someone else who reported back to me incorrectly, I did NOT do my own homework and so now, here I am...having lost even more sleep over this issue than I have been normally...

    YES - the Age Limits box was checked, and set to 30 days.  That is why the 3 folders I mention above which all went back to 3/18/09 when i posted now only go back to 3/20/09!

    I had asked one of my people recently to handle this - after our Public Calendar entries started disappearing (which this isnt really solved yet) I wanted to change the default deleted items retention to 30 days.  Well, it looks like they did that - but they also checked the Age limits box and set it for 30 days.  This would NOT have happened automatically upon changing the default retention would it (in case he tries to say so)?

    Now, why my Public Calendar entries were deleting from January 2009 and back I dont' know.  
    And why certain Subfolders in My Public Folders Tree still have emails from before 3/20 and going back to 2008, I DON"T KNOW either...

    But what I do know is that i feel like...well - insert your own horror story of stupidity here.

    So, inevitably now, I have a question:

    If ESM Age limits were deleting this stuff - then it's GONE right?
    Does the Age Limits Override the Retention Limits?
    Or if for instance the 3/19 emails were just deleted yesterday due to Age Limits, is there someway to get them back?

    Is there any utility I can use on the server machine to try and find these deleted items?  
    I do NOT have Outlook on the Server - and have been told that that is even worse than your DC having Exchange (which i do right now).
    What about PFDavAdmin - am I correct that I believe I read that this should NOT be run on a server?

    Or is it hopeless?

    And I should just start merging PSTs???

    I think this is your 3rd question with me Simon, and I  hope you will not count this against me and will continue to aid me when in need.  It is experts like you that made me join this forum and that make me not even blink at any old membership fee...

    Author Comment

    Clarification on the Exmerge comment please?
    So, I import joebrown's pst from 2009 - named jb2009
    I have PSTs from joe for the last five years.
    what I do is rename each of the past year's files to be jb2009 and then just keep importing them.
    at the end i should have one big mailbox and one big PST of all of joe's emails from the last 5 years???

    is that right?

    I sure hope so.

    What about if they are from different people?  For instance, in my current circumstance - what if I have several PSTs from several users over the last few years - and my goal is to ultimately combine all of those emails into one inbox - for purposes of de-duping - and then I will re-file them in their appropriate public folder.

    Can Exmerge help me in this way?  Or can I only import joe browns PST into an already imported Joe Brown folder?  Or can I import and merge a jane green PST into the Joe Brown profile?
    LVL 65

    Accepted Solution

    With regards to exmerge...
    If the user's ALIAS is joe.brown, then all you need to do is keep renaming the PST file to joe.brown and running the import again. Who the file belongs doesn't really matter. You could rename a PST file that "belongs" to Jane Smith and it would be imported correctly in to the mailbox with whatever name that you changed it to. Remember exmerge is used for cross forest moves, where the concept of who "owns" the folder is lost (on purpose).

    However with regards to the content removed by age limits - that is gone. A restore from backup is your only option. It would need to be a backup from before the age limit was set ideally.
    Age limit and retention limit are not related. Retention limit is for deleted items, where the content is deleted by a user, not by the system.


    Author Comment

    Simon, thank you.
    For listening and being patient and helping me understand.

    I appreciate the clarification on Exmerge.  This will go a long way toward helping me recover from this blunder.

    I do have backup from prior to the Age Limit change.  Also, if i didnt state above - most all of the public folder emails that have disappeared were once sent to and then sometimes forwarded to these public folders - so most all of it is able to be "found"  if needed by searching through other employees files for now until I figure out how best to do a restore within my current environment.

    I am probably going to get started on figuring that out now and posting some questions elsewhere on that...its going to be tricky.  It may be the  learning experience of a lifetime - but tricky nonetheless.

    Thanks again, I am more than happy to award these points - and hope you won't shy away from  my questions in the future.

    I am very appreciative.  As bad as this sucks - there is a bit of calm in at least knowing what happened...even if it is my own fault!

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Wish Marketing would stop bothering you?

    Is your marketing department constantly asking for new email signature updates? Are they requesting a different design for every department? Do they need yet another banner added? Don’t let it get you down! There is an easy way to manage all of these requests...

    Granting full access permission allows users to access mailboxes present in their database. By giving full access permission one can open and read the content of any mailbox but cannot send emails from that mailbox.
    Use email signature images to promote corporate certifications and industry awards.
    In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
    In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now