• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 769
  • Last Modified:

How to find lost email in Exchange 2003 server

A customer has called and said that all of their email for 2 users has disappeared prior to 6th April 2009. One other user said that their email is fine except for a period of 10 days. They claim that they have not made any changes to the system.

In investigation I found that the OWA shows only email from the 6th of April. They are using Outlook 2007 and there is no evidence of Archive .pst files on their system. Infact there are no PST files on the system at all. There is an OST file. The exchange server database files Priv1.edb and .stm are a total of 5GB.  The modified dates on the .edb and .stm are the 6th of April at 11:57 am. There is no reference to any events in the System or application logs which refer to exchange. In fact there are very few error/warning events at all around that period.

Could a backup have cleared out all the mail prior to the 6th of April. Are there any cleaning routines that could have been run on the server to clear out old mail? Can they be run on a single mailbox? Could they be a part of a backup process?

What can I do to find the missing email? How can I identify what happened to cause this?
4 Solutions
Exchange does not delete content on its own. A backup certainly does not remove data.

The modified dates on the database files are of no consequence at all, so can be ignored.

There are basically three ways that data has been removed.

- Mailbox Management process - but that would remove the data from all users or in a more unified way, it works on a strict date, so would remove old content, not content from the middle of a month.
- Auto archiving
- Logging in to a machine and setting the delivery location as a PST file - but that would remove all data.
- Logging in to another machine and connecting as a POP3 client - again that would remove all data.
- Database corruption - but if that was the case I would expect more data to be missing.
- User deleting the email and not admitting it.

The most likely is the last option.

Have you checked recover deleted items?

How many days does your system hold deleted mail before purging? If it s not too late, have the user open Outlook, highlight the inbox (if thats where the mail disappeared from) and use the "recover deleted Items" in the View menu. you might find the missing emails there if the usrr accidentally deleted them or had a rule that deleted them. (Note I'm basing this on Outlook 2003 - if you are using 2007 you may have to hunt to find this item)

Other than that, get the user onto another PC & create e new profile. Ensure that its not in cached mode & do a search for emails with dates in the missing periods. This ensures its not a screwy local cahce issue.
btec_bobAuthor Commented:
Can you recover deleted items if it is email? How would I do that since it would be deleted from the exchange server rather than the local machine?
NEW Veeam Backup for Microsoft Office 365 1.5

With Office 365, it’s your data and your responsibility to protect it. NEW Veeam Backup for Microsoft Office 365 eliminates the risk of losing access to your Office 365 data.

btec_bobAuthor Commented:
Dreadman2k, I will try the recovery of undeleted items. By the way I did log in using OWA as the user to elimante the possiblity of a fault local cache. The emails were not visible in the OWA either.
First do this to be able to recover deleted items from any folder (not just Deleted Items)
Then select Inbox, choose Tools->Recover deleted items.
Depending on your retention setting you will be able to see deleted emails a while back.
btec_bobAuthor Commented:
I was unable to recover the email. The retention days were set to 1 and the backups were non existent.

The odd thing is that on the day the emails went missing one of the users was already logged in to his outlook and could see all of his emails. His colleague arrived and logged on and realized he could only see from the 6th of April onwards. He ask the first guy to check and when he did his emails were gone. This only happened to two users out of 10 and they were both the longest serving people there and the owners. They rebooted the server in case it was  an exchange lock up issue. This made no difference.

When we went to site we checked all of the machines for .pst or .ost files but there were no .pst files with any data in them. The .ost files looked correct.

I will run a defrag & integrity check on the exchange database but the mailboxes sizes look to be about the size you would expect for the amount of mail they currently have.

Have you any other thoughts??

DO they have any sort of document management system (eg. TRIM or IManage)? A lot of these have plug-ins for Outlook & users are often convinced something is in the email system when it is stored in the docuemt system. Especially when the document system can be used for email messages.

This is a real long shot, but worth ticking off the list. Your statement about one guy seeing all emails then them being gone when the second guy asked him to check is interesting. It sounds like it should give you a fairly narrow time windows for this deletion (or whateever it is) to have taken place. I assume you have been over the system logs for this time? Anything at all out of the ordinary?
btec_bobAuthor Commented:
No they do not have an Document Management (unfortunately). The time window was small .. about an hour on the 6th or April at 8:30 GMT. There are no events which relate to it. In fact the events relate to the reboot which they did around 11:00.

I am afraid that we have conceded that they are gone but I must admit I still do not have a good answer as to why or where.  

Thanks guys for the input.

btec_bobAuthor Commented:
Thanks for the input but I guess some times they really are deleted.

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now