How to find lost email in Exchange 2003 server
A customer has called and said that all of their email for 2 users has disappeared prior to 6th April 2009. One other user said that their email is fine except for a period of 10 days. They claim that they have not made any changes to the system.
In investigation I found that the OWA shows only email from the 6th of April. They are using Outlook 2007 and there is no evidence of Archive .pst files on their system. Infact there are no PST files on the system at all. There is an OST file. The exchange server database files Priv1.edb and .stm are a total of 5GB. The modified dates on the .edb and .stm are the 6th of April at 11:57 am. There is no reference to any events in the System or application logs which refer to exchange. In fact there are very few error/warning events at all around that period.
Could a backup have cleared out all the mail prior to the 6th of April. Are there any cleaning routines that could have been run on the server to clear out old mail? Can they be run on a single mailbox? Could they be a part of a backup process?
What can I do to find the missing email? How can I identify what happened to cause this?
In investigation I found that the OWA shows only email from the 6th of April. They are using Outlook 2007 and there is no evidence of Archive .pst files on their system. Infact there are no PST files on the system at all. There is an OST file. The exchange server database files Priv1.edb and .stm are a total of 5GB. The modified dates on the .edb and .stm are the 6th of April at 11:57 am. There is no reference to any events in the System or application logs which refer to exchange. In fact there are very few error/warning events at all around that period.
Could a backup have cleared out all the mail prior to the 6th of April. Are there any cleaning routines that could have been run on the server to clear out old mail? Can they be run on a single mailbox? Could they be a part of a backup process?
What can I do to find the missing email? How can I identify what happened to cause this?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Dreadman2k, I will try the recovery of undeleted items. By the way I did log in using OWA as the user to elimante the possiblity of a fault local cache. The emails were not visible in the OWA either.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I was unable to recover the email. The retention days were set to 1 and the backups were non existent.
The odd thing is that on the day the emails went missing one of the users was already logged in to his outlook and could see all of his emails. His colleague arrived and logged on and realized he could only see from the 6th of April onwards. He ask the first guy to check and when he did his emails were gone. This only happened to two users out of 10 and they were both the longest serving people there and the owners. They rebooted the server in case it was an exchange lock up issue. This made no difference.
When we went to site we checked all of the machines for .pst or .ost files but there were no .pst files with any data in them. The .ost files looked correct.
I will run a defrag & integrity check on the exchange database but the mailboxes sizes look to be about the size you would expect for the amount of mail they currently have.
Have you any other thoughts??
The odd thing is that on the day the emails went missing one of the users was already logged in to his outlook and could see all of his emails. His colleague arrived and logged on and realized he could only see from the 6th of April onwards. He ask the first guy to check and when he did his emails were gone. This only happened to two users out of 10 and they were both the longest serving people there and the owners. They rebooted the server in case it was an exchange lock up issue. This made no difference.
When we went to site we checked all of the machines for .pst or .ost files but there were no .pst files with any data in them. The .ost files looked correct.
I will run a defrag & integrity check on the exchange database but the mailboxes sizes look to be about the size you would expect for the amount of mail they currently have.
Have you any other thoughts??
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
No they do not have an Document Management (unfortunately). The time window was small .. about an hour on the 6th or April at 8:30 GMT. There are no events which relate to it. In fact the events relate to the reboot which they did around 11:00.
I am afraid that we have conceded that they are gone but I must admit I still do not have a good answer as to why or where.
Thanks guys for the input.
I am afraid that we have conceded that they are gone but I must admit I still do not have a good answer as to why or where.
Thanks guys for the input.
ASKER
Thanks for the input but I guess some times they really are deleted.
ASKER