A customer has called and said that all of their email for 2 users has disappeared prior to 6th April 2009. One other user said that their email is fine except for a period of 10 days. They claim that they have not made any changes to the system.
In investigation I found that the OWA shows only email from the 6th of April. They are using Outlook 2007 and there is no evidence of Archive .pst files on their system. Infact there are no PST files on the system at all. There is an OST file. The exchange server database files Priv1.edb and .stm are a total of 5GB. The modified dates on the .edb and .stm are the 6th of April at 11:57 am. There is no reference to any events in the System or application logs which refer to exchange. In fact there are very few error/warning events at all around that period.
Could a backup have cleared out all the mail prior to the 6th of April. Are there any cleaning routines that could have been run on the server to clear out old mail? Can they be run on a single mailbox? Could they be a part of a backup process?
What can I do to find the missing email? How can I identify what happened to cause this?