Solved

Exchange Server 2007

Posted on 2010-08-18
44
291 Views
Last Modified: 2013-12-05
Good morning,
I woke up this morning to find out that all my messages in my inbox are deleted. I still have my messages for my deleted items and for my sent items but everything in my inbox has been deleted. How can i recover my deleted items in my inbox more importantly how can i find out why all my messages in my inbox got deleted thank you
0
Comment
Question by:thinktechsolutions
  • 21
  • 14
  • 4
  • +2
44 Comments
 
LVL 32

Expert Comment

by:endital1097
ID: 33464044
first i would connect to your mailbox using owa to verify they are gone

then i would enable the recovery bin if they are gone to restore
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33464051
if you can see them in owa, start outlook by going to the run menu and typing
outlook /cleanviews
0
 

Author Comment

by:thinktechsolutions
ID: 33464068
if I go to the owa there gone in there as well. how do i enable the recovery bin. is it under microsoft disaster recovery tool in exchange
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33464085
set the dumpsteralwayson registry key
http://support.microsoft.com/kb/959878

then open outlook and highlight the inbox, select tools, recover deleted items
0
 

Author Comment

by:thinktechsolutions
ID: 33464091
all my emails from the folders are still there its just the inbox itself for somereason has disappeared
0
 

Author Comment

by:thinktechsolutions
ID: 33464102
now do I do this on the exchange server are on my personal computer
0
 
LVL 8

Expert Comment

by:jessmca
ID: 33464132
Check some of the other folders for your inbox.  You may have accidentally dragged it into another folder.  If you have a lot of folders, do a search for some emails you know are there, look at the folder path to see which folder your inbox is in.  You cannot delete your inbox folder, but you can move it.

Jess
0
 

Author Comment

by:thinktechsolutions
ID: 33464159
I know for a fact I did not deleted anything in my inbox I know everything was working under 9:00pm last night sent some emails. When I woke up this morning I went on my htc touch pro2 to look to see if anybody has emailed me and all of my messages were gone. So I figured it was probally an issue with windows mobile 6.5 so I booted up my computer and went to outlook 2007 it connected to the exchange server and I had all of my folder except all my inbox emails were gone. The strange thing is if I tried to send myself an email it will show up in the inbox and then within 30-45 seconds it disappears. I can view that I sent it by going to sent items. But the message disppears I checked the forwarding option in exchange thinking that somebody hacked my exchange server and forwarded all my emails to another address and there is no forward rule. What do you think could be going on. inbox coruption or do you think my computer or server has hacked. I'm freaking out here thank you for all your help by the way.
0
 

Author Comment

by:thinktechsolutions
ID: 33464165
jessmca:  the inbox folder is still there all of my messages are gone.
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33464174
add the reg key to your computer
0
 
LVL 4

Expert Comment

by:priyaexch
ID: 33464190
Hi,
Can you check if there are rules to delete the mails. Also try deleting the corrupted rules(rules in red)
0
 
LVL 32

Accepted Solution

by:
endital1097 earned 500 total points
ID: 33464255
if they are disappearing as shortly after you receive them it sounds like a POP account may be setup somewhere pulling them out of your mailbox

disable POP for your account
0
 

Author Comment

by:thinktechsolutions
ID: 33464290
ok I don't see an corupted rules in red. No rules to say delete the emails. Unless I'm looking in the wrong place.
0
 
LVL 4

Expert Comment

by:priyaexch
ID: 33464314
You need to identify, if the mails are getting deleted or being moved to any other folder.
1. mails may be moved-  Select mailbox. Right click choose Advanced find. enter any keyword from the missing mails and click on find now
2. mails may be deleted- Select inbox-->tools-->recovered deleted items. check to see if the mails are hard-deleted.
advFind.JPG
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33464315
check your recovery bin to see if the messages were removed from your mailbox
then ensure POP is disabled for your mailbox (POP is not enabled by default on the server)
did anyone create managed folder policies
0
 
LVL 4

Expert Comment

by:priyaexch
ID: 33464333
Also check your deleted items if the mails are being moved there.
0
 

Author Comment

by:thinktechsolutions
ID: 33464343
endital1097: ok disabled pop3. Sent myself I test message. Access OWA message was there for 45 seconds and then disappeared. looked under deleted items nothing very strange
0
 

Author Comment

by:thinktechsolutions
ID: 33464374
double checked all folder and also deleted items drafts and nothing my inbox messages are gone. pop3 is completely disabled.
0
 

Author Comment

by:thinktechsolutions
ID: 33464389
I've also rebooted the exchange server verified its not happening with any other email accounts everybodys email account functions properly just mine for some reason does not want to work today.
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33464398
are these messages appearing in the recovery bin for your Inbox
0
 

Author Comment

by:thinktechsolutions
ID: 33464432
I'm sorry how to I access the recovery bin. Was that registry file you refered me to a few comments back.
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33464453
yes, you need to add that key and restart outlook
this will allow you to view the recovery bin for all folder, by default you only have the deleted items folder
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 

Author Comment

by:thinktechsolutions
ID: 33464503
priyaexch: I'm so stupid I didn't even think of looking in to recover deleted items from inbox but all my message are there. Why would that happen.
0
 

Author Comment

by:thinktechsolutions
ID: 33464575
I can restore all the messages but I'm worried that If I do I'm going to loose them all again. any suggestions on what happened.
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33464604
i thought i mentioned recover deleted items earlier...

i would look at mobile devices, reset your password, managed folder settings
0
 

Author Comment

by:thinktechsolutions
ID: 33464649
You did but I was looking in the exchange server and going through the rules making sure nobody setup any type of forwarding address are any type of rules. I didn't even think to check outlook under recovery deleted items to see if there was anything there sorry my bad. I will reset my password and verify my htc touch pro2 to make sure it didn't delete my messages could that be possible. Everything was working perfect as of last night.
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33464675
0
 

Author Comment

by:thinktechsolutions
ID: 33464758
Ok I will do that.
0
 

Author Comment

by:thinktechsolutions
ID: 33464764
if I recover these deleted items. How can i save them so if it is my phone and it does delete them how can I recover them
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33464786
they'll go back to the recovery bin
then i would put them in a separate folder until the issue is resolved

it seems like something, a process, is doing this
0
 

Author Comment

by:thinktechsolutions
ID: 33464796
ok so the recovery bin located under documents and settings
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33464889
no, it is on the exchange server and contains items that have been removed from the mailbox (ex. Shift+Del or empty recycle bin)
you configure the retentino for this on the server
0
 

Author Comment

by:thinktechsolutions
ID: 33465109
ok I restored all the messaages and then one by one they all got deleted again and are in the deleted recovery items folder. Turning off myu phone now to see if that fixes it
0
 

Author Comment

by:thinktechsolutions
ID: 33465192
nope its not the phone thats causing the messages to get deleted. Under rules and alerts. there is a rule thee not sure if it was there before it says clear cartegories on mail recommend (client-only)
Apply this rule after messages arrives.
Any suggestions on what could be causing this.
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33465270
I'd go with endital's line along this thread.

I suspect some POP3 account was created to download mails from your account. Whether you did it / someone else did -- but that deleted all your mails in your account.

What phone are you using ?
For most phones you can directly connect to exchange using EAS, instead of pulling mails via pop3 and smtp.
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33465283
was anything enabled yesterday that may cause this? since it happens shortly after you mailbox receives the message, it seems like some type of process is running against your mailbox

did you enable auditing? it should show what account is accessing the folder
0
 

Author Comment

by:thinktechsolutions
ID: 33465336
enable auditing now. I disabled pop3 from my mailbox. I'm using the htc touch pro 2 yes I'm connected to the exchange server part not pop3.
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33465351
Does anyone else have access to your account / know your passwords ?
Can you ask around..
0
 

Author Comment

by:thinktechsolutions
ID: 33465399
Nope nobody has access to any of the passwords but me there not saved anywhere on my computer at all.
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33465496
To summarize (@what caused it)
- POP3 connection downloaded emails / deleted them (keep messages on server not checked)
- No external user has access to mailbox / passwords.
- External process / process auditing
- External Application / helpdesk ticketing software downloading mails to its queue ?
- Bad Phone Sync ?

Your configs / present status
- Outlook connected to Exchange - not POP3
- Deleted Messages are in deleted items retention.
- POP3 was enabled, disabled by Endital's commands above.

@endital - let me know if I missed something ?
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33465712
my first guess was POP3 downloading and not keepig messages on server which would be eliminated once POP was disabled for the mailbox

suggested auditing in case someone had username and password (could also reset password to ensure), but why would they only shift+delete the inbox

phone turned off and it happened

still could be a process, and auditing may pickup the account it is running under. i don't think it would be managed folders because they are typically set for a window, but still a possibility

i think resetting your password would be the best option at this point
it would break a POP3 account
it would break a login attempt by someone else
it would break ActiveSync
it would break any process running under your account

also check to see if your mailbox has a managed folder mailbox policy
Get-Mailbox you | ft Manage*

@sunnyc7 - what do you think?
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33465844
@endital
I agree. Resetting password will break POP3 / EAS and any other account which is accessing it (or NOT).

Apart from the obvious explainable reasons like POP3 download from home, I had seen a similar case about a year ago where outlook/exchange over VPN account somehow deleted all those messages.
(New Exchange account created to access emails over VPN, reset the emails with the empty OST..)
I was on call with Microsoft PSS for 2 days before they gave up.

We ended up doing a dumpster recovery using exmerge.

There is something going on over there for sure...
0
 
LVL 8

Expert Comment

by:jessmca
ID: 33465977
Are there any forwarding rules for your account in Outlook or any device connected to exchange?
0
 

Author Closing Comment

by:thinktechsolutions
ID: 33466561
My wife used an old laptop that had pop enabled for some reason I don't remember ever setting it up to use pop. But after I made sure nothing at the office was the cause I called my wife who is out of town and. Surprise Surprise she has an old laptop of mine because hers was not working. So I remoted in on the laptop she had and that was the problem. Sorry it’s the obvious things that you don't think of first. Going through all my systems to make sure nothing is setup to pop3. Thank you for all your help I have learned a lot today.
0

Featured Post

Do email signature updates give you a headache?

Constantly trying to correctly format email signatures? Spending all of your time at every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

Join & Write a Comment

Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
In this video we show how to create a Shared Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Sha…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now