[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

The case of the missing email PST.

Posted on 2012-08-10
18
Medium Priority
?
339 Views
Last Modified: 2013-03-13
The Facts:

Server stores user documents.  Some users have outlook .PST files in addition to documents.  The server was experiencing HD issues.  Decided to offline server and copy user files to external HD.  Reason this was done was the server was getting unstable.  It was  running really slow and eventually crashed.  

SO user docs are in two places, original and external HD.

We rebuilt new server and copy the documents over.  Remap all users to point to new location.

The problem 1 user is missing 2 years of emails that were stored in PST files.

The PST files on the original location, external location, and 1 week old backup all look similar and are missing the emails.

So there must have been  another PST in play that we can't locate.  Checked on the users PC and the server but couldn't find a PST file with the missing emails.  Does anyone have a clue what could have happened and how?

we checked the outlook hidden directories Outlook.Content, and where the .ost file and .nk2 file are stored.  We have high confidence in the user that she is indeed telling the truth that the emails existed.

Her computer did have sync going for her user drive and that sync pointed to the server that was offline not sure if this caused issues.
0
Comment
Question by:ewit
  • 6
  • 6
  • 2
  • +2
16 Comments
 
LVL 12

Expert Comment

by:aindelicato
ID: 38282367
Could it be in archive.pst ?
0
 
LVL 17

Expert Comment

by:Kent Dyer
ID: 38282534
If you cannot find the pst..  Can you pull it out of backup?  I would start there.

HTH,

Kent
0
 
LVL 33

Expert Comment

by:Exchange_Geek
ID: 38282599
Had it been archive PST it would be normally stored under her profile on her machine. You'd get the PST location from her OL - If PST goes missing, OL will not forget the PST location and would keep on trying to find the PST.

Since, you've copied the folders to another location and brought it back - search in the same folder - what ever you get is her PST.

While, she may or may not accept - that is her opinion.

We get to talk to such folks everyday where they'll always deny that those emails were never there in first place. People forget and then starts the blame game.

Regards,
Exchange_Geek
0
Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

 

Author Comment

by:ewit
ID: 38283799
Kent,

PST From the backup matches the PST files from that we have.  All three locations show 2 pst files that date back to 2010.  


Exchange_geek,

I know this user isn't lying.  There are 2 years of emails she is missing kinda backing up the 2010 date of the files.

To everyone else:

Something is gone wrong here.  Her my documents folder was redirected to her U: (user drive on the server).  We always put PST files in people's U drives ( i know there are reasons against it).  U: Drive being a network share on a file server.

For some reason this particular user's PST files regressed 2 years or she had other PST files they have gone missing (Couldn't of been on U cause they would be on backup tape).  I personally think the PST files had to be some place else because of the time stamps.  The PST files we have are dated to 2010.  They exist in the User drive, the file copy of that drive as well as the tape backup.  All implies she must not have used these PST files.  So what happened to the current 2012 PST files?

My best guess with no proof is MS sync just destroyed her PST files somehow.  I guess this would happen when windows assumed that the old ones dated 2010 were somehow more relevant than her current ones.  The syncing must not have been working properly over the years and moving around the server shares somehow caused a sync.


I really don't know what happened here and I'm a bit uncomfortable with it as I feel there always is an answer in the computer world.  I don't like to tell my users I don't have their file and they are on their own.
0
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 38284602
Did you check if user has some Auto-acrhiving set with PST location ?

MS sync can be discontinued but cannot remove or delete the PST :(

Did you check the data inside those PST's on users machine apart from their date ?

Of the user had those files on the U:\ drive surely you will have a backup of those at a certain time maybe 2 weeks ago from the removal or even a few months old ..... right

If everything is fine check if user has some USB or any other shared folder that is being used ?

Also couldn't it be that users Shared location\Home drive changed and caused this mis-understanding ?

- Rancy
0
 
LVL 33

Expert Comment

by:Exchange_Geek
ID: 38284797
Friend,

All i can tell you is if the PST isn't on the users machine NOR on your drive. It's history, sounds a bit rude - but you and i both know that its gone.

Regards,
Exchange_Geek
0
 

Author Comment

by:ewit
ID: 38287608
Exchange_geek,

I do tend to agree.  I just want to understand why?  You can almost always explain processes on a pc in some way as to what happened.  With the proper knowledge of course.  Why are you so certain is it the evidence I provided or have you ran into something like this before yourself?
0
 
LVL 33

Expert Comment

by:Exchange_Geek
ID: 38287637
I've burnt my hands on such issues before, where in customer would save the PST on a shared location - that they know of, for some reason the location wouldn't exist in future OR the server was decommissioned OR some USB Drive was removed and they've lost their emails.

In spite of us restoring xyz files from any number of months - no data was ever retrieved, it was on such instances where we had to tell them - WHY aren't they saving files locally.

Also, some folks use the feature of Archive PST and when their boxes gets formatt'd OR re-profile'd - at those instances such hue and cry happens - we spend money on restoring data using file recovery softwares to get back data that they want. Some time we are successful and some times not.

So, in your case that is the reason I said, if you cannot find it on the server AND you cannot find it locally. Well, that sounds bad news for the user.

Regards,
Exchange_Geek
0
 

Author Comment

by:ewit
ID: 38287643
Rancy,

I didn't see auto-archiving enabled but i will recheck this.

OK so MS Sync won't delete a PST even if the same name but older file exists in the directory.

Yes I checked the data, I looked at all the PST's.  PST Sources included:
1)what we thought was current copied file from the source.
2)the source of the copy (original failing server).
3)two week old backup tape.

Yes had a backup but it doesn't have a newer PST than 2010.

i checked the users computer for *.pst files found nothing.

-yes the change somehow did cause the misunderstanding or in this case missing files/emails.    All the other users that have their files intact this particular user lost her latest PST Files.
0
 

Author Comment

by:ewit
ID: 38287704
Geek,

What software do you use to recover such files.  I scanned her PC using some cheap freeware that shows deleted files but I didn't really see anything that looked like  a PST.  Maybe you use some fancier software.
0
 
LVL 33

Expert Comment

by:Exchange_Geek
ID: 38287725
Pretty much everything that doesn't require to shell out money ;)

http://www.piriform.com/recuva
http://www.snapfiles.com/get/restoration.html
http://www.officerecovery.com/freeundelete/

Regards,
Exchange_Geeek
0
 

Author Comment

by:ewit
ID: 38292003
OK Thanks to Recuva I may have gotten another clue as to what happened.

I found what looks like the PST files down to the date and time of the incident 8/2/2012 @8:30AM.  This is exactly the time that an admin disconnected the PST file from the user.    

What i don't understand is why they are sitting in that directory.  There also seems to be multiple copies of the same file in the same directory according the the recovery tool.  Not sure if that's just a byproduct of a file that was over written and got scattered.

The said directory is:
 C:\Windows\CSC\v2.0.6\namespace\%servername%\%username%\
i replaced actual server and username with the %variables%.

Unfortunately the PST's have been over written by other files and their sizes are really really tiny.  16KB's and 43KB's.  The state is unrecoverable.

So it seems that recovery is not possible.  However, this may answer a question or two as to how this incident occurred.  

Why is the PST file sitting in this fortified CSC folder (very strict permissions)?

What is the function of that Directory in windows in general?

Why would outlook leave a file there when it was supposed to be mapped to a User drive?
0
 
LVL 33

Expert Comment

by:Exchange_Geek
ID: 38292087
CSC is offline cache folder that windows create

Read in detail why and how of this folder

http://blogs.msdn.com/b/oldnewthing/archive/2003/08/27/54712.aspx

Regards,
Exchange_Geek

P.S - keep that tool handy, it did help me and would help you too :)
0
 

Author Comment

by:ewit
ID: 38292279
So geek...

did M$ sync delete the files after the server name changed and it found some really old PST files in the newly mapped drive?

Those old PST files were exactly what they should of been syncing too all along but something broke and it couldn't sync over the last two years?  So the last two years it ran in cache mode?

Then out of the blue it decided to ditch the cached files?
0
 
LVL 33

Accepted Solution

by:
Exchange_Geek earned 2000 total points
ID: 38292750
My guess is that the PST were overwritten for reasons unknown to us OR possibly have gone corrupted.

The fact that the PST were present in CVC folder means that they were there as an offline cache and they shouldn't have been there since the mapped drive should have had the original PST.

Did MS Sync delete the files - your guess is as good as mine. Possibly yes. What was left behind were cache'd PST which are of no use to us.

Regards.
Exchange_Geek
0
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 38297488
With 16KB's and 43KB's .... its like nothing in them.
Wired things happen ones in a while and not much can be done than to move ahead :(
Rest i guess Exchange_Geek has mostly answered the queries ..... however if still any issues do let us know.

- Rancy
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article describes how to import Lotus Notes Contacts into Outlook 2016, 2013, 2010 and 2007 etc. with a few manual steps. You can easily export and migrate Lotus Notes contacts into Microsoft Outlook without having to use any third party tools.
Take a look at these 6 Outlook Email management tools which can augment the working and performance of Microsoft Outlook to give you a more rewarding emailing experience.
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
As many of you are aware about Scanpst.exe utility which is owned by Microsoft itself to repair inaccessible or damaged PST files, but the question is do you really think Scanpst.exe is capable to repair all sorts of PST related corruption issues?
Suggested Courses

872 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question