missing email

We have received a copy of a users mailbox for an investigation, I beleive the exchange admin used export-mailbox command as it came in a PST format. We also have the exchange tracking logs for the past 30 days. There is an entry in the tracking logs of an email sent by a specific user, but the email is not in the PST file. The PST file contains a folder "recoverable items" which I thought would include all mail/calendar entries deleted in the previous 30 days. So even if they'd deleted the email it should be in there. But it isnt? Can anyone provide a theory why that would be. The mailbox was provided within 5 days of this email showing as being sent in the tracking logs, so well within the 30 days that anything deleted should be shown in recoverable items. Completely baffled!
LVL 3
pma111Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

pma111Author Commented:
one other thing I noticed, is this email is only shown in the edge transport server logs.2 rows, one SEND event, and one RECEIVE event. both the email addresses are "external" email addresses.
0
Will SzymkowskiSenior Solution ArchitectCommented:
It has been permanetly removed. You cannot stop a user from deleting email unless you are using Legal Hold.

So what probably happend was, the user got the email deleted it (shift+del). It then goes into the dumpster (recover deleted Items). The user probably went into Recovery Deleted Items and then purged it from there as well (which they have the ability to do).

So i believe that is probably what happened.

WIll.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.