We have received a copy of a users mailbox for an investigation, I beleive the exchange admin used export-mailbox command as it came in a PST format. We also have the exchange tracking logs for the past 30 days. There is an entry in the tracking logs of an email sent by a specific user, but the email is not in the PST file. The PST file contains a folder "recoverable items" which I thought would include all mail/calendar entries deleted in the previous 30 days. So even if they'd deleted the email it should be in there. But it isnt? Can anyone provide a theory why that would be. The mailbox was provided within 5 days of this email showing as being sent in the tracking logs, so well within the 30 days that anything deleted should be shown in recoverable items. Completely baffled!