Exchange 2003, a few emails just disappeared?

B

black_b[ ]x

[H]ard|Gawd
Joined
Jul 1, 2002
Messages
1,753
I have an SBS 2003 server with Symantec Mail Security and one of our users is missing some emails from last week. They do not show up in the user's Deleted Items folder (in outlook or outlook web access), nor in the Recover Deleted Items. Item/mailbox retention is set to the default of 30 days.

Missing emails include both sent and received items. I can see the emails being sent/received in the SMTP log based on the email addresses and timestamps.

I don't know if the user is trying to delete things on purpose... I rebooted the server this morning, no change. The mailbox is about 4GB, connecting via Outlook 2007 on a Windows Vista Pro machine and also through webmail at times.

Is there anywhere else I can look?
 
PM a mod to move this thread to "Networking and Security" forum.
 
Enable the dumpster on all folders and then try to recover deleted items directly from the inbox or sent items or whatever.

It is extremely unlikely that your mail server is losing email. It is far more likely that the user deleted or moved the messages by mistake.

Also, change the user's password; just in case someone has hijacked her account and is using it to send spam.
 
Thank you. Dumpster is on and that's the weird thing, there are other entries in the Recover Deleted Items. It makes me think it was deleted and then selectively purged right away to cover the tracks.

Would manually purging the Recovered Deleted Items show up in a client or server log file?
 
Adding to possibly deleted...or junk mailed in Outlook, ensure the recipient doesn't have some weird view/sort by rule flipped on by mistake on his/her Outlook. I've seen "show only" rules with dates/received dates throw me down some dead end time wasting searches only to find that rule was flipped on by mistake.
 
black_b[ ]x;1038614402 said:
Missing emails include both sent and received items. I can see the emails being sent/received in the SMTP log based on the email addresses and timestamps.
Click to expand...


Did they somehow setup a pop account in an email client and download them to a computer? That's what it sounds like to me.
 
Probably dumped into a PST or sub folder accidentally.

Did you do a comprehensive mailbox search?
 
You must log in or register to reply here.
Back
Top