2

We run a single Exchange 2003 Standard server. On two separate occasions we have had the following happen, both times with the same sender and recipients.

A user with an an email address in domain A sends a message to two others with email addresses in domain B. I must stress that this is all internal and on the same Exchange server. Both recipients were listed in the "to" field. The first listed recipient received the message, the other didn't.

Checking message tracking in ESM, as well as manually checking the server Application event log, indicates that both messages were delivered without a hitch. However, the message just cannot be found in the second recipient's mailbox.

Using both Outlook and OWA I have searched all the recipient's Outlook folders, in case it accidentally got moved to another folder or was deleted. I also checked the deleted message recovery folder. No sign of it anywhere.

I'm completely baffled. How could a message that the system insists was delivered not actually be in the recipient's mailbox? What else can I do to try and track it down?

John Gardeniers
  • 27,458
  • 12
  • 55
  • 109

3 Answers3

3

As Shane said in his answer, if the logs show it as having been delivered then it was delivered. I've seen some pretty strange stuff with users who've configured POP connections to the server and with users who have handheld devices that connect to the server. Assuming you've got the Deleted Items retention setting on the server set to something other than 0 I would use exmerge to export the dumpster from the mailbox of the user in question and see if the email was hard deleted. I'd also look for a pst file or an archive that the user may have inadvertently moved the message to.

joeqwerty
  • 109,901
  • 6
  • 81
  • 172
  • Quite a new machine and I personally set up the accounts. No POP accounts, just the Exchange one. Dumpster checked (I referred to it as the "deleted message recovery folder" in the question). Retention is the default 30 days and only if it has been previously backed up. The most recent incident occurred yesterday. – John Gardeniers Jun 29 '11 at 00:12
  • As far as I know, the backup is not relevant to the dumpster. I just tested this with my account and was able to recover a message I just emailed to myself and then deleted. I might suggest temporarily disabling POP, IMAP, OWA, and Mobile Services to rule out an "external force" as the cause of the problem. – joeqwerty Jun 29 '11 at 00:44
  • 2
    Facepalm... If the message was deleted directly from the Inbox it won't show up in the "Recover Deleted Items" option in the Deleted Items folder, it will show up in the "Recover Deleted Items" option in the Inbox, assuming the dumpster is enabled for all folders. If that's the folder you checked earlier then ignore this comment. If you didn't then I would suggest checking it. If the dumpster is not enabled for all folders then you can use exmerge to export the dumpster for the applicable folder. – joeqwerty Jun 29 '11 at 00:57
2

Send to trash -> Delete from trash -> Purge recoverable items. I've had users do this to insist that they didn't get email X from Important Person Y.

I'd trust the logs saying it was stored over the current state of the user's mailbox any day of the week; without Exchange 2010's litigation hold in place, you really can't trust the mailbox.

Shane Madden
  • 114,520
  • 13
  • 181
  • 251
  • Telling me that you trust the logs over the user isn't really helpful. I normally also trust logs but only to the extent that they can be verified. In this instance that is not the case. – John Gardeniers Jun 29 '11 at 00:18
  • M. Madden makes a fair point, though. – JdeBP Jun 29 '11 at 11:29
0

Messages that have been deleted can be recovered from the Exchange server, if it is within the recovery period. There are separate "recoverable" lists for messages deleted from the inbox, from the deleted items folder, and from the junk mail folder.

Messages that have been moved to the junk mail folder, or to the deleted folder, and then deleted, are still recoverable, but on the exchange server must be found in the separate lists.

user165568
  • 270
  • 1
  • 2
  • 9