Hello, I have an environment running Windows Server 2008 SBS with Exchange Server 2007, but I have a complaining worker who do not find few emails about 2 months.

I did some searches using the Exchange Tools and verified that the email came/server was recorder.

I have to figure out just what really happened? he erased? failure in the transaction logs?

I need to understand, it may be that there are more workers in this situation

So if I understand you correctly the issue you are experiencing is

• A user is stating that they cannot find specific emails that they said they had prior?
• These missing emails were last scene about two months ago?

Several things could be at play here

• failure in Transaction Logs would not have caused this issue since if you had a transaction log failure your database would have crashed or dismounted and you would have had to of done a /p to repair.  Also if you show that it came into the server then the logs with that information was committed to the DB.
• User could have purposefully hard deleted them i.e. SHIFT+Delete which in short bypasses the Deleted Items Folder and in essence hides them in the place they were deleted from.  The good news is its possible to find these items, however the bad news is that its more then likely they have already passed the deleted item retention which on SBS 2008 by default is 14 days.

A: That said if the deleted item retention period has passed you could restore a backup to the RSG and then examine the DB with a 3rd party tool like our DigiScope product that would expose the items and the 30 day DEMO license would allow you to look inside any production or offline DB to see whats actually there

• If the user has access to their mailbox on their cellphone via active sync its possible they may have accidentally deleted the items
• user could have moved the message somewhere and forgotten about it.

So you have a few options here

1. you could export the users mailbox to PST since any items marked for deletion that have not yet passed the retention period would be exported.  Then once exported you could search the PST for the existence of the missing emails.

2. You could restore any backups from those points in time to the RSG and then again export that users mailbox to PST and search it for the missing emails.

3. You could try searching the users mailbox to with the admin cmdlets https://social.technet.microsoft.com/Forums/exchange/en-US/8f01ff4b-c681-419d-805f-d68c42cfa56e/exchange-2007-searching-for-specific-emails-using-message-tracker?forum=exchangesvradminlegacy

4. you could check out our DigiScope product since it allows you to search production databases as well as offline copies of database within an intuitive GUI.  The 30 Day demo license would allow you to find the desired information and then if you wanted to use the tool to recover or export data you could purchase a license or fallback to one of the free MS methods                                                                                                                     

Hi Mujhahid,

Thank you for your question.

Are emails missing on a whole day? For example: missing all emails on the specific day? Or missing few email on the specific day?

Did those users belong to the same database?

We could check if there are some retain policy to apply to those user, then login on OWA to check if we could find emails which are missing. Then restart the service of Microsoft Exchange Information store to check if we could find emails.

If the issue persist, we could refer to the following link to rebuild search index:

https://technet.microsoft.com/en-us/library/aa995966(v=exchg.80).aspx

If there are any questions regarding this issue, please be free to let me know.

Best Regard,

Jim