Complex problem I dont understand. Four receipients are configured to receive automated email from our exchange through SMTP.one particular email only arrived to one receipient not all four. User opened email read email and then deleted. He subsequenly then emptied his deleted items box. Have carried out undelete on local machine other emails are there but not the one I'm looking for. Have set exchange for 30 days to keep undeleted and have restored from exchange once againlots of emails undeleted but once again this email not there. It has a message header that is easily identified as it contains the ID of the machine that the Anti Virus created the email for. I know that we were generating a lot of Anti Virus reports that day but it reached his mailbox and then disappeared once it was deleted.

Did the user "hard delete"? (shift+del) This bypasses the deleted item retention by default and if he did it before a backup ran...

Mike Crowley wrote: Did the user "hard delete"? (shift+del) This bypasses the deleted item retention by default and if he did it before a backup ran... So I'm taking it that if he had multiple items highlighted on his machine and then pressed shift delete all of these items would have been straight deleted and would not be recoverable through exchange 2003 even with retain deleted items set to 7 days and mailbox delete for 30 days. I wasn't aware of that. Is this in all folders or just in deleted items Thanks for your help

That is correct. You can change this if you want to prevent it in the future by enabling deleted item retention on other folders (deleted items folder is all by default) I've gotta run, but here is a semi-relevant link: http://support.microsoft.com/?id=178630and this: http://support.microsoft.com/kb/246153