any advice on how to track or locate deleted emails. User A sent email to User B and C. Both Users B and C recieved the emails in their inboxs. Few days later user B reports the email missing. User C confirms that the email has also disappeared as well as User A reports the email missing from his sent items. anyway on seeing who did this and how this happened? StephaneStephane Favre

First confirm that it is actually missing in their mailbox. I've noticed that when I get these support calls, majority of the cases I was able to locate them when I log into their mailbox in OWA and do a search of the message at the root mailbox level. Most of the times they have it hidden in some subfolder or they some custom views in their outlook and cannot find it. James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

I agree with James, Also Most of the time i ssaw that users have deleted emails accidently and can recoverd mails from "recover deleted items". Did you check that. For this problem please follwo below points to troubleshoo this. 1. Check recover deleted items in both A and B Mailbox's 2. Check any customer rules/ add-ins installed in user A and B Mailbox and try to reproduce it 3. If still you are getting this problem repeat, I would advise you to use MFCMAPI to delete any stale rules for user A and B and check for some days. http://exchangeshare.wordpress.com/2008/04/10/delete-corrupted-hidden-or-stale-rules-from-mailbox-with-mfcmapi/ Anil

User should get the mails from Recover Delete Items as James said.Gulab | MCTS-MCITP Messaging: 2010 | MCTS-MCITP Messaging: 2007 | MCC 2011 | Skype: Gulab.Mallah

Assuming malicious intent, who, beside "SELF", has Full Mailbox Access to the mailboxes? Or who has the mailbox owner delegated access to on the folders in their mailbox? Has anyone run "export-mailbox" to remove messages from mailboxes? That mailbox access would be recorded in the applications log.--- Rich Matheisen MCSE+I, Exchange MVP

Hi Stephane Any update for your issue? Above gave some good suggestion. Which version of exchange do you use? Regards! GavinPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

If you have Exchange 2007, you can trace the e-amail and confirm that it was deleted. If it's less thatn 14 days, you can easily recover it if you have Outlook 2007.

Hi all..... it is Exchange 2007 SP2. Have checked Recovered items, searched mailboxes for the email instance. Remember that this email instance has been "removed" from the sender's sent items and both recipients inbox. If someone had used a powershell script to delete that particular email would it be recorded in the event log? I am more looking from a server perspective. StephaneStephane Favre

Hi Stephane, If you have configure the Mailbox Access Auditing feature it will be logged, some information for you: http://technet.microsoft.com/en-us/library/ee331009(EXCHG.80).aspx Regards! Gavin TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Agree with Gavin, if you have configured the Auditing than you should have event in application Log. Post the update Gulab | MCTS-MCITP Messaging: 2010 | MCTS-MCITP Messaging: 2007 | MCC 2011 | Skype: Gulab.Mallah

Is this Mailbox Auditing something you would run continuously in a production environment? Stephane Favre