Thanks all for the responses received. After "interrogating" each user to the nth degree it turned out one of them had moved the missing content to his own mailbox without telling the others. Idiot. Via the MS exchange newsgroup I also found an answer to my query about using Exchange logs to audit mailbox transactions at an item level;
Response from MS; *"There's no item-level auditing in Exchange (for items in a user mailbox). Journaling is an option, as are archiving tools from partners."* Cue Homer Simpson d'oh!! Guess it's time we splash some cash on an enterprise grade e-mail archiving solution. Death to PSTs!! Woohoo!! Mmmmm doughnuts.... On Mon, Dec 15, 2008 at 4:52 PM, cs <chr...@gmail.com> wrote: > Ah - good point. I haven't checked each individual's deleted items folder > yet. I'll have a look. > > On Mon, Dec 15, 2008 at 4:35 PM, Sherry Abercrombie <saber...@gmail.com>wrote: > >> Just a note on shared mailboxes, if someone has deleted the emails in >> question, then the deleted emails will show in their Outlooks deleted items >> folder, not the deleted items folder of the shared mailbox. >> >> On Mon, Dec 15, 2008 at 10:29 AM, cs <chr...@gmail.com> wrote: >> >>> Firstly apologies for the long post. >>> >>> I have a user ranting on about a bunch of e-mail that "mysteriously" >>> disappeared from a shared mailbox. Naturally, I've been summoned to >>> investigate. At this stage of my analysis I can't rule out the possibility >>> that one of 3 users have inadvertently moved the missing e-mail from the >>> mailbox into a PST file (albeit either manually or automatically via Outlook >>> 2003's AutoArchive). I've tried using Outlook's Deleted Item Recovery add-in >>> to find out if the e-mail was deleted but suffice there is nothing available >>> to recover (which makes me think that the content was moved not deleted). >>> >>> Before I trawl through any PST filess located on each user PC I was >>> wondering if there is any way to query Exchange to determine what specific >>> "actions" were taken around the specific point in time prior to the e-mail >>> disappearing, i.e. if e-mail A is moved from a mailbox to a PST, is the >>> specific move transaction logged on the server somewhere? Also, does Outlook >>> 2003's AutoArchive contain any client/server side logging functionality? >>> >>> Ultimately I can restore a mailstore backup to a recovery storage group >>> to retrieve the missing e-mail, but I've been specifically asked by >>> management to tell them why and how the content was originally >>> moved/deleted. >>> >>> Environment is Exchange 2003, native mode AD >>> >>> Hope that makes some degree of sense. Thanks in advance for any >>> help/pointers. >>> >>> >>> >>> >>> >>> >> >> >> -- >> Sherry Abercrombie >> >> "Any sufficiently advanced technology is indistinguishable from magic." >> Arthur C. Clarke >> >> >> >> >> >> > > > > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
