Looking for possible deleted message  
Author Message
buddyGdawg





PostPosted: Mon Mar 31 16:47:33 CDT 2008 Top

Exchange Servers Admin >> Looking for possible deleted message

I have a simple setup of Exchange 2007 running, with Outlook 2007
clients. We've lost a message, and just trying to track down what
exactly happened to it.

The message came from one person outside of our organization, and he
sent the message directly to one person in our organization, and CC'd
another person inside our organziation.

Sender = person who sent the message
User1 = person who was the direct recipient of the message
User2 = person who was CC'd.

The Sender sent the message.. the message made it to User2's outlook
client, User1 cliams it never got to him. The Sender sends a second
email a week later asking why User1 hasn't responded yet. This second
email DOES make it to both User1 and User2's inbox.

So I have two messages to track. I found them in Exchange's Message
Tracker, and they are logged identical in the server. First logged
line is like this: EventID:Receive, Source: SMTP, Message ID: 1703928,
Recipient is User2. The next logged line is one second later like
this: EventID: Deliver, Source: STOREDRIV, Message ID: 1703928,
Recipient is User1.

I could not find any difference between the message that User1 got,
and the one he claims he did not get. From my stand point, it WAS
delivered to his client.. and I think he either deleted it, or it went
to Junk mail on his client. But I don't think the Junk mail is true,
since when the Sender sent the second message which made it to User1's
inbox.. he copied the text from the email that did no make it.. so
junk mail would've canned both emails if it was the culprate.

This user does use web access quite often while on the road if that
matters.. and his client maybe running in Cached mode (i'll check
tommorrow)

So my question to you is how can I check if the User deleted this
email.. or how can I further track the email from the server end of
it? I must figure this out, it was a very important email and lots of
people are looking for answers. Thanks -Kbalz

Exchange Server41  
 
 
Susan





PostPosted: Mon Mar 31 16:47:33 CDT 2008 Top

Exchange Servers Admin >> Looking for possible deleted message if Exchange message tracking says it was delivered, it was delivered. Your
only option is to logon to that mailbox, and do an "advanced find" with
Outlook for the message, and if it's not there, search the dumpsters for
each folder (http://support.microsoft.com/kb/886205/en-us). This will only
work if the message was sent/received during your DIR window. If it was
sen/received past your DIR window, you'd need to do a restore to an RSG,
then extract the mailbox data, including dumpster items, and search for
it...most likely, the user deleted it, or it was moved to another folder due
to a rule, or something like that...

--
Susan Conkey [MVP]





>I have a simple setup of Exchange 2007 running, with Outlook 2007
> clients. We've lost a message, and just trying to track down what
> exactly happened to it.
>
> The message came from one person outside of our organization, and he
> sent the message directly to one person in our organization, and CC'd
> another person inside our organziation.
>
> Sender = person who sent the message
> User1 = person who was the direct recipient of the message
> User2 = person who was CC'd.
>
> The Sender sent the message.. the message made it to User2's outlook
> client, User1 cliams it never got to him. The Sender sends a second
> email a week later asking why User1 hasn't responded yet. This second
> email DOES make it to both User1 and User2's inbox.
>
> So I have two messages to track. I found them in Exchange's Message
> Tracker, and they are logged identical in the server. First logged
> line is like this: EventID:Receive, Source: SMTP, Message ID: 1703928,
> Recipient is User2. The next logged line is one second later like
> this: EventID: Deliver, Source: STOREDRIV, Message ID: 1703928,
> Recipient is User1.
>
> I could not find any difference between the message that User1 got,
> and the one he claims he did not get. From my stand point, it WAS
> delivered to his client.. and I think he either deleted it, or it went
> to Junk mail on his client. But I don't think the Junk mail is true,
> since when the Sender sent the second message which made it to User1's
> inbox.. he copied the text from the email that did no make it.. so
> junk mail would've canned both emails if it was the culprate.
>
> This user does use web access quite often while on the road if that
> matters.. and his client maybe running in Cached mode (i'll check
> tommorrow)
>
> So my question to you is how can I check if the User deleted this
> email.. or how can I further track the email from the server end of
> it? I must figure this out, it was a very important email and lots of
> people are looking for answers. Thanks -Kbalz


 
 
Kbalz





PostPosted: Tue Apr 01 06:43:14 CDT 2008 Top

Exchange Servers Admin >> Looking for possible deleted message Thanks for your response, and just to double check based on the info I
posted, the message did in fact get delivered? If I didn't post enough
info, what else do I need to confirm that?


> if Exchange message tracking says it was delivered, it was delivered. =A0Y=
our
> only option is to logon to that mailbox, and do an "advanced find" with
> Outlook for the message, and if it's not there, search the dumpsters for
> each folder (http://support.microsoft.com/kb/886205/en-us). =A0This will o=
nly
> work if the message was sent/received during your DIR window. =A0If it was=

> sen/received past your DIR window, you'd need to do a restore to an RSG,
> then extract the mailbox data, including dumpster items, and search for
> it...most likely, the user deleted it, or it was moved to another folder d=
ue
> to a rule, or something like that...
>
> --
> Susan Conkey [MVP]
>
> - Show quoted text -