Deleting Archived Items in Exchange
Yesterday I had a call from an employee that he missed about 2000 eMails. I checked his Mailbox and his Archive :
Outlook Shows about 2000 eMails (Stubfiles) <=> Archiveexplore shows only 7
After some research I found out, that he moved the missing emails out of his Outlookfolder into a network folder. For me, it is clear that if you move (Outlook 2007) than you delete the items from the original place (Outlook does not warn you, that you also delete mails in the archive as a normal deletion would do).
If you just drag and drop the items, than you move only stubfiles and not the email itself. So he restored the Item by moving them back.(!)
In the background EV marked the item as deleted and 'moved' them in the recovery bin. so far everything is ok.
The employee tried to open the the email -> and everything worked fine - for him : everything is ok!!!!
So time goes by and we reached the end of our Recovery time. All the 2000 emails are gone and for us no chance to restore them !
I know that we never should delete Items and so on, but this are our directives.
Is there a setting that user could not recover mails from the "Recover bin" by open the item, or at least get a warning ? So that he can make a call for undelete all his archived deletd mails. ?
dTrace shows me a Savesetnumber "201203020708536~201112020727150000~Z~B0B3FD2BE424D6D715B0E3C20E7DE901" (could not found)
Is there a way to get the physical file out of these number through a restore of an older DB version?
Is there a way to get the savesetids out of the stubfiles ?
As you can mention, he wasn't very happy about my answer that all his emails are lost .!