Video Screencast Help

Deleting Archived Items in Exchange

Created: 25 Oct 2012 • Updated: 15 Nov 2012 | 10 comments
This issue has been solved. See solution.

Hallo,

Yesterday I had a call from an employee that he missed about 2000 eMails. I checked his Mailbox and his Archive :

Outlook Shows about 2000 eMails (Stubfiles) <=> Archiveexplore shows only 7

After some research I found out, that he moved the missing emails out of his Outlookfolder into a network folder. For me, it is clear that if you move (Outlook 2007) than you delete the items from the original place (Outlook does not warn you, that you also delete mails in the archive as a normal deletion would do).

If you just drag and drop the items, than you move only stubfiles and not the email itself. So he restored the Item by moving them back.(!)

In the background EV marked the item as deleted and 'moved' them in  the recovery bin. so far everything is ok.

The employee tried to open the the email  -> and everything worked fine - for him : everything is ok!!!!

So time goes by and we reached the end of our Recovery time. All the 2000 emails are gone and for us no chance to restore them !

I know that we never should delete Items and so on, but this are our directives.

Is there a setting that user could not recover mails from the "Recover bin" by open the item, or at least get a warning  ?  So that he can make a call for undelete all his archived deletd mails. ?

 

dTrace shows me a Savesetnumber "201203020708536~201112020727150000~Z~B0B3FD2BE424D6D715B0E3C20E7DE901"  (could not found)

Is there a way to get the physical file out of these number through a restore of an older DB version?

Is there a way to get the savesetids out of the stubfiles ?

 

As you can mention, he wasn't very happy about my answer that all his emails are lost .!

Kind regards

Andreas

Comments 10 CommentsJump to latest comment

JesusWept3's picture

Really?! Moving a shortcut outside of the mailbox triggers a delete? Are you absolutely sure about that??
None of that scenario makes any sense

Would suggest just using virtual vault as it'd solve a lot of these issues, but still I just can't wrap my head around the behavior you described

What version of EV server and client?

NSeel's picture

Hi,

We have tried this scenrio on EV 10.01 with MS Outlook 2007, Exchange Sever 2010, EV Client 9 / Ev Client 8

Moving an email (Stub File) on e.g. Destop removes the eMail from the Outlook Folder and increase the Counter on "Number of marked items for deletion" in the Archive Properties of the user.

 

Addreas

 

JesusWept3's picture

hmmmm, will have to test that as I've never heard of that behavior before, best thing as a work around i can suggest is set it delete shortcut only and not the archived item as well

GertjanA's picture

Interesting..

In your desktop policy, what is the setting at Tab Options, Outlook Behaviour when Shortcut is Deleted?

 

 

Thank you, Gertjan, MCSE, MCITP,MCTS, SCS, STS
Company: www.t2.nl

www.quadrotech-it.com

www.symantec.com/vision

JesusWept3's picture

oh hang on a minute
So he dragged and dropped the messages from the mailbox, and then deleted the shortcut after?
Because i tried Moving an item from outlook on to the desktop and the original item remained in the mailbox, however if the user is then going ahead and deleting the email afterwards then that is 100% expected behavior.

Your best bet is to change the desktop policy to either do a delete of the shortcut only or ask the user, so that it will ask whether you want to delete the shortcut AND the archived item or just the shortcut only

NSeel's picture

Hi,

If I try this on my computer than the item will remain in outlook and I had to delete the emails in a second step. (Outlook 2010 EV 10.02). If I do this on an older Installation Outlook 2007 Ev 8 than I had the behavior I described in my first statement.

 

As we are not responsible for our client (we just can give some recommendations) I'm not shure which version of software the client had (it happend more than 100 days ago ! -our settings for hold deleted items is 99 days).

I agree with you that "not allow deletion" would be the best solution to prevent further problems. unfortunately to change our policy-settings would mean to run through several internal processes including recalculation of storage and costs. (not my part)

For my questions, is there a way to get the physical File ? I'm pretty shure, that some (many) of the lost mails are also archived in other mailboxes from different users. Can I "renew" the link ?

 

Kind regards Andreas

 

JesusWept3's picture

If your backup solution can restore *only* files that do not exist on the disk, you can do that and run EVSVR and have it reimport DVS Files.

Unfortunately though due to the complexity of how EV Shares email across vault stores, its not just as simple as putting a single file back in a location and it being picked up

i.e a single email that has several attachments maybe in different locations across different servers, and when EV goes ahead and deletes the email (if eligible) will delete it from all of those locations, it will also delete the content from the index and from the database

So you have to restore the files to all their different locations, then run EVSVR to recreate the db entries and then recreate the index entries

If its really really important, your best bet would to be restore the entire environment to a DR site, then export the users mailbox to PST

NSeel's picture

These are bad news. We only have a few days back for desaster recovery, our archive has a size of 10 tb. We thought, that when someone deletes an archived email with an alert that this is irreversible task he knows what he is doing. This is the first time that this happend by - let's say - an accident. We never thought of this.

My last hope was to find a way to get some usable information out of the stubfiles (these we still have) and find all identical emails and match them again.

 

The next thing is to ckeck what happens when somone enables autoarchving in outlook. I know that when we activate the ev-policy for a user we should dissable this "feature" but who knows ...

Is there aa easy way to undelete all mails marked for deletion ?

eg

 

 

JesusWept3's picture

if anything is in the dumpster, go to the properties of the users archive, go to "Deleted Items" tab and there is a Recover Items button

And auto archiving will not cause an issue, the fact is the guy they physically hit delete on the items, it wasnt simply just cutting and pasting out of the mailbox

SOLUTION
NSeel's picture

Hi,

thanks for the answer. I know how to recover the dumpster for one person, but we have more than 8 000. is there a way to get a list of all users who have items in the dumpster and "recover"all of them. (DB modification or something like that?)

 If I must do this on the regular way it'll take a long time .

eg.