I've got a customer who has managed to delete items almost 7 months ago now, but has only just realised they are missing from the archive.
Now I'm not trying to get them back, but I am trying to prove they deleted them.
I've restored a backup of the Vault Store Database from that time and looked in the JournalDelete table (due to length of time, these have been cleared from the live db). I can see the items they deleted and I can see that they are DeletionStatus of 1 which is hard delete and I know DeletionReason 1 is client, but I'm seeing 3 for all the items.
EDIT: Further digging has found this...
deletionstatus 0 – soft delete, not deleted from storage
deletionstatus 1 – hard delete, deleted from storage
deletionreason 0 – none
deletionreason 1 – by user
deletionreason 2 – by expiry
deletionreason 3 – by system
I have deletionstatus 1 and deletionstatus 3. So hard delete and by system. I need to work out why this is. TSM was setup to migrate CAB files to tape for a short period, could it be that these files are no longer available on the tape and thus EV has cleaned them out? Or could it be that AV exclusions are wrong and it's cleaned them out for that reason? Or is it more likely that an admin has run EVSVR in repair mode?
Any help is greatly appreciated.