How do you find what objects have been retrieved from the Archive in the last 48 hours?
I'm new to EV (inherited it last month) and we just had an issue where an FSA protected volume suddenly lost 250GB of space over the weekend. We show that no one added that much data to the volume so the only explination we can come up with is someone or something triggered a restore from archive for the 250 GB. Being new to EV, however, I can't figure out how to prove this or find what person or process casued it assuming it was EV. I've looked at the reports and they seem weak on this type of need and I found out we do not have auditing turned on.
Can anyone help?