I have a user who suddenly lost all mail from before two days ago. I have confirmed this issue on multiple machines. It is not a view issue. When I do get-mailboxstatistics she shows as having only about 2800 items. I did an export on her mailbox and wham! All her mail is in the export far more that 2800 items. So through Outlook and get-mailboxstatistics and it shows significantly less email. I do a mailbox export and get far more email. Why is there a disconnect between these two? Why is the mail present in the export but not available through Outlook? How do I fix this? Your assistance is much appreciated.

Could be that the export is pulling out hard and soft deleted items that have not yet passed the retention date, i.e. did the user accidently delete some things with Shift Delete? OR cound be that the PST/OST is corrupt?? OR the Profile is corrupt? Have you tried accessing the account with OWA to see if the mail shows up? If it does then I would think its a corrupt profile, PST or OST. Troy Werelius Lucid8

1. I don't think the user is sophisticated email to shift delete, but I will ask. 2-3 The issue is happening on multiple machines. So it is not an ost/pst/profile issue. 4. OWA does not show the missing mail. My guess was that auto-archive ran and exchange does not purge these items until nightly maintenance. But I did not find any evidence of an archive file.

Hmm ok so; Are you by chance running the mailbox management service to auto-delete certain items? Did the user by chance setup Outlook rules the are then deleting them? If you want to see if items have been shift-delete, check out Lucid8's DigiScope http://www.lucid8.com/product/digiscope.asp it does allot more then what you looking for, but if get the 30-day Demo license you can see items in the users mailbox that have been shift-deleted because within the DigiScope interface they will show up as grayed out and you will see them in the original location not the deleted items folder, although I suppose they could be hard deleted from there as well. Anyway just an idea to double check where the items went without having to ask the user etc. Troy Werelius Lucid8

OK, I finally had a chance to get on this user's computer. No rules, no autoarchive, no filters. Again, get-mailboxstatistics says 2800 but when I export I get far more than 2800 items. The missing mail is there. It just isn't available through owa or outlook. Any ideas.

When you export the email into a PST where do the misisng items show up, i.e. Inbox, Inbox/Personal etc?

On Mon, 20 Sep 2010 20:10:22 +0000, Troy Werelius wrote: >When you export the email into a PST where do the misisng items show up, i.e. Inbox, Inbox/Personal etc? .. . . "deleted items"? The *user* doesn't have to use shift+delete -- all they have to do is use a POP3 or IMAP4 client or hold down the shift key and click "delete". It could also be right in the root of the mailbox. I've seen that happen too many times. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Thanks so much for the input. The only missing items I notice return in the export are in the Inbox and the Deleted Items. (I have not checked all the other locations.) Through Outlook her inbox (no matter what machine I connect on) shows about 10 items, all from the last two days. When exported, she has over 80 items in her inbox dated from over a month ago up to and including the 10 items she sees. She indicates a similar effect on many subfolders, but I did not check. According to the Exchange Management Console GUI, she has 60Megs of data. When I export her mailbox, it is 500Megs. (I kind of expected some minor deviation but not 8 times as much.) The user only connects to exchange through Outlook, OWA and Blackberry. I am going to disconnect and reconnect the mailbox next. I am just at a loss. It seems minorly corrupt. Your continued feedback and suggestions are much appreciated.

I suppose it could be a POP3 or IMAP client like Rich says, but IMO if that were the case it would consistently remove the messages not just some. Sounds to me like they are definitely getting hard deleted As previously stated If you want to see if items have been shift-delete, check out Lucid8's DigiScope http://www.lucid8.com/product/digiscope.asp it does allot more then what you looking for, but if you get the 30-day Demo license you can see items in the users mailbox that have been shift-deleted because within the DigiScope interface they will show up as grayed. Doing the above will most definitely confirm they are being hard deleted without having to do a restore. Next comes the fun part, i.e. figuring out how this is happening I would ask her if she has been doing any Shift-Delete actions or has programmed any Macros to do this Then I would look at her BB, could be she has a rule within her BB to take actions when read or responded to OR she could have a programmed macros in use on BB that is making this happen as well. I do not think you have a mailbox corruption issue since the items are there but appear to just be hard deleted and are also recoverable Will certainly be interesting to hear what the end result is. Troy Werelius Lucid8

I am not clear on why you think they are hard deleted. They appear in the export in the inbox, not in the deleted items or elsewhere. Exchange's export process clearly sees them as still in the Inbox. On the other hand, Outlook, OWA and Blackberry don't see them in the inbox. This user is unfamiliar with shift delete and not sophisticated enough to have macros. I honestly am headed toward exporting the mailbox, deleting the mailbox, creating a mailbox and importing the export. Any other ideas.

Soft deleted items are first moved to the Deleted Items Folder where they sit until the user empties the deleted items. When the emptied deleted items have aged past the deleted item retention period then they are non-recoverable. Hard Deleted items are note moved, instead they are marked for deletion and hidden from view in the very place they were hard deleted from. They then age against the deleted item retention and are purged once they pass that point. NOTE; Exchange 2010 works much differently than the above process here is more about the Hard vs Soft deletion process http://www.lucid8.com/download/documentation/DSWebHelp/MNG/Restoring_Hard_and_Soft_Deleted_Items.htm So in short base upon your description I think these are somehow being hard deleted because; They are not viewable in OWA or Outlook. Yet when you recover them to PST they exist within the same folder structure they were previously placed. Granted that I could be wrong here and something else is happening, hence the reason I suggested you download the DigiScope product in demo mode so that you could view it as an administrator in read only mode and validate the theory. If the missing items are grayed out then they are hard deleted items plain and simple. How they got that way is a whole other issue that needs to be tracked down. If they are NOT seen as grayed out items or not seen at all well then I am at a loss of what is happening and perhaps am missing a piece to the puzzle. If the above does not show them to be hard deleted items I guess I would suggest that you try to move the users mailbox to another store and see if that clears up the issue. But first I would validate that these ARE or ARE NOT hard deleted items because if they are then moving the mailbox will do you no good. Troy Werelius Lucid8

On Tue, 21 Sep 2010 01:43:48 +0000, mikainsb wrote: > > >Thanks so much for the input. > >The only missing items I notice return in the export are in the Inbox and the Deleted Items. (I have not checked all the other locations.) Through Outlook her inbox (no matter what machine I connect on) shows about 10 items, all from the last two days. When exported, she has over 80 items in her inbox dated from over a month ago up to and including the 10 items she sees. She indicates a similar effect on many subfolders, but I did not check. Any chance that there are filters set on the views? You might try removing any filters (read/unread items, only messages from the last X days, messages with certain sizes, attachemts, etc.) and see if those messages show up. >According to the Exchange Management Console GUI, she has 60Megs of data. When I export her mailbox, it is 500Megs. (I kind of expected some minor deviation but not 8 times as much.) Well, if the messages in the Deleted Items folder were recovered from the dumpster then they wouldn't be counted in the size of the mailbox in the EMC. >The user only connects to exchange through Outlook, OWA and Blackberry. Wanna bet the BB the problem> :-) >I am going to disconnect and reconnect the mailbox next. I am just at a loss. It seems minorly corrupt. Move the mailbox to another database and see if the size changes. If this is E2K7 I don't think the items in the dumpster will move to the new database. If they don't then your export to a PST will be closer to the size of the mailbox you see in the EMC. >Your continued feedback and suggestions are much appreciated. FYI, if there are lots of NDRs and read receipts the size of the PST can be considerably larger than the size you see in the EMC. Unless somethings changed, each of those types of messages will hav a copy of the message and a copy of the form needed to view the message. Forms are way bigger than the message contents. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

On Tue, 21 Sep 2010 02:20:17 +0000, mikainsb wrote: >I am not clear on why you think they are hard deleted. They appear in the export in the inbox, not in the deleted items or elsewhere. From the "Export-Mailbox" help: "The Export-Mailbox cmdlet also exports messages from the dumpster. Messages from the dumpster are converted to regular items in the folder or .pst file to which you export data." >Exchange's export process clearly sees them as still in the Inbox. On the other hand, Outlook, OWA and Blackberry don't see them in the inbox. In Outlook, select the Inbox and then use the "Tools | Recover deleted items.." menu. Anything there? The "Deleted Items" folder will, of course, have lots of recoverable items. >This user is unfamiliar with shift delete and not sophisticated enough to have macros. > >I honestly am headed toward exporting the mailbox, deleting the mailbox, creating a mailbox and importing the export. I'd say, at this point, you're headed in the wrong direction. >Any other ideas. All on one line: get-mailboxstatistics <mailboxname> | fl deleteditemcount,totaldeleteditemsize --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

I want to thank everyone for their input and explanations. Unfortunately I ran out of time to keep trying things, so I did export the mailbox, disconnect it, recreate a mailbox for that user and import the mailbox. Obviously not ideal. Now, thanks to you guys, I have a better understanding of how deleted items work, namely the fact that they do appear in the export in their original location. I no doubt could have saved myself a lot of trouble. Next time... Thanks again.