The Mysterious Missing Mail Folder

[trump...@gmail.com]

I am running a SBS 2003 server that has been running without any major
glitches for the better part of five years.

About a month ago, an employee came to me complaining that a mail
folder in his mailbox was missing. I attempted to find it using the
"recover deleted files" option since I have the server set to retain
deleted items for 30 days.

I could not find the folder or any of the missing emails in the
deleted items recovery location so I was forced to pull out a backup
of my exchange server and extract his complete mailbox into a .pst
using exmerge.

Exmerge got me the information the user was missing and everything was
back to normal. You wouldn't be hearing about this, but its now about
a month later and the guy is back to me AGAIN saying the folder is
missing again! Same problem, still can't find it in the deleted items
recovery location. I'll have to go back into an old backup and pull
out his information.

I want to get to the bottom of what is causing my user's problems. Is
this a data corruption issue, or a users issue. I wouldn't have been
supprised to find out that the user was deleting the folder without
knowing it, but I thought it would have come up in the deleted items
recovery section and I'm just not seeing it there.

Any ideas on what's causing the problem? Also, I only have 10 active
users on the server, is there some log function I can turn on so I can
track user's actions (such as move/delete/copy items). I"m assuming
the log function is there, I just don't know which one and I'm having
a hard time finding a real good explanation of each function and log
level explanation.

Thanks.

[Lanwench [MVP - Exchange]]

Do you have the DumpsterAlwaysOn reg hack on his PC? Remember, a deleted
folder won't show up as a folder in the dumpster - the *items* in it will
show up there though.

The user is deleting this folder accidentally, dollars to donuts.

[Joe Grover]

Do you have the Deleted Item Recovery enabled on all folders? My guess is
the folder and its contents are getting archived and removed (or just
removed due to autoarchive settings), which get hard deleted from their
original location and do not go to the Deleted Items folder.

<trump...@gmail.com> wrote in message
news:faa87517-9654-4c62...@h60g2000hsg.googlegroups.com...

[Martin Blackstone [MVP]]

Deleted item recovery should be on. I recommend 30 days.
Additionally dumpsteralwayson reg hack for OL2003 clients and earlier (on by
default in 2007).

I have yet to ever see this happen when it wasn't the user moving too fast
or being sloppy and accidently moving or deleting the folder. In fact I
would take a hard look at the other folders in the mailbox and wouldn't be
surprised to see it nested under one.

<trump...@gmail.com> wrote in message
news:faa87517-9654-4c62...@h60g2000hsg.googlegroups.com...

[trump...@gmail.com]

I"m not familier with the "DumpsterAlwaysOn reg hack" so I"m guessing
that its not on since I"m the only admin and unless I just don't
remember doing it, I"m sure it wasn't set.

I have the deleted item recovery set to 30 days.

When I looked at the user's computer (he's running outlook 2003), I
didn't see any items deleted after 10/1 and he swears the folder was
there wednesday.

Joe, what do you mean to have deleted items recovery enabled for all
folders? I thought it dealt with the mailbox and covered everything
in the mailbox. The folder that is missing was a mail folder that was
located as a sub-folder of the user's main mail folder.

[Joe Grover]

I'm sorry, my wording was kind of misleading. I was referring to the
DumpsterAlwaysOn setting.

By default in Outlook clients prior to 2007, the "Recover Deleted Items"
feature is only available on the Deleted Items folder. However, if a user
hard-deletes something (Shift+DEL), or something is removed via a script or
AutoArchive feature, it is not sent to Deleted Items, but remains in the
dumpster for that particular folder.

To enable the Dumpster feature for all folders, perform the following on the
client machine navigate to the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options

Create the following DWORD value:

DumpsterAlwaysOn

and set the value to 1.

Close out of the Registry Editor and re-open Outlook. Now the "Recover
Deleted Items" option in the Tools menu should be available on any folders.
Go to the parent folder of the missing folder and try it, and see if the
folder is there. If it is, you can recover it and its contents.

If that's where it is, it's likely his AutoArchive settings on the parent
folder is set to permanently delete old items (or he just gets Shift+DEL
happy).

<trump...@gmail.com> wrote in message
news:f13acbf9-4059-4238...@s9g2000prg.googlegroups.com...

[Susan]

see this:

http://support.microsoft.com/kb/246153/en-us

--
Susan Conkey [MVP]

<trump...@gmail.com> wrote in message
news:f13acbf9-4059-4238...@s9g2000prg.googlegroups.com...

[trump...@gmail.com]

thanks susan and joe. that helps clairify the dumpster always on
trick.

I'll apply that regedit, but I think its very unlikely that this user
knew shift+delete.

Does anybody know what logging I should turn on to enable me to track
if/when an item in a mailbox is deleted?

I verified that this user doesn't have auto-archive enabled and I'm
positive the only way this user did shift+del is by accident. I want
to know if there is a way that I can conclusivly tell him that he's an
idiot and to stop deleting his folders or tell him that I'm sorry
there was a database corruption and you lost your folder. I haven't
heard any noise from any other users about missing folders, but it
doesn't mean they aren't missing things.

thanks.

[Susan]

i don't believe there's a way to log every deleted email, and I don't think
you'd even want to see such a log, or dedicate the space to contain
one...that would no doubt be a huge daily file...

--
Susan Conkey [MVP]

<trump...@gmail.com> wrote in message
news:51d79ba5-8ed3-407c...@2g2000hsn.googlegroups.com...

[trump...@gmail.com]

On Oct 10, 1:54 pm, "Susan" <scon...@mgmmirage.nospam.com> wrote:
> i don't believe there's a way to log every deleted email, and I don't think
> you'd even want to see such a log, or dedicate the space to contain
> one...that would no doubt be a huge daily file...
>
> --
> Susan Conkey [MVP]
>

> <trump26...@gmail.com> wrote in message

>
> news:51d79ba5-8ed3-407c...@2g2000hsn.googlegroups.com...
>
>
>
> > thanks susan and joe.  that helps clairify the dumpster always on
> > trick.
>
> > I'll apply that regedit, but I think its very unlikely that this user
> > knew shift+delete.
>
> > Does anybody know what logging I should turn on to enable me to track
> > if/when an item in a mailbox is deleted?
>
> > I verified that this user doesn't have auto-archive enabled and I'm
> > positive the only way this user did shift+del is by accident.  I want
> > to know if there is a way that I can conclusivly tell him that he's an
> > idiot and to stop deleting his folders or tell him that I'm sorry

> > there was a database corruption and you lost yourfolder.  I haven't
> > heard any noise from any other users aboutmissingfolders, but it

> > doesn't mean they aren'tmissingthings.
>

> > thanks.- Hide quoted text -
>
> - Show quoted text -

I totally agree, but I only have a small user base and I would only
keep it on temporarily. I just wish I had a way to figure out if the
missing folder was done by the user or if I have another more serious
problem. I'm' 99% sure it was user error, but I don't want to make
any assumptions.

[Susan]

I would tend to believe 99% that it is indeed user error...

--
Susan Conkey [MVP]

<trump...@gmail.com> wrote in message
news:0b08791e-f764-41a5...@l64g2000hse.googlegroups.com...

[trump...@gmail.com]

more to the mystery.... I just checked his computer and
DumpserAlwaysOn was present in the regestry and set to 1.

What now? How can the folder/contents get deleted and not show up?
Its like the information just dissappeared.

[Martin Blackstone [MVP]]

<trump...@gmail.com> wrote in message
news:b39c4e03-33b3-4cca...@l64g2000hse.googlegroups.com...

So Deleted Item Retention was on? And the dumpster was empty??

[Susan]

you checked the dumpster for every folder? and you're sure the folder
didn't just get moved somewhere? you're certain you have DIR configured
correctly on this store?

--
Susan Conkey [MVP]

<trump...@gmail.com> wrote in message
news:b39c4e03-33b3-4cca...@l64g2000hse.googlegroups.com...

[trump...@gmail.com]

susan, the user only had 4 other sub folders so it was easy to check
every folder and it doesn't exist in any of them.

I'm sure the folder didn't just get moved because the folder that is
missing was a rather larger folder and I can see that his mailbox size
is now smaller than it was the day before. I can't say for certain
that I have DIR configured correctly... only setting I know of is the
setting to determine how long it exchange retains deleted items... I
have that set for 30 days and I do see items in the "Recover deleted
items" window when I check there, I just don't see the items I know
are missing. I HAVE NOT found a folder other than the deleted items
folder with anything in its "Recover deleted items" window, but I
assume that is because items would only show up there IF the user does
a hard delete (I tested this on my own mailbox and it is working such
that if I do a hard delete, the item does show up.)

I told the guy that he is going to have to wait until the weekend for
me to recover his data because "the way you deleted the data requires
a very complicated recovery process that might not be successful..."
I've actually got his data in a .pst already, but in case it was user
error, I want him to sweat over his lost data for a little so he might
be a little more careful in the future. I know the information he is
trying to get is not time critical, so the delay won't really adversly
affect him.

I have the data, so I"m not really concerned about the recovery, but
it is a little unnerving when things just disappear.

[Susan]

yes, it's annoying, and frankly, I have never seen email just disappear, by
itself...there is usually some intervention, via a process, a rule, or user
error...unless he's really just messing with your head, and deleting, then
actually PURGING the folder out of the dumpster...

--
Susan Conkey [MVP]

<trump...@gmail.com> wrote in message
news:8e65bdcc-616a-465f...@u65g2000hsc.googlegroups.com...

[Martin Blackstone [MVP]]

Yup!
Email just doesn't disappear. Ever.

"Susan" <sco...@mgmmirage.nospam.com> wrote in message
news:%23UCOgFy...@TK2MSFTNGP06.phx.gbl...

[Lanwench [MVP - Exchange]]

Martin Blackstone [MVP] <mar...@myrealbox.com> wrote:
> Yup!
> Email just doesn't disappear. Ever.

It is kept in your permanent record. The record that will follow you around
for the rest of your life.

<snip>

[Andy David {MVP}]

I keep all my email in my back pocket.

[Lanwench [MVP - Exchange]]

Oh. I thought that was a pick for your 'fro.

[Martin Blackstone [MVP]]

"Lanwench [MVP - Exchange]"
<lanw...@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
news:eQHIjm%23KJH...@TK2MSFTNGP05.phx.gbl...

I'm wearing cargo capri's

[Lanwench [MVP - Exchange]]

Martin Blackstone [MVP] <mar...@myrealbox.com> wrote:
> "Lanwench [MVP - Exchange]"
> <lanw...@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
> message news:eQHIjm%23KJH...@TK2MSFTNGP05.phx.gbl...
>> Andy David {MVP} <ada...@pleasekeepinngcheesebucket.com> wrote:
>>> On Sat, 11 Oct 2008 11:45:11 -0400, "Lanwench [MVP - Exchange]"
>>> <lanw...@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote:
>>>
>>>> Martin Blackstone [MVP] <mar...@myrealbox.com> wrote:
>>>>> Yup!
>>>>> Email just doesn't disappear. Ever.
>>>>
>>>> It is kept in your permanent record. The record that will follow
>>>> you around for the rest of your life.
>>>>
>>>> <snip>
>>>>
>>>
>>> I keep all my email in my back pocket.
>>
>> Oh. I thought that was a pick for your 'fro.
>>
> I'm wearing cargo capri's

Apostrophe fault aside, I'm glad you're secure enough to do that. Now please
stay on topic.

To the OP: I'm inclined to think this is a PEBKAC issue, but just in case,
run a scanost.exe against his offline file.

[Martin Blackstone [MVP]]

"Lanwench [MVP - Exchange]"
<lanw...@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
>>>

>> I'm wearing cargo capri's
>
> Apostrophe fault aside, I'm glad you're secure enough to do that.

Thanks Ed.

[Rich Matheisen [MVP]]

On Fri, 10 Oct 2008 14:32:03 -0700 (PDT), "trump...@gmail.com"
<trump...@gmail.com> wrote:

[ snip ]

>are missing. I HAVE NOT found a folder other than the deleted items
>folder with anything in its "Recover deleted items" window, but I
>assume that is because items would only show up there IF the user does
>a hard delete (I tested this on my own mailbox and it is working such
>that if I do a hard delete, the item does show up.)

Select the top of the mailbox hierarchy and then check the "Recover
Deleted Items". If the deleted folder wasn't a sub-folder it'll only
be found when lookng at the parent folder (which is, in this case, the
root of the mailbox). Make sure you're looking at the "Folders" view
of the mailbox when you do this. A "hard deleted" folder /will/ show
up in the "Recover Deleted Items" view if it's there (as it will if
you select any other folder).

You might want to disable the "Today" view of the mailbox, too. I've
found lots of "missing" things in the root folder that were covered up
by the "Today" view.

>I told the guy that he is going to have to wait until the weekend for
>me to recover his data because "the way you deleted the data requires
>a very complicated recovery process that might not be successful..."
>I've actually got his data in a .pst already, but in case it was user
>error, I want him to sweat over his lost data for a little so he might
>be a little more careful in the future. I know the information he is
>trying to get is not time critical, so the delay won't really adversly
>affect him.
>
>I have the data, so I"m not really concerned about the recovery, but
>it is a little unnerving when things just disappear.

Does the guy have a PST in his profile? Does he have any PSTs at all
on his machine? Was the folder moved there?
---
Rich Matheisen
MCSE+I, Exchange MVP

[Ed Crowley [MVP]]

That wasn't me. I corrected you in another thread.
--
Ed Crowley MVP
"There are seldom good technological solutions to behavioral problems."
.

"Martin Blackstone [MVP]" <mar...@myrealbox.com> wrote in message
news:OkNJNqAL...@TK2MSFTNGP03.phx.gbl...

[Martin Blackstone [MVP]]

I appreciate all your hard work.

"Ed Crowley [MVP]" <curs...@nospam.net> wrote in message
news:uRVWOmJL...@TK2MSFTNGP05.phx.gbl...

[Andy David {MVP}]

On Sun, 12 Oct 2008 12:38:58 -0700, "Martin Blackstone [MVP]"
<mar...@myrealbox.com> wrote:

>I appreciate all your hard work.

He's my favorite MVP.

[trump...@gmail.com]

susan, since the guy didn't even know about the recovery folder, I
highly doubt that he purged items from it... also, he actually does
want the emails back, they aren't anything he would want to hide.

lanwrench, I"m not familiar with the term "PEBAK", but I'll run the
scan on the ost file on monday. His computer is a 5-7 year old dell
computer so I wouldn't be supprised if that HDD is starting to throw
out some errors.

rich, the user doesn't have a pst file in his profile and I've checked
the rules and the only rule he has is to throw emails from our
internal emails into the now missing folder. Also, I'm sure the
folder and its contents are GONE from his mailbox and not misplaced
through the today view because there was a change in mailbox size
corrisponded with the loss of the folder.

I believe I mentioned it before... but this user lost THE SAME FOLDER
(and maybe another folder too, but I can't remember) about two months
ago. At the time, I just assumed he did something with it and didn't
look into it much and just recovered his data from an old backup, but
I don't think this user is doing anything malicious and I"m sure he
doesn't know how to do anything advanced on purpose... this guy sorts
his mailbox by sender because he hasn't figured out how to work with
folders. I saw what he was doing in one huge inbox and tried to get
him to make folders for his largest groups of people, but the best I
could get him to do was let me set up the rule to put all his internal
mail into a folder.

[Rich Matheisen [MVP]]

On Sun, 12 Oct 2008 17:53:05 -0700 (PDT), "trump...@gmail.com"
<trump...@gmail.com> wrote:

[ snip ]

>lanwrench, I"m not familiar with the term "PEBAK",

That's usually "PEBKAC" (Problem Exists Between Keyboard And Chair) or
"PEBCAK" (Problem Exists Between Chair And Keyboard).

[ snip ]

>rich, the user doesn't have a pst file in his profile and I've checked
>the rules and the only rule he has is to throw emails from our
>internal emails into the now missing folder. Also, I'm sure the
>folder and its contents are GONE from his mailbox and not misplaced
>through the today view because there was a change in mailbox size
>corrisponded with the loss of the folder.

Yup. I understand that. But you didn't say you checked the root of the
mailbox with the "Tools | recover Deleted Items..." menu. If you did,
then okay.

If you suspect there's a probem with the mailbox then move it to
another database. If you have only E2K3 standard it might be easier to
stand up another server running on a PC and move the mailbox to it and
then back instead of the alternative (running isinteg and hoving to
take the database offline).

[Missy Koslosky]

Can you all please keep on topic?

kthxbye
"Andy David {MVP}" <ada...@pleasekeepinngcheesebucket.com> wrote in message
news:bfm4f41lqolkiakiu...@4ax.com...

[Andy David {MVP}]

On Sun, 12 Oct 2008 22:26:44 -0700, "Missy Koslosky"
<mi...@DONTSPAMMEmvps.org> wrote:

>Can you all please keep on topic?

I blame Ed.

[trump...@gmail.com]

rich, I"m running SBS2k3, so its exchange std. Its looking more and
more like its not PEBAK (thanks for the definition btw, I like that).
I ran scanost.exe (tried twice actually) this morning and the results
of the log are copied below... the folder the user is missing is
called "Company Mail" and it does show up listed in the scan... What
is the story with the errors in red saying "The message with the
subject 'Hidden Message' exists in the offline folder file but not in
your mailbox on the Microsoft Exchange Server"? That happened after
every scan of the company mail folder.

9:23:58 Beginning offline folder file integrity check.

9:23:58 Performing initial synchronization.

9:23:58 Synchronizer Version 11.0.8200

9:23:58 Synchronizing Mailbox 'luyen'

9:23:58 Synchronizing Hierarchy

9:23:58 Synchronizing server changes in folder 'Deleted Items'

9:23:58 Downloading from server 'server.redactedforusenet.local'

9:23:58 1 item(s) changed read-state in offline folder

9:23:58 Done

9:23:58 Performing integrity detection scan.

9:23:58 Scanning hierarchy.

9:23:58 Scanning folder Shortcuts.

9:23:58 Scanning folder Views.

9:23:58 Scanning folder Views.

9:23:58 Scanning folder Inbox.

9:23:59 Scanning folder Sent Items.

9:23:59 Scanning folder Junk E-mail.

9:23:59 Scanning folder cage.

9:23:59 Scanning folder Old mails.

9:23:59 Scanning folder Company Mail.

9:24:01 The message with the subject 'Hidden Message' exists in
the offline folder file but not in your mailbox on the Microsoft
Exchange Server.

9:24:01 Done

9:24:01 Performing phase 1 synchronization.

9:24:01 Synchronizer Version 11.0.8200

9:24:01 Synchronizing Mailbox 'luyen'

9:24:01 Done

9:24:01 Scanning for problems in phase 1 synchronization.

9:24:01 Scanning folder Inbox.

9:24:01 Scanning folder Sent Items.

9:24:01 Scanning folder Junk E-mail.

9:24:01 Scanning folder cage.

9:24:01 Scanning folder Old mails.

9:24:01 Scanning folder Company Mail.

9:24:03 The message with the subject 'Hidden Message' exists in
the offline folder file but not in your mailbox on the Microsoft
Exchange Server.

9:24:03 Done

9:24:03 Performing phase 2 synchronization.

9:24:03 Synchronizer Version 11.0.8200

9:24:03 Synchronizing Mailbox 'luyen'

9:24:03 Done

9:24:03 Scanning for problems in phase 2 synchronization.

9:24:03 If problems are found in this scan, they must be fixed
manually.

9:24:03 Scanning folder Inbox.

9:24:03 Scanning folder Sent Items.

9:24:03 Scanning folder Junk E-mail.

9:24:03 Scanning folder cage.

9:24:04 Scanning folder Old mails.

9:24:04 Scanning folder Company Mail.

9:24:05 The message with the subject 'Hidden Message' exists in
the offline folder file but not in your mailbox on the Microsoft
Exchange Server.

9:24:05 Done

[Rich Matheisen [MVP]]

On Mon, 13 Oct 2008 06:35:49 -0700 (PDT), "trump...@gmail.com"
<trump...@gmail.com> wrote:

>rich, I"m running SBS2k3, so its exchange std. Its looking more and
>more like its not PEBAK (thanks for the definition btw, I like that).
>I ran scanost.exe (tried twice actually) this morning and the results
>of the log are copied below... the folder the user is missing is
>called "Company Mail" and it does show up listed in the scan... What
>is the story with the errors in red saying "The message with the
>subject 'Hidden Message' exists in the offline folder file but not in
>your mailbox on the Microsoft Exchange Server"? That happened after
>every scan of the company mail folder.

So, does the missing folder show up if the user doesn't use cached
mode in Outlook?

Are there errors reported in the "Sync Issues" folders (working in
cached-mode)?

I'd drop out of cached mode, blow away .ost file, verify the folders
are there, and then put the client back into cached mode and wait for
the resync to finish.

[trump...@gmail.com]

GOOD NEWS!

Thanks for the help everybody. Rich, it looks like going out of
cached mode did the trick. The user did move the folder (to the
journal section), but it didn't show up in the journal section until I
turned off the cache and started up outlook again.

It was easy to find the folder location just by clicking on the
"folder sizes" link below the navigation pane. I know I tried that
when I originally looked for the files, and it didn't show up, but
when the folder was back it immediately grabbed my attention.

Thanks again.

Andrew