About a month ago, an employee came to me complaining that a mail
folder in his mailbox was missing. I attempted to find it using the
"recover deleted files" option since I have the server set to retain
deleted items for 30 days.
I could not find the folder or any of the missing emails in the
deleted items recovery location so I was forced to pull out a backup
of my exchange server and extract his complete mailbox into a .pst
using exmerge.
Exmerge got me the information the user was missing and everything was
back to normal. You wouldn't be hearing about this, but its now about
a month later and the guy is back to me AGAIN saying the folder is
missing again! Same problem, still can't find it in the deleted items
recovery location. I'll have to go back into an old backup and pull
out his information.
I want to get to the bottom of what is causing my user's problems. Is
this a data corruption issue, or a users issue. I wouldn't have been
supprised to find out that the user was deleting the folder without
knowing it, but I thought it would have come up in the deleted items
recovery section and I'm just not seeing it there.
Any ideas on what's causing the problem? Also, I only have 10 active
users on the server, is there some log function I can turn on so I can
track user's actions (such as move/delete/copy items). I"m assuming
the log function is there, I just don't know which one and I'm having
a hard time finding a real good explanation of each function and log
level explanation.
Thanks.
Do you have the DumpsterAlwaysOn reg hack on his PC? Remember, a deleted
folder won't show up as a folder in the dumpster - the *items* in it will
show up there though.
The user is deleting this folder accidentally, dollars to donuts.
<trump...@gmail.com> wrote in message
news:faa87517-9654-4c62...@h60g2000hsg.googlegroups.com...
I have yet to ever see this happen when it wasn't the user moving too fast
or being sloppy and accidently moving or deleting the folder. In fact I
would take a hard look at the other folders in the mailbox and wouldn't be
surprised to see it nested under one.
<trump...@gmail.com> wrote in message
news:faa87517-9654-4c62...@h60g2000hsg.googlegroups.com...
I have the deleted item recovery set to 30 days.
When I looked at the user's computer (he's running outlook 2003), I
didn't see any items deleted after 10/1 and he swears the folder was
there wednesday.
Joe, what do you mean to have deleted items recovery enabled for all
folders? I thought it dealt with the mailbox and covered everything
in the mailbox. The folder that is missing was a mail folder that was
located as a sub-folder of the user's main mail folder.
By default in Outlook clients prior to 2007, the "Recover Deleted Items"
feature is only available on the Deleted Items folder. However, if a user
hard-deletes something (Shift+DEL), or something is removed via a script or
AutoArchive feature, it is not sent to Deleted Items, but remains in the
dumpster for that particular folder.
To enable the Dumpster feature for all folders, perform the following on the
client machine navigate to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options
Create the following DWORD value:
DumpsterAlwaysOn
and set the value to 1.
Close out of the Registry Editor and re-open Outlook. Now the "Recover
Deleted Items" option in the Tools menu should be available on any folders.
Go to the parent folder of the missing folder and try it, and see if the
folder is there. If it is, you can recover it and its contents.
If that's where it is, it's likely his AutoArchive settings on the parent
folder is set to permanently delete old items (or he just gets Shift+DEL
happy).
<trump...@gmail.com> wrote in message
news:f13acbf9-4059-4238...@s9g2000prg.googlegroups.com...
http://support.microsoft.com/kb/246153/en-us
--
Susan Conkey [MVP]
<trump...@gmail.com> wrote in message
news:f13acbf9-4059-4238...@s9g2000prg.googlegroups.com...
I'll apply that regedit, but I think its very unlikely that this user
knew shift+delete.
Does anybody know what logging I should turn on to enable me to track
if/when an item in a mailbox is deleted?
I verified that this user doesn't have auto-archive enabled and I'm
positive the only way this user did shift+del is by accident. I want
to know if there is a way that I can conclusivly tell him that he's an
idiot and to stop deleting his folders or tell him that I'm sorry
there was a database corruption and you lost your folder. I haven't
heard any noise from any other users about missing folders, but it
doesn't mean they aren't missing things.
thanks.
--
Susan Conkey [MVP]
<trump...@gmail.com> wrote in message
news:51d79ba5-8ed3-407c...@2g2000hsn.googlegroups.com...
I totally agree, but I only have a small user base and I would only
keep it on temporarily. I just wish I had a way to figure out if the
missing folder was done by the user or if I have another more serious
problem. I'm' 99% sure it was user error, but I don't want to make
any assumptions.
--
Susan Conkey [MVP]
<trump...@gmail.com> wrote in message
news:0b08791e-f764-41a5...@l64g2000hse.googlegroups.com...
What now? How can the folder/contents get deleted and not show up?
Its like the information just dissappeared.
So Deleted Item Retention was on? And the dumpster was empty??
--
Susan Conkey [MVP]
<trump...@gmail.com> wrote in message
news:b39c4e03-33b3-4cca...@l64g2000hse.googlegroups.com...
I'm sure the folder didn't just get moved because the folder that is
missing was a rather larger folder and I can see that his mailbox size
is now smaller than it was the day before. I can't say for certain
that I have DIR configured correctly... only setting I know of is the
setting to determine how long it exchange retains deleted items... I
have that set for 30 days and I do see items in the "Recover deleted
items" window when I check there, I just don't see the items I know
are missing. I HAVE NOT found a folder other than the deleted items
folder with anything in its "Recover deleted items" window, but I
assume that is because items would only show up there IF the user does
a hard delete (I tested this on my own mailbox and it is working such
that if I do a hard delete, the item does show up.)
I told the guy that he is going to have to wait until the weekend for
me to recover his data because "the way you deleted the data requires
a very complicated recovery process that might not be successful..."
I've actually got his data in a .pst already, but in case it was user
error, I want him to sweat over his lost data for a little so he might
be a little more careful in the future. I know the information he is
trying to get is not time critical, so the delay won't really adversly
affect him.
I have the data, so I"m not really concerned about the recovery, but
it is a little unnerving when things just disappear.
--
Susan Conkey [MVP]
<trump...@gmail.com> wrote in message
news:8e65bdcc-616a-465f...@u65g2000hsc.googlegroups.com...
"Susan" <sco...@mgmmirage.nospam.com> wrote in message
news:%23UCOgFy...@TK2MSFTNGP06.phx.gbl...
It is kept in your permanent record. The record that will follow you around
for the rest of your life.
<snip>
I keep all my email in my back pocket.
Oh. I thought that was a pick for your 'fro.
Apostrophe fault aside, I'm glad you're secure enough to do that. Now please
stay on topic.
To the OP: I'm inclined to think this is a PEBKAC issue, but just in case,
run a scanost.exe against his offline file.
[ snip ]
>are missing. I HAVE NOT found a folder other than the deleted items
>folder with anything in its "Recover deleted items" window, but I
>assume that is because items would only show up there IF the user does
>a hard delete (I tested this on my own mailbox and it is working such
>that if I do a hard delete, the item does show up.)
Select the top of the mailbox hierarchy and then check the "Recover
Deleted Items". If the deleted folder wasn't a sub-folder it'll only
be found when lookng at the parent folder (which is, in this case, the
root of the mailbox). Make sure you're looking at the "Folders" view
of the mailbox when you do this. A "hard deleted" folder /will/ show
up in the "Recover Deleted Items" view if it's there (as it will if
you select any other folder).
You might want to disable the "Today" view of the mailbox, too. I've
found lots of "missing" things in the root folder that were covered up
by the "Today" view.
>I told the guy that he is going to have to wait until the weekend for
>me to recover his data because "the way you deleted the data requires
>a very complicated recovery process that might not be successful..."
>I've actually got his data in a .pst already, but in case it was user
>error, I want him to sweat over his lost data for a little so he might
>be a little more careful in the future. I know the information he is
>trying to get is not time critical, so the delay won't really adversly
>affect him.
>
>I have the data, so I"m not really concerned about the recovery, but
>it is a little unnerving when things just disappear.
Does the guy have a PST in his profile? Does he have any PSTs at all
on his machine? Was the folder moved there?
---
Rich Matheisen
MCSE+I, Exchange MVP
"Martin Blackstone [MVP]" <mar...@myrealbox.com> wrote in message
news:OkNJNqAL...@TK2MSFTNGP03.phx.gbl...
"Ed Crowley [MVP]" <curs...@nospam.net> wrote in message
news:uRVWOmJL...@TK2MSFTNGP05.phx.gbl...
>I appreciate all your hard work.
He's my favorite MVP.
lanwrench, I"m not familiar with the term "PEBAK", but I'll run the
scan on the ost file on monday. His computer is a 5-7 year old dell
computer so I wouldn't be supprised if that HDD is starting to throw
out some errors.
rich, the user doesn't have a pst file in his profile and I've checked
the rules and the only rule he has is to throw emails from our
internal emails into the now missing folder. Also, I'm sure the
folder and its contents are GONE from his mailbox and not misplaced
through the today view because there was a change in mailbox size
corrisponded with the loss of the folder.
I believe I mentioned it before... but this user lost THE SAME FOLDER
(and maybe another folder too, but I can't remember) about two months
ago. At the time, I just assumed he did something with it and didn't
look into it much and just recovered his data from an old backup, but
I don't think this user is doing anything malicious and I"m sure he
doesn't know how to do anything advanced on purpose... this guy sorts
his mailbox by sender because he hasn't figured out how to work with
folders. I saw what he was doing in one huge inbox and tried to get
him to make folders for his largest groups of people, but the best I
could get him to do was let me set up the rule to put all his internal
mail into a folder.
[ snip ]
>lanwrench, I"m not familiar with the term "PEBAK",
That's usually "PEBKAC" (Problem Exists Between Keyboard And Chair) or
"PEBCAK" (Problem Exists Between Chair And Keyboard).
[ snip ]
>rich, the user doesn't have a pst file in his profile and I've checked
>the rules and the only rule he has is to throw emails from our
>internal emails into the now missing folder. Also, I'm sure the
>folder and its contents are GONE from his mailbox and not misplaced
>through the today view because there was a change in mailbox size
>corrisponded with the loss of the folder.
Yup. I understand that. But you didn't say you checked the root of the
mailbox with the "Tools | recover Deleted Items..." menu. If you did,
then okay.
If you suspect there's a probem with the mailbox then move it to
another database. If you have only E2K3 standard it might be easier to
stand up another server running on a PC and move the mailbox to it and
then back instead of the alternative (running isinteg and hoving to
take the database offline).
kthxbye
"Andy David {MVP}" <ada...@pleasekeepinngcheesebucket.com> wrote in message
news:bfm4f41lqolkiakiu...@4ax.com...
>Can you all please keep on topic?
I blame Ed.
9:23:58 Beginning offline folder file integrity check.
9:23:58 Performing initial synchronization.
9:23:58 Synchronizer Version 11.0.8200
9:23:58 Synchronizing Mailbox 'luyen'
9:23:58 Synchronizing Hierarchy
9:23:58 Synchronizing server changes in folder 'Deleted Items'
9:23:58 Downloading from server 'server.redactedforusenet.local'
9:23:58 1 item(s) changed read-state in offline folder
9:23:58 Done
9:23:58 Performing integrity detection scan.
9:23:58 Scanning hierarchy.
9:23:58 Scanning folder Shortcuts.
9:23:58 Scanning folder Views.
9:23:58 Scanning folder Views.
9:23:58 Scanning folder Inbox.
9:23:59 Scanning folder Sent Items.
9:23:59 Scanning folder Junk E-mail.
9:23:59 Scanning folder cage.
9:23:59 Scanning folder Old mails.
9:23:59 Scanning folder Company Mail.
9:24:01 The message with the subject 'Hidden Message' exists in
the offline folder file but not in your mailbox on the Microsoft
Exchange Server.
9:24:01 Done
9:24:01 Performing phase 1 synchronization.
9:24:01 Synchronizer Version 11.0.8200
9:24:01 Synchronizing Mailbox 'luyen'
9:24:01 Done
9:24:01 Scanning for problems in phase 1 synchronization.
9:24:01 Scanning folder Inbox.
9:24:01 Scanning folder Sent Items.
9:24:01 Scanning folder Junk E-mail.
9:24:01 Scanning folder cage.
9:24:01 Scanning folder Old mails.
9:24:01 Scanning folder Company Mail.
9:24:03 The message with the subject 'Hidden Message' exists in
the offline folder file but not in your mailbox on the Microsoft
Exchange Server.
9:24:03 Done
9:24:03 Performing phase 2 synchronization.
9:24:03 Synchronizer Version 11.0.8200
9:24:03 Synchronizing Mailbox 'luyen'
9:24:03 Done
9:24:03 Scanning for problems in phase 2 synchronization.
9:24:03 If problems are found in this scan, they must be fixed
manually.
9:24:03 Scanning folder Inbox.
9:24:03 Scanning folder Sent Items.
9:24:03 Scanning folder Junk E-mail.
9:24:03 Scanning folder cage.
9:24:04 Scanning folder Old mails.
9:24:04 Scanning folder Company Mail.
9:24:05 The message with the subject 'Hidden Message' exists in
the offline folder file but not in your mailbox on the Microsoft
Exchange Server.
9:24:05 Done
>rich, I"m running SBS2k3, so its exchange std. Its looking more and
>more like its not PEBAK (thanks for the definition btw, I like that).
>I ran scanost.exe (tried twice actually) this morning and the results
>of the log are copied below... the folder the user is missing is
>called "Company Mail" and it does show up listed in the scan... What
>is the story with the errors in red saying "The message with the
>subject 'Hidden Message' exists in the offline folder file but not in
>your mailbox on the Microsoft Exchange Server"? That happened after
>every scan of the company mail folder.
So, does the missing folder show up if the user doesn't use cached
mode in Outlook?
Are there errors reported in the "Sync Issues" folders (working in
cached-mode)?
I'd drop out of cached mode, blow away .ost file, verify the folders
are there, and then put the client back into cached mode and wait for
the resync to finish.
Thanks for the help everybody. Rich, it looks like going out of
cached mode did the trick. The user did move the folder (to the
journal section), but it didn't show up in the journal section until I
turned off the cache and started up outlook again.
It was easy to find the folder location just by clicking on the
"folder sizes" link below the navigation pane. I know I tried that
when I originally looked for the files, and it didn't show up, but
when the folder was back it immediately grabbed my attention.
Thanks again.
Andrew