Looking for possible deleted message

K

Kbalz

I have a simple setup of Exchange 2007 running, with Outlook 2007
clients. We've lost a message, and just trying to track down what
exactly happened to it.

The message came from one person outside of our organization, and he
sent the message directly to one person in our organization, and CC'd
another person inside our organziation.

Sender = person who sent the message
User1 = person who was the direct recipient of the message
User2 = person who was CC'd.

The Sender sent the message.. the message made it to User2's outlook
client, User1 cliams it never got to him. The Sender sends a second
email a week later asking why User1 hasn't responded yet. This second
email DOES make it to both User1 and User2's inbox.

So I have two messages to track. I found them in Exchange's Message
Tracker, and they are logged identical in the server. First logged
line is like this: EventID:Receive, Source: SMTP, Message ID: 1703928,
Recipient is User2. The next logged line is one second later like
this: EventID: Deliver, Source: STOREDRIV, Message ID: 1703928,
Recipient is User1.

I could not find any difference between the message that User1 got,
and the one he claims he did not get. From my stand point, it WAS
delivered to his client.. and I think he either deleted it, or it went
to Junk mail on his client. But I don't think the Junk mail is true,
since when the Sender sent the second message which made it to User1's
inbox.. he copied the text from the email that did no make it.. so
junk mail would've canned both emails if it was the culprate.

This user does use web access quite often while on the road if that
matters.. and his client maybe running in Cached mode (i'll check
tommorrow)

So my question to you is how can I check if the User deleted this
email.. or how can I further track the email from the server end of
it? I must figure this out, it was a very important email and lots of
people are looking for answers. Thanks -Kbalz
 
S

Susan

if Exchange message tracking says it was delivered, it was delivered. Your
only option is to logon to that mailbox, and do an "advanced find" with
Outlook for the message, and if it's not there, search the dumpsters for
each folder (http://support.microsoft.com/kb/886205/en-us). This will only
work if the message was sent/received during your DIR window. If it was
sen/received past your DIR window, you'd need to do a restore to an RSG,
then extract the mailbox data, including dumpster items, and search for
it...most likely, the user deleted it, or it was moved to another folder due
to a rule, or something like that...
 
K

Kbalz

Thanks for your response, and just to double check based on the info I
posted, the message did in fact get delivered? If I didn't post enough
info, what else do I need to confirm that?
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top