Monitor email deletion

[RNW2]

Hi,

Does anyone know if it's possible to audit item deletion from a mailbox?

We have a user that seems to lose items from their sent items intermittently. When they "disappear" it's usually in a large batch. For example they've just reported that all emails from their sent items before 18th March have gone. I'd like to monitor the mailbox to see if they are deleted or are really just vanishing.

I've checked that auto archive isn't moving them to a .pst which it isn't set to do. I've also gone to "recover deleted items" where there is nothing relating to the missing emails.

I know public folders and have a retention date on them but I'm not aware of any such think on a mailbox and specifically on a subfolder of a mailbox.

Any ideas guys?

 

[ntinlin]

Two things.

1. Search net for DumpsterAlwaysOn which will allow you to see stuff hard deleted from Sent Items which didn't go through Deleted Items
2. Check there are no mailbox manager policies applying to the mailbox (this would be at organisation, recipient level within Exchange)

Neill

 

[RNW2]

Hi Neill,

There are no policies in place. I've enabled the DumpsterAlwaysOn registry setting and will have a look today to see if anything has been hard deleted.

Any ideas on auditing?