Forum Discussion

MRWALLEYE's avatar
MRWALLEYE
Level 3
7 years ago

Any way to find out who deleted a users mailbox archive

Recently we noticed a mailbox went missing in Evault. Is there anyway to find out who deleted the mailbox archive?

Thanks

1 Reply

  • Hello,

    Are you sure it is missing? Sometimes a name change of the mailbox in Exchange changes the name of the archive.

    Anyway. If you have auditing enabled, you might be able to get something from that. Otherwise (as you don't seem to know when it went missing), you might be able to go through the eventlog and see if you can spot something there. I believe it is logged when an archive deletion starts, but not sure. Based on that, see what you can find on otherlogs about logons.

    Additionally, it might be you can get some info from the EV dab's in general. See (for instance) the Direcdtory DB, ExchangeMailboxEntry table and find the mailbox in there.

    good luck.