What is your Vault Store option for safety copies set to do? Typically for Mailbox archiving, the saftey copies (the original items) are not removed until your vault store partitions have been backed up. Check your Vault Store settings. Next, check your Vault Store partitions backup settings. There are two options...using the archive bit, or to check for a trigger file (this setting is available on each vault store partition). If the storage service never gets notified that a backup has occured, the saftey copies will not be deleted and your mailboxes will grow.

Also...do you show any monitoring Warnings/Errors on the Enterprise Vault status screen in the console?

Ah, bingo. We don't back up our vault drives at all. All the drives are LUN's on a Compellant SAN which by it's very nature is redunant, and we have 2 weeks worth of replays so we didn't see a need to make backups.

I can make snapshots of the VM but neither would present a trigger file or archive bit.

EDIT: Actually I just looked and I see "Remove Original Items" is checked and the drop down has "No, remove immediately after archiving"

EDIT2: I dont think there'll ever be a way for me to convince our SAN guys to make backups of 13 LUN's and eat another 16TB worth of drive space...  yeah we have alot of archived email.

Thanks Tony. I've finally set up some scheduled tasks to create a trigger file and then remove the old one.

I can see that the LUN's now believe they are being backed up and are securing the items. Brilliant!

Quick question.. would running attrib -a /s on the root of each partition kick off the scan and secure those items?

Only if the vault store is configured to use the archive bit and not a trigger file.  If you are using a trigger file, you can force a check by restarting the storage service, or more simply, setting backup mode on the vault store and then clearing it.  When using a trigger file, EV checks every time the backup mode is cleared on a vault store.