Deleted Vault emails are gone permanently?

[tfoster]

If you accidentally delete an email or a bunch of email from a vault archive, those emails are gone permanently correct? there any ways to restore them? There anyways to find out if those emails were infact deleted?

I have an archive that appears that the last 3 years worth of email is gone. Their inbox shows the latest email is late 2012. However their Deleted Items folder shows current archived stuff..

They are on the same Vault policy as 1,000+ other people so the only thing I can think of is they accidentally deleted a bunch of email.

[TonySterling]

Do you have Recover Deleted Items enabled?

http://www.symantec.com/docs/HOWTO108198

Also, you can query the journaldelete table.

Article URL http://www.symantec.com/docs/HOWTO42225

If the DeletionReason is 1 it means the user deleted them.

[tfoster]

We dont.. but we have a situation where a couple direct reports to one of our executive team have read/write/delete permission on the execs archive, even though at the site level we don't allow people to delete archived email..

If you manually add those permission, does it overwrite the block at the site level?

[TonySterling]

If at the site level you do not allow deletes nothing will override it.  You should be able to recover the shortcuts from the Exchange Dumpster and be all set.

[JesusWept3]

Unless it's expiry of course

[tfoster]

I figured out what happened. Apparently at some point in 2012, someone used the Outlook plugin to set the inbox to "Do Not Archive"..

Now I get the fun task of trying to fix that.

[TonySterling]

if there are no other EV config changes you can Zap the mailbox and re-enable.  http://www.symantec.com/docs/TECH35614

[tfoster]

When you "zap" an archive, does it do anything to the archived emails inside? or does it ONLY remove the properties of the root/subfolders to which I'd have to re-enable it using the wizard?

[TonySterling · Accepted solution]

No, it will not affect the mail.  It just removes any EV settings on the folders and deletes the hidden message from the mailbox.

[tfoster]

Awesome, thanks!

I ran it and I can now see the archive actually archiving emails.