Enterprise Vault, stubs and missing items

[BrettWorld]

Hi,

I'm very new to Enterprise Vault (8.0.3.1845) and was looking for a sanity check before I deliver some bad news to a user.

Situation is:

User opens a mail message from within outloook that has been archived.  The attachment looks like is there, however upon attempting to open, the message "Symantec Enterprise Vault - Error.  The requested item is no longer in the vault." is displayed.  I've got them to search using the Archive Explorer but the messages are not found.

Whilst on the EV server, there is a single retention policy (Set to "Forever", the option to stop items from being deleted is not checked).

This leads me to think that:

i) Enterprise vault didn't delete the items based on a policy

ii) The (or another) user has deleted the items.

iii) There is some form of misalignment between the stubs in the mailbox and what is present in the users Archive. (Is this common?  Is it fixable?)

The user did mention that a folder (containing these items) was deleted from her inbox but later pulled back through from deleted items - not sure if this can cause this unsynched stubs?

I'm trying to understand what the functional behaviour should be, so that I can formulate what to say to the user.

A colleague had suggested that embarking down a restore is not a simple task by any means.

Thanks in advance :)

[JesusWept3]

First just go to the archive properties for that user and see if they have items that are deleted

[BrettWorld]

Thanks for your response JesusWept3.

Sadly, there are 0 items marked for deletion. 

I'm thinking that because the folder containing the original items in her inbox was deleted, this sent the instruction to delete the items from the archive.  Whilst the folder containing the stubs could be pulled back from the deleted items, the EV had already executed the instruction to delete.  Hence why the stubs are present, but data isn't in the archive.  Is that logiv feasible?

Many thanks

[JesusWept3 · Accepted solution]

Sounds a bit odd..... so heres the deal.

With Enterprise Vault in Outlook, if you have stubs, you can delete shortcuts individually, it will either delete the shortcut and the item, or just the shortcut or ask you what you want to do, depending on policy.

However, if you delete an entire folder, it will be considered a soft delete, where the folder and shortcuts move to deleted items, but the items in the archive will remain

If you delete items through Archive Explorer or Browser Search, it just deletes the items from the archive, but does not delete the shortcuts, its up to another process called Orphaned Shortcut Cleanup thats configurable as part of your desktop policy to go ahead and delete those shortcuts.

If you have Vault Cache and Virtual Vault, where its presented in Outlook like a PST file, you can delete items and folders, but again the shortcuts remain in tact.

One thing you could be seeing is a user deleting items, but you may not have the dumpster enabled, or have it set for a really short period. If you go to the properties of your site in the Vault Admin Console and then go to Archive Settings.... 

You have a check box "Enable Recovery of Deleted Items" and then a number of days
If you have the Enable unchecked, then the dumpster is disabled and anything anyone deletes is unrecoverable.

Are you able to access SQL Server and run SQL Queries per chance?

[BrettWorld]

Thanks for your excellent response.

To confirm your hints:

The Options tab for the default Desktop Policy, has the "Shortcut Deletion" set to "Both Deleted" under the "Outlook Behaviour" section. 

Under the "Vault Cache" tab, the "Make Vault Cache available for users" not checked.

On the "Advanced" tab, I noticed that the option for Soft Deletes in On.

None of the Mailbox policies have the Shortcut Deletion option checked.

Under the Archive Settings, both the "Users can delete items from their archives" and "Enable recovery of user deleted items" are checked.  The "Number of days until items are permanently deleted" is set to 7, and that duration has certainly passed. (I'm guessing this is the bottom line right here!)

Yes, I have full access to SQL.

Thanks again for your time.

[GabeV]

If "Shortcut Deletion" is set to "Both Deleted" and the user deleted a folder with EV shortcuts from Outlook, the archived items were deleted from vault as well since the users are allow to delete items from the archive. So, yes, that's bad news for the user. If they really want to recover the emails, then they need to perform a DR process using a backup (Vault stores + SQL DBs) that was taken before the items were deleted, extract the emails to a PST and then provide this PST to the user.

I hope this helps.

[BrettWorld]

Thanks for the assistance (and crashcourse on Enterprise Vault).

To complete the story, I've just explained the situation and she just laughed and said "Oh well".

Thanks again.