EV uses MAPI to interact with Exchange. So in the case of an archived message with the safety copy being removed after an EV backup what will happen is that the message is read from the mailbox by EV, converted to html/text, stored and then indexed. The message class is changed from ipm.note to ipm.note.enterprisevault.pendingarchive (this prompts the icon change to a little clock) once EV is backed up the original message is deleted and the short cut created with the message class changed to ipm.note.enterprisevault.shortcut (don't quote me on the exact names but you get the idea) and the item is shown as fully archived. This is all down through MAPI calls.