Hi Tony,
Thanks for replying. We're on version 7 of EV.
I've had a look at the Vault Explorer and it definitely looks like the vaulted items have gone, we do allow short-cut deletion, but it looks like they've gone lock-stock and barrel!
We switch off Auto-Archive in Outlook via a GPO so, I don't think that's what's happened, but I'll certainly have a quick scan of her Hard Drive just in case it's slipped through somehow.
I've been having a bit of a browse through the index folder on the server and found this in the updates.log file for the user in question - I think this relates to what's happened ...but I'm not sure what "Reason=Write timer expiry" means:
2008-01-17 08:05:06.402 M Index commit (Makestable) Reason=Write timer expiry Item Seq Num=3133 Delete Seq Num=6017 Items added=0 Words added=0 Items deleted=2884 Elapsed(secs)=2.0
2008-01-17 08:05:06.886 M Index commit (Makestable) Reason=Major Compaction Item Seq Num=3133 Delete Seq Num=6017 Items added=0 Words added=0 Items deleted=0 Elapsed(secs)=0.0
2008-01-17 08:05:08.214 C Compaction completed. Type=Major Steps=9 Time compacting(secs)=2.0 Elapsed(secs)=2.0
2008-01-17 08:09:53.816 S Update session ended Index commits(Makestables)=2 Items added=0 Words added=0 Items Deleted=2884
(sorry the formatting's a bit rough, but it become unreadable if I make it any smaller!)
This *looks* about the right time for when the user started reporting that everything had gone - about 3,000 items sounds right too.
Any ideas?
Thanks again,
Luke.