The amazing disappearing vaulted items!

[LukeTwigger]

Hi,

I've got a very strange occurence where a user's vaulted items have all simultaneously disappeared.  The user assures me she hasn't deleted them herself (although this is permitted on the policy), and I believe her as the folder structure she's using is extremely complicated - it would have taken her ages to have gone through each one and carefully delete all the items.  The folder structure remains intact - just no items in there.

Firstly, I wondered if anyone has come across something like this before and if so, have they any idea what has caused it (where should I look for clues?!), and secondly, how would I go about restoring this individual user's vault?  The server is backed up nightly, so I'm assuming all the data's in there somewhere!  I've looked through the on-line help and all the scenarios they suggest seem to relate to complete system restores rather than just a single vault.

Any help would be gratefully (pitifully, gratefully actually!) received.

Many thanks in advance,

Luke.

[TonySterling]

Hey Luke,

What version are you on?

First thing I would check is http://evserver/EnterpriseVault/archiveexplorerui.asp and see if the archive items are still in the archive.

If they are, do you use shortcut deletion? 

Also, did the user turn on AutoArchive in Outlook?

regards,
Tony

[LukeTwigger]

Hi Tony,

Thanks for replying.  We're on version 7 of EV.

I've had a look at the Vault Explorer and it definitely looks like the vaulted items have gone, we do allow short-cut deletion, but it looks like they've gone lock-stock and barrel!

We switch off Auto-Archive in Outlook via a GPO so, I don't think that's what's happened, but I'll certainly have a quick scan of her Hard Drive just in case it's slipped through somehow.

I've been having a bit of a browse through the index folder on the server and found this in the updates.log file for the user in question - I think this relates to what's happened ...but I'm not sure what "Reason=Write timer expiry" means:

2008-01-17 08:05:06.402 M Index commit (Makestable) Reason=Write timer expiry Item Seq Num=3133 Delete Seq Num=6017 Items added=0 Words added=0 Items deleted=2884 Elapsed(secs)=2.0
2008-01-17 08:05:06.886 M Index commit (Makestable) Reason=Major Compaction Item Seq Num=3133 Delete Seq Num=6017 Items added=0 Words added=0 Items deleted=0 Elapsed(secs)=0.0
2008-01-17 08:05:08.214 C Compaction completed. Type=Major Steps=9 Time compacting(secs)=2.0 Elapsed(secs)=2.0
2008-01-17 08:09:53.816 S Update session ended Index commits(Makestables)=2 Items added=0 Words added=0 Items Deleted=2884

(sorry the formatting's a bit rough, but it become unreadable if I make it any smaller!)

This *looks* about the right time for when the user started reporting that everything had gone - about 3,000 items sounds right too.

Any ideas?

Thanks again,

Luke.

[TonySterling · Accepted solution]

After that posting it is apparent it isn't Auto-Archive, so no need to chase that one.

To be honest, to me that looks as though Storage Expiry ran and then shortcut deletion cleaned up the mailbox.

Do you have your EV application log from the 16th or 17th?

I would recommend calling support and letting them help you sort this out. It may be this user is the only one reporting missing items, but if Storage Expiry got turned on by mistake you may have more users out there.

Sorry it isn't better news, but as long as your backups have the data you can recover.  :)

Regards,

Tony

[jimbo2]

Someone could have changed the value of the retention category to a few days then storage expire could have ran. This would affect many users though.

[LukeTwigger]

Hi All,

Thanks very much for the replies.  I've taken your advice and logged a case with support, so I'll see what they come up with.  If I get a decent resolution, I'll post it up here in case anyone's interested.

Thanks again,

Luke.

[Maverik]

Have to be honest with you that Support will not be able to just recover all your data if its gone.  Once its deleted, its deleted and the fact it has been removed from Archive Explorer etc suggests however it was removed it was removed correctly through the deletion process.  

The only way to get this data back will be through a DR situation as per the Admin Guide, unless Support can come up with anything but I had a similar issue before and this was the solution given.

[LukeTwigger]

Hi,

Support's suggestion so far IS to do a DR recovery from tape, but as they can't explain how this has happened (or more worryingly, why), they've escalated it up to their engineers.

They seem to be taking it seriously though, and I'm pleased with the service so far.

I'll post any developments...