Page 1 of 1

Troubleshooting deleted emails

Posted: Tue Apr 17, 2007 3:12 pm
by e37
Out of about 20 users, one user experienced their entire inbox folder disappear. Now this could be an easy answer, they deleted all of their email accidentally. However, as we all now, I can't just say that without showing something.

So, question is, are there any tricks in Scalix that can shed some light on this? Also, is there is a specific place where this users email would reside on the server?

This is existing email that is now gone...not new mail not being received.

Also, some of their email was coming to them, just not showing up in their inbox during this period. The craziest idea that I have is that perhaps this person's account was hacked (someone sniffed their credentials) and all of their Inbox mail was POPed off the server. This person was recently in Europe for some time and upon their return, this happened. Is there anyway to view who is POPing. I could do this Cyrus-IMAP so I thought that perhaps I could do this with Scalix.

Posted: Tue Apr 17, 2007 3:55 pm
by Shredder
If you are running Scalix 11 you can use the recovery folder to get back deleted items.

Log into SAC, and then select the user from the list. In the bottom right, there is a Show Recovery Folder button. Click this and a new folder will become visible for that user. They might need to log off and relog in if using SWA or just shut down Outlook and restart if using Outlook. Then you can copy the messages from this folder to the inbox.

To remove the folder, go back into SAC and click on the Hide Recovery Folder button.

You might want to do this without the user seeing you so they don't think they can just delete stuff all over the place and you can easily recover it. :D

Hope this helps,
Shredder

no freakin' way

Posted: Tue Apr 17, 2007 5:07 pm
by e37
U got to be kidding me!!!! It can't be that easy... I don't believe it.

I will try that right now and post my marvel once I get it done...
I swear I read the documentation at least .5 times. Is it in the documentation?

Posted: Tue Apr 17, 2007 5:10 pm
by e37
I don't see it.

Is this available in Enterprise Edition only?

Posted: Tue Apr 17, 2007 5:18 pm
by Shredder
It is available in the Enterprise and SBE versions.

Not the community version.

Sorry,
Shredder

Nevermind

Posted: Tue Apr 17, 2007 5:27 pm
by e37
I used the command line interface

ommodu -o "FirstName LastName" --recovery N

Anyway, the recovery folder is empty. It seems that maybe this email was not deleted but maybe being POPed or something. Is there anyway to view a "client access" log or something.