Forum Discussion
Help please! Exchange report questions
Hello! I’m hoping someone can help clarify a few things about a deletion report I received.
The report shows hard and soft deletes, but it seems to be missing information about moves and restores. I’m trying to understand the following:
1. **Hard Deletes:**
* When something is hard deleted, does it go to the Purge folder, and is it still recoverable from there?
* Is a “hard delete” simply what happens when someone empties their Deleted Items folder?
* Can hard deletes happen accidentally?
2. **Limitations of the Report:**
* Are there other reports that can show moves, restores, or whether an item is *currently* deleted?
* My understanding is that this delete report only indicates that an item was deleted at some point, not its current status. Is that correct?
3. **Missing Message IDs:**
* About half the entries in the report don’t include a message ID. Am I correct in assuming those items aren’t emails?
If anyone is willing to chat or walk through this with me, I’d really appreciate it — I’m hoping to understand this report better.
Any guidance or links to solid documentation would be truly appreciated. Thank you!
1 Reply
Hard deletes are items removed from both the mailbox and the Recoverable Items folders. When a message is hard deleted, it goes to the Purges subfolder inside Recoverable Items and can still be recovered depending on the retention settings.
A hard delete usually occurs when a user empties the Deleted Items folder or permanently deletes an item with Shift+Delete. Accidental hard deletes are possible because Outlook allows Shift+Delete without confirmation.
The deletion report you're reviewing only records that an item was deleted at some point. It does not track moves between folders or restorations, so it cannot indicate whether an item is currently deleted.
Missing message IDs usually mean the action wasn’t performed on a standard email item. Calendar items, drafts, and tasks often lack traditional Internet Message IDs, so the report will show the action without an identifier. This is normal behavior and not a corruption of the report.
