Forum Discussion
Missing emails
Got a weird one here and hoping someone else has seen this before.
Scenario: Internal user sends an email to about 15 other internal users. I see the sent item in message trace, delivering successfully for all recipients. Days later, the sender and recipients can not locate the item in their mailboxes. I spot check one of the recipients and perform as thorough of a search on their mailbox as I can and am unable to locate it. All recipients claim to have not permanently deleted the item.
What I've done: I did multiple content searches with scopes of varying depth, none of them have found the item. I checked audit logs for 'move to deleted' and 'delete from deleted', nothing. I checked Defender to see if the item had any post delivery processing performed, nothing. The trace shows successful delivery, Explorer in Defender portal shows the same, yet the item is undetectable. I don't know what I'm missing as far as what system could have snagged that item out of the mailboxes, which I'm assuming happened since the content searches are coming up empty.
For the affected users, there are no commonalities regarding delegate access. There are 3 administrative users for the environment - none recall performing any purge for this item. There are no logs of a purge of this item that I can find.
2 Replies
Check for mail flow rules, third-party tools, or mailbox add-ins that could auto-delete. Also, review sign-in logs for compromise. If Litigation Hold is on, search the Recoverable Items folder. If still missing, contact Microsoft support for deeper analysis.
Try running a blanket content search, for example all messages received on that day. Even if the items were moved/deleted by some system process, there will be a trace in the audit log, though you can only search those with a proper message identifier (subject and such wont cut it).
