Searching for a specific mail but can't find it

[mcz]

Hi everybody,

we have different mailboxes and we are backing up them every hour using veeam backup for office 365. Last week we needed a specific mail which we had in print but we needed the attachments so I started a restore session with a restore point that was as close as possible to the time where the mail has been received (approx. 45 min. later) - nothing special so far.

So I checked Inbox, Deleted Items, Permanently deleted Items, searched for unique keywords, searched for the whole mailbox (which took quite some time) but I wasn't able to find this mail. I found the first request for this topic which was written two days before but not the answered mail as mentioned. I always thought if a mail is deleted or moved to a new location it will still be present in some folder for "getting" into the backup.

Any idea what I could do? Am I right with my assumption that not all mails will be backed up? Is there a way to achieve a backup containing all elements which have every been within a mailbox?

Thanks for the clarifications!

[Mike Resseler]

Michael,

Can you let me know what version you are using? And second question: The search, was that from within the last 2 days?

Thanks
Mike

[mcz]

Hi Mike,

thanks for the quick reply. Version number is 1.5 and the searched item is from the 27th of October...

[Mike Resseler]

And last question... I assume your retention is long enough? (Sorry, should have asked it in the first reply already...)

[mcz]

Yeah, retention should be 7 years...

[Mike Resseler]

In that case, please create a support call. Post the support case ID here, and the follow-up after the conversation with our support engineers.

I am not sure what the problem can be in this case. Because this is a rather specific one, please have as much information ready for our engineers.

Let me know
Mike

[mcz]

Case-number is 02410498 and it could be a microsoft-issue which would probably affect other users as well...

[Mike Resseler]

Hmmm. This obviously is not good. Please keep us informed from the further investigation

Thanks
Mike

[mcz]

Finally, we have found our "lost" item and it looks like that there weren't any issues on microsoft- or veeam-side.

So what happended? The mailbox, which should have received the item, was forwarding all items to a different mailbox (you can set it up in office 365 online interface) and that's why the item wasn't in the original mailbox where we were searching... I was working with the supportteam more than 3 weeks on that case and finally the support engineer found a hint in a (already deleted but via backup restored) logfile. The fact that it took so much time shows probably that we should try to avoid such a situation in the future. Of course, you could try to search for the item within the whole organization, but takes some big amount of time and sometimes you do not really have some unique keywords to search for.

So my feature request would be that exchange explorer gives you a hint or a warning when you browse a mailbox within a point in time when there was some kind of forwarding active (plus forwarding target). Then we would automatically browse the other mailbox instead of wondering why you can't find the item...

Hope that I have written it in a understandable manner.

[Mike Resseler]

Michael,

You did wrote it in an understandable manner, but I am going to ask some more information
That engineer that found the hint, was that one of ours? (If so, I would like his name because that is thorough support )

Any change you can give me the log name where I can find that information in o365?

Thanks
Mike

[mcz]

Hi Mike,

yep it was your engineer and his name is Kirill Kuklin. Kirill is one of the best engineers I have ever worked with (had some few cases with him) so again big "thank you" to him for his fantastic work.
And please don't get me wrong, I didn't wannt to criticize anybody that the investigation has taken so much time (compared to the quite "simple" request), I just wannted to point out that if such a "simple" task takes so much time then there's obviously some space for improvement.

Well probably it's better to ask Kirill where he did find the information but I guess he found it in the proxy-logfile, there you should find sequences like:

03.01.2018 10:00:12 82 (9844) Subject: AW: here you finde the subject
03.01.2018 10:00:12 82 (9844) Last modified time: 03.01.2018 08:45:32 (UTC)
03.01.2018 10:00:12 82 (9844) Size: 73694
03.01.2018 10:00:12 82 (9844) Changed item:
03.01.2018 10:00:12 82 (9844) ID: [ID=AAMkADVkZjg4MzdkLThhZmUtNDM4NS05ZGFkLTVhNzAxM2QwNDKSELGAAAAAAAzL+ALOPiaRZ2l0IH6w8UfBwAyDmVlj0PcT58KH4nOpOWPAAAAAAEWAAAyDmVlj0PcT58KH4nOpOWPAAAhAav+AAA=]:[CK=CQAAABYAAAAyDmVlj0PcasHR5s4nOpOWPAAAhCnzH]

Probably you won't see that per default because we have enabled the extended logging and I can't tell you since when we enabled it (probably I was lucky that this mode has already been enabled).

Please let me know your thoughts - thank you!

[Mike Resseler]

Thanks Michael,

And no, I did not want his name to criticize either, I rather want to thank him for such a good job!.
There are some engineers on vacation (and I believe Kirill also, they do need to get some rest from time to time ) and I will discuss the case with him in a few weeks, after our internal year start and things become a bit less hectic again. Based on that information the VBO team and me will look what we can do about it (whether it is easy or rather difficult)

Thanks for the additional info!
Mike

[mcz]

Thank you Mike for this information! Please let me know the results (if you plan to do something or not) because I would like to sort this out for the future (either on veeam or on our side).