The Case of the Vanishing E-mails

I just wanted to relay a support call I’ve just dealt with as it really had me stumped. For a while I was concerned there was something really bad happening but now that I’ve gotten to the bottom of it I can breathe easy as it wasn’t actually all that serious

Our client called to say that she was expecting an e-mail from their German contractor and it hadn’t arrived. He’d resent it a couple of times to confirm he’d got the email address, etc correct

I logged onto the server and used Exchange message tracking to see if the e-mail had arrived

The message did arrive at the server as expected

image

My next port of call was to logon to the PC and check Outlook, sometimes I’ve seen similar cases where a filter has been applied by mistake that means the user has “lost” the message. Unfortunately this drew a blank as well

I used the advanced find feature to display all emails that had been delivered today and I even created a search folder to do the same thing but the message was nowhere to be seen

I logged in via Outlook Web Access to see if the message was visible there as I’ve also seen cases where the message is corrupt and Outlook can’t display the message but OWA seems to do ok with it. Again no luck here

So I checked to see if she hadn’t deleted the message by mistake. The message wasn’t in there but when I used the “Recover Deleted Items” feature in Outlook there is was! I thought this would be a simple matter of clicking the message and pressing restore……unfortunately not

After I clicked restore I expected the message to reappear in the Inbox but after waiting a few minutes, nothing

Confused I went back into the dialog in case I’d selected the wrong message. The message was still available for restore so I clicked it again. Once again the message failed to reappear so I went back in again

One of the columns is “Deleted On”, I noticed that time was only a minute ago

image

I recovered the item again, noted the time, waited a minute and went back in and lo and behold the deleted on time had changed to the time just after I’d recovered the item

Confused I turned to the server, this particular server uses McAfee GroupShield for checking inbound messages for malware so I trawled through the logs to see if it was picking this up as a dodgy message. I wasn’t holding my breath though as this isn’t how GroupShield works (the message is usually quarantined or a part of it replaced and the user alerted). As expected this was a dead end

I was starting to get a little paranoid now so checked the PC over for malware and my initial checks didn’t turn anything up. I even used SysInternals Process Monitor to track what was going on during the recovery to see if there was an outside process doing something but again this didn’t show anything of use

I fired up Outlook in safe mode but didn’t get very far as the recover items feature is an add-in itself!

I decided to keep my attentions on Outlook and created a new profile for the user. This time I disabled Outlook cache mode and recovered the item again

This time the message reappeared as expected!!

As soon as this happened a huge light bulb came on somewhere in the back of my head 🙂

There is a feature in Outlook that will ONLY work when cache mode is enabled

Outlook Junk Filter

I went into the options for this it hit me straight in the face!

This is how the junk filter was configured on the PC

image

Can you see the problem?

Only allow from safe lists and permanently delete suspect messages!!!

I’m surprised she gets any email at all! But if she only receives messages from a group of people that she always emails then they would be on her safe list

The junk filter checks for messages as soon as they arrive in the inbox, irrespective of whether that is because the message is an incoming e-mail or has just appeared there after being restored

I have no idea why this has changed. It must have only have changed recently because as I said earlier the configuration would surely mean she would notice lots of emails going missing.

Once I turned off the junk mail filter I was able to recover the message ok

Ordinarily when a client doesn’t require the Outlook junk filter because they are getting their spam filtered elsewhere I use the Office ADM files and setup group policy to explicitly disable the Outlook filter (Office 2007 version here) so I need to go and set this up I think!

Minor panic over!

The following two tabs change content below.
Andy Parkes is Technical Director at Coventry based IT support company IBIT Solutions. Formerly, coordinator of AMITPRO and Microsoft Partner Area Lead for 2012-2013. He also isn't a fan of describing himself in the third person.

Latest posts by Andy Parkes (see all)

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.