Over the years I have encountered this a few times, and I have seen questions raised in Forums about why this happens and what can be done about it.

Firstly lets consider the symptoms;

In the Exchange System Manager you have a Mailbox that says that it has 790 items and is a total size of 47,932 KB – see below;

Your user has cleared down all their e-mail in the Inbox, Sent Items, Deleted items so they have a completely empty mailbox, but the Exchange System manager still claims that the mailbox contains items and those items amount to several Megabytes in size – but no matter how hard you look you cannot find anything in the mailbox.

Options that I know people have tried are – an Offline Defrag the Information Store (ESEUTIL /D), using ISINTEG to check for errors, sometimes I have heard of people running ESEUTIL /P to get around this issue, but alas to no avail – no matter what is tried the ESM reports items that otherwise cannot be found.

At this point I know that a number of people have assumed a corrupted mailbox and deleted the object from the database and started again, however there is another option that perhaps may not of been considered, which I will discuss a little later on.

How can the above scenario happen;

I have seen this scenario happen on a number of occasions, and it is almost always down to how the person who’s mailbox has been effected by this has been using Outlook.

Essentially Outlook allows for people to “Drag and Drop” between folders (but you all knew that) however, what is quite common is the number of users whom drag and drop into the wrong place and then forget about it and move on to which the only time it becomes an issue is when you as the System Admin have to merge data out of the mailbox for some reason and cannot figure out where the rest of the items being reported are – or indeed when the user remembers that they need one of these items, swears blind that they did not delete it but it cannot be seen.

The following is a video of the situation that I described above – you will need either WinRar or 7ZIP to extract it (as it is in RAR format) – WinRar is available as an evaluation and 7Zip is free but will only allow for you to extract RARs.

It shows you how easy it is to end up in this situation, and the effect that it has on the ESM and the “Folder Size” option in Outlook.

MissingItems.rar [1.24 MB – Compressed 71.2 MB – Expanded]

Ok, now we know, what can we do to sort out this problem?;

Now for items to go missing, they tend to get dropped into what is called “Top of the Information Store – [TOIS]” which exists within every mailbox, and it is not viewable by Outlook or OWA.

There are a few ways however where as an Exchange Admin you can view the content that is in the TOIS which are as follows:

• In the Exchange 2003 Server re-enable the EXIFS Drive (more commonly known as the M: drive) – this can be done by down-loading the script from Microsoft which is located here: http://support.microsoft.com/?kbid=305145 – this will require some down time on the Exchange Server, and will require your administrator account to have “Send As and Recieve As” rights on the Information store – you should also note, that using this method will only allow for you to check to see if there are items in the TOIS – moving / deleting them tends not to work.

The following is how you can use the script to view the items:

• Copy the script to a command file on your Exchange server (e.g. create a new text file using Notepad, copy the script from the article into the file and then save it to a location on your Exchange server as “IFSDrive.cmd” – REMEMBER that using this method will take your Exchange Services offline – you should also ensure that ANY file level Virus checker that is running on your Exchange server should ignore the M: drive.

Navigate to where you have placed the script and type in the following command (as per above) ifsdrive.cmd M: and press the <ENTER> key

The CMD will then begin configuring your Exchange server for the mapping of the M: Drive – see below;

When the command file has processed navigate to “My Computer -> M: -> <Your Domain> -> MBX – <The Mailbox>” which should give you a Explorer Window which looks like the example below:

As you can see, in the Explorer Windows there is a visual representation of the users mailbox, however, you can also see a number of mail items outside these folders – these are the missing items, and they are residing in the TOIS.

Ok at this stage you might be wondering – right so you have shown us a method to view the items, which involves down-time on the server and re-enables a previously disabled feature, but how do we fix this – in fact do we have to use this method at all?

The quick answer is no, you don’t I was just showing you one method to view mailboxes that you suspect have this problem – the best method is as follows:

• From the Microsoft Exchange web-site you will need to download the “Microsoft Exchange Server MAPI Editor” – to a machine on your network with Outlook installed.

NOTE: Before we begin I need to point out the MAPI Editor is a pretty serious tool – it should be used with care as misuse could result in the loss of data or a mailbox being rendered completely unusable – take care and as always ensure that you have a decent backup.

Ensure that there is a MAPI profile setup within Outlook on the machine that you have placed the MAPI Editor which connects to the Mailbox that you wish to interrogate.

Double click on the MFCMAPI.exe file in the location where you extracted it and you will be presented with the following screen:

Click on the OK button then go to the “SESSION” menu and select “Logon and Display Store Table” – see below;

This will either produce the familiar looking MAPI profile selection box (if you have multiple MAPI profiles configured – or will directly take you to the Store list) – see below;

Choose the correct profile from the list above – or if you do not get this proceed to the next stage

The MAPI Editor screen will change to look like the following;

You will need to double click on the item entitled “Mailbox – <Person your are working with>” – when you have done that a new Window will open which looks like the following (you will have to expand the item called the “Root Container”:

Double click on the option in the left hand tree entitled “Top of Information Store” – this will open up the following Window:

As you can see, in the top plane you can see all of the items that appear to be missing – you now have a couple of choices:

1. You can selected all the messages above and export them to EML files – this can be accomplished by selecting all the messages (this can be done by clicking on the top message and then holding down SHIFT and then scrolling down to the last message (or with focus on the top pane holding CTRL-A). When you have done this go to the “ACTIONS” menu and choosing the “SAVE TO FILE” option – when you have done this you can move to step 2.
2. Or you can hold down CTRL-A (with focus on the top pane) and go to the “Actions” menu and choose the “DELETE MESSAGES” option – this will prompt you with the following question:

Choose the “Permanent delete passing DELETE_HARD_DELETE (unrecoverable)” option – this will ensure that the items have been fully removed from the Information Store.

When you have completed the above, close down the MAPI editor and then return the the ESM and refresh the Mailboxes view – which should now look like the following:

There we go, mystery solved!