Query regarding recovery of subfolders

[rickjames]

Afternoon all,

 

We have run into an issue regarding a set of users who are delegates for a mailbox and have had a set of subfolders deleted. We can't see these subfolders anywhere for the life of us; so far we have checked the Deleted Items as well as eDiscovery in both EAC and S&C which has proved rather fruitless with both PSTs that have been pulled back.

 

I have run Get-MailboxFolderStatistics [email protected] -FolderScope RecoverableItems | FL Name,FolderAndSubfolderSize,ItemsInFolderAndSubfolders

 

And it's presented me with a Recoverable Items folder a lot, lot larger than what we've pulled out of eDiscovery, which makes me believe the data they're after is in there. Is there any way of finding out if these subfolders are in this Recoverable Items folder? Whilst I understand I could just recover everything to a target mailbox, I fear it won't bring back the folder hierarchy...

 

Or am I being thick and there's something else I can do that's simpler? Also is there any way of pulling back audit logs that show a subfolder being deleted? We're also going through the logs and can only see emails deleted from their Inbox, nothing from these folders which is just bizarre...

 

Cheers!

[rickjames]

Turns out this was a user deleting the folders locally on their Outlook for Mac client. Beautiful.