How do I identify emails that have been deleted and moved in my organization?

Emails are the primary means of communication in any organization, large or small. It's therefore important to be vigilant about the deletion and movement of emails across folders in mailboxes in your organization.

You need to know when someone other than the owner of the mailbox gains access and deletes or moves the messages within it. This is all the more important if the mailbox in question contains business-critical information that shouldn't fall into the hands of the wrong sort.

Solution

Exchange Reporter Plus helps you identify these emails with its Mails Deleted or Moved report. To access this report:

• Go to the Audit tab.
• Click the Advanced Audit Reports link.
• Open the Mails Deleted or Moved report, found under the Mailbox Audit Logging category.

Figure 1: View all emails that were deleted or moved using Exchange Reporter Plus

This report displays not only the mailbox where the action took place, but also the source and destination folders, the user who moved the emails, and the subject of the message.

In addition to viewing this data, you can also configure alerts in order to receive real time notifications whenever an email is deleted or moved.