Soft Deletes, Hard Deletes, Shift+Delete, Move, etc.

  • Thread starter Thread starter Marty List
  • Start date Start date
M

Marty List

I'm writing an auditing tool and I'm trying to find out exactly what happens to
an item in Outlook when you 1.) Delete 2.) Shift+Delete and 3.) Move.

By doing a before & after comparison of the PR_ENTRYID, here's what I think
Outlook is doing:

- If you press the Delete key (or button), the item is
1. Copied to the Deleted Items folder
2. Hard deleted (permanently purged) from the original folder

- If you press Shift+Delete, the item is
1. Soft deleted in the original folder (flagged as deleted & hidden)

- If you Move an item to a new folder, the item is:
1. Copied to the new folder
2. Soft deleted in the original folder (flagged as deleted & hidden)

NOTES:
- The above scenarios do not apply if the item is already in the Deleted Items
folder.

- If Outlook is running in cached mode, items do not show up in the Recover
Deleted Items window until a Send/Receive has occurred. Also, recovered items
do not show up in the original folder until a Send/Receive has occurred.


I've tried to use the Compare and Watch functionality OutlookSpy, no luck. I'm
opening the IMessage window for the item, then on the Watch tab I click
"All -->" and then "Dump Now". Then I do one of the above actions and click
"Dump Now", but OutlookSpy says "*** No changes ***".

Any suggestions/more info would be appreciated.
 
Compare tab in OutlookSpy (IMessage window) won't really help you since if a
message is deleted, you can't access it anymore.
All of your conclusions are correct, just keep in mind that the cached store
does not expose soft deleted contents table, you will only be able to see
deleted messages there after the cached store propagates the changes to the
online store on the server.

Dmitry Streblechenko (MVP)
http://www.dimastr.com/
OutlookSpy - Outlook, CDO
and MAPI Developer Tool
 
Thanks for the info. I'm curious why the Watch tab on the IMessage window
doesn't capture the delete or move (read, copy, delete) events.

Also, I'm curious why IMAPIFolder and IMsgStore don't have a Watch tab? I would
like to see all the events happening to a folder.
 
Watch tab catches the fnevObjectModified notification for that message,
reopens it, retrieves the properties, then compares them with what it
currently has.
If a message is deleted, fnevObjectModified is not fired. Even if it did,
OutlookSpy would not be able to reopen the deleted or moved message since
the old entry id is longer valid.
That feature was designed to help figure out what changes on the MAPI
properties level when you modify something in the Outlook UI. The only
reason that is not available for IMAPIFolder and IMsgStore is because it
won't be very useful for these objeects.

Dmitry Streblechenko (MVP)
http://www.dimastr.com/
OutlookSpy - Outlook, CDO
and MAPI Developer Tool
 
Back
Top