Compare tab in OutlookSpy (IMessage window) won't really help you since if a
message is deleted, you can't access it anymore.
All of your conclusions are correct, just keep in mind that the cached store
does not expose soft deleted contents table, you will only be able to see
deleted messages there after the cached store propagates the changes to the
online store on the server.

Dmitry Streblechenko (MVP)
http://www.dimastr.com/
OutlookSpy - Outlook, CDO
and MAPI Developer Tool

"Marty List" wrote in message
...

I'm writing an auditing tool and I'm trying to find out exactly what
happens to an item in Outlook when you 1.) Delete 2.) Shift+Delete and 3.)
Move.

By doing a before & after comparison of the PR_ENTRYID, here's what I
think Outlook is doing:

- If you press the Delete key (or button), the item is
1. Copied to the Deleted Items folder
2. Hard deleted (permanently purged) from the original folder

- If you press Shift+Delete, the item is
1. Soft deleted in the original folder (flagged as deleted & hidden)

- If you Move an item to a new folder, the item is:
1. Copied to the new folder
2. Soft deleted in the original folder (flagged as deleted & hidden)

NOTES:
- The above scenarios do not apply if the item is already in the Deleted
Items folder.

- If Outlook is running in cached mode, items do not show up in the
Recover Deleted Items window until a Send/Receive has occurred. Also,
recovered items do not show up in the original folder until a Send/Receive
has occurred.


I've tried to use the Compare and Watch functionality OutlookSpy, no luck.
I'm opening the IMessage window for the item, then on the Watch tab I
click "All --" and then "Dump Now". Then I do one of the above actions
and click "Dump Now", but OutlookSpy says "*** No changes ***".

Any suggestions/more info would be appreciated.