I'm writing an auditing tool and I'm trying to find out exactly what happens to
an item in Outlook when you 1.) Delete 2.) Shift+Delete and 3.) Move.

By doing a before & after comparison of the PR_ENTRYID, here's what I think
Outlook is doing:

- If you press the Delete key (or button), the item is
1. Copied to the Deleted Items folder
2. Hard deleted (permanently purged) from the original folder

- If you press Shift+Delete, the item is
1. Soft deleted in the original folder (flagged as deleted & hidden)

- If you Move an item to a new folder, the item is:
1. Copied to the new folder
2. Soft deleted in the original folder (flagged as deleted & hidden)

NOTES:
- The above scenarios do not apply if the item is already in the Deleted Items
folder.

- If Outlook is running in cached mode, items do not show up in the Recover
Deleted Items window until a Send/Receive has occurred. Also, recovered items
do not show up in the original folder until a Send/Receive has occurred.


I've tried to use the Compare and Watch functionality OutlookSpy, no luck. I'm
opening the IMessage window for the item, then on the Watch tab I click
"All --" and then "Dump Now". Then I do one of the above actions and click
"Dump Now", but OutlookSpy says "*** No changes ***".

Any suggestions/more info would be appreciated.

Compare tab in OutlookSpy (IMessage window) won't really help you since if a
message is deleted, you can't access it anymore.
All of your conclusions are correct, just keep in mind that the cached store
does not expose soft deleted contents table, you will only be able to see
deleted messages there after the cached store propagates the changes to the
online store on the server.

Dmitry Streblechenko (MVP)
http://www.dimastr.com/
OutlookSpy - Outlook, CDO
and MAPI Developer Tool

"Marty List" wrote in message
...

I'm writing an auditing tool and I'm trying to find out exactly what
happens to an item in Outlook when you 1.) Delete 2.) Shift+Delete and 3.)
Move.

By doing a before & after comparison of the PR_ENTRYID, here's what I
think Outlook is doing:

- If you press the Delete key (or button), the item is
1. Copied to the Deleted Items folder
2. Hard deleted (permanently purged) from the original folder

- If you press Shift+Delete, the item is
1. Soft deleted in the original folder (flagged as deleted & hidden)

- If you Move an item to a new folder, the item is:
1. Copied to the new folder
2. Soft deleted in the original folder (flagged as deleted & hidden)

NOTES:
- The above scenarios do not apply if the item is already in the Deleted
Items folder.

- If Outlook is running in cached mode, items do not show up in the
Recover Deleted Items window until a Send/Receive has occurred. Also,
recovered items do not show up in the original folder until a Send/Receive
has occurred.


I've tried to use the Compare and Watch functionality OutlookSpy, no luck.
I'm opening the IMessage window for the item, then on the Watch tab I
click "All --" and then "Dump Now". Then I do one of the above actions
and click "Dump Now", but OutlookSpy says "*** No changes ***".

Any suggestions/more info would be appreciated.

Thanks for the info. I'm curious why the Watch tab on the IMessage window
doesn't capture the delete or move (read, copy, delete) events.

Also, I'm curious why IMAPIFolder and IMsgStore don't have a Watch tab? I would
like to see all the events happening to a folder.


"Dmitry Streblechenko" wrote in message
...
Compare tab in OutlookSpy (IMessage window) won't really help you since if a
message is deleted, you can't access it anymore.
All of your conclusions are correct, just keep in mind that the cached store
does not expose soft deleted contents table, you will only be able to see
deleted messages there after the cached store propagates the changes to the
online store on the server.

Dmitry Streblechenko (MVP)
http://www.dimastr.com/
OutlookSpy - Outlook, CDO
and MAPI Developer Tool

"Marty List" wrote in message
...

I'm writing an auditing tool and I'm trying to find out exactly what happens
to an item in Outlook when you 1.) Delete 2.) Shift+Delete and 3.) Move.

By doing a before & after comparison of the PR_ENTRYID, here's what I think
Outlook is doing:

- If you press the Delete key (or button), the item is
1. Copied to the Deleted Items folder
2. Hard deleted (permanently purged) from the original folder

- If you press Shift+Delete, the item is
1. Soft deleted in the original folder (flagged as deleted & hidden)

- If you Move an item to a new folder, the item is:
1. Copied to the new folder
2. Soft deleted in the original folder (flagged as deleted & hidden)

NOTES:
- The above scenarios do not apply if the item is already in the Deleted
Items folder.

- If Outlook is running in cached mode, items do not show up in the Recover
Deleted Items window until a Send/Receive has occurred. Also, recovered
items do not show up in the original folder until a Send/Receive has
occurred.


I've tried to use the Compare and Watch functionality OutlookSpy, no luck.
I'm opening the IMessage window for the item, then on the Watch tab I click
"All --" and then "Dump Now". Then I do one of the above actions and click
"Dump Now", but OutlookSpy says "*** No changes ***".

Any suggestions/more info would be appreciated.

Watch tab catches the fnevObjectModified notification for that message,
reopens it, retrieves the properties, then compares them with what it
currently has.
If a message is deleted, fnevObjectModified is not fired. Even if it did,
OutlookSpy would not be able to reopen the deleted or moved message since
the old entry id is longer valid.
That feature was designed to help figure out what changes on the MAPI
properties level when you modify something in the Outlook UI. The only
reason that is not available for IMAPIFolder and IMsgStore is because it
won't be very useful for these objeects.

Dmitry Streblechenko (MVP)
http://www.dimastr.com/
OutlookSpy - Outlook, CDO
and MAPI Developer Tool

"Marty List" wrote in message
...

Thanks for the info. I'm curious why the Watch tab on the IMessage window
doesn't capture the delete or move (read, copy, delete) events.

Also, I'm curious why IMAPIFolder and IMsgStore don't have a Watch tab? I
would like to see all the events happening to a folder.


"Dmitry Streblechenko" wrote in message
...
Compare tab in OutlookSpy (IMessage window) won't really help you since
if a message is deleted, you can't access it anymore.
All of your conclusions are correct, just keep in mind that the cached
store does not expose soft deleted contents table, you will only be able
to see deleted messages there after the cached store propagates the
changes to the online store on the server.

Dmitry Streblechenko (MVP)
http://www.dimastr.com/
OutlookSpy - Outlook, CDO
and MAPI Developer Tool

"Marty List" wrote in message
...

I'm writing an auditing tool and I'm trying to find out exactly what
happens to an item in Outlook when you 1.) Delete 2.) Shift+Delete and
3.) Move.

By doing a before & after comparison of the PR_ENTRYID, here's what I
think Outlook is doing:

- If you press the Delete key (or button), the item is
1. Copied to the Deleted Items folder
2. Hard deleted (permanently purged) from the original folder

- If you press Shift+Delete, the item is
1. Soft deleted in the original folder (flagged as deleted & hidden)

- If you Move an item to a new folder, the item is:
1. Copied to the new folder
2. Soft deleted in the original folder (flagged as deleted & hidden)

NOTES:
- The above scenarios do not apply if the item is already in the Deleted
Items folder.

- If Outlook is running in cached mode, items do not show up in the
Recover Deleted Items window until a Send/Receive has occurred. Also,
recovered items do not show up in the original folder until a
Send/Receive has occurred.


I've tried to use the Compare and Watch functionality OutlookSpy, no
luck. I'm opening the IMessage window for the item, then on the Watch
tab I click "All --" and then "Dump Now". Then I do one of the above
actions and click "Dump Now", but OutlookSpy says "*** No changes ***".

Any suggestions/more info would be appreciated.