How can I determine the "deleted on" date of an item in Exchange using EWS?

Question

I've written a C# program using managed Exchange Web Services (EWS) to query a user mailbox in Exchange 2010.

We need to be able to look at the recoverable items for various users and see for each user how many items were deleted within a specific time range. I have been able to query the WellKnownFolderName.RecoverableItemsDeletions folder and fetch the items, but I can not find any property that tells when the items were deleted. (The Outlook GUI shows this date, so I know the property must be stored somewhere.)

There are no standard properties that look like "DateDeleted" or anything close. I have tried to see if the extended MAPI property PR_DELETED_ON is defined for the items, but either it is not or I'm not querying it correctly.

How can I find out when these items were deleted?

-mark

This question has been viewed over 1000 times, yet not a single person has up-voted it. The tooltip for the upvote button says doing so indicates you feel the question shows research effort and is useful and clear. For my own understanding when I ask other questions in the future: Why has it received no up-votes? I certainly tried to research the question first, and I think it is clear, and enough people are viewing it to indicate it has at least the potential for being useful. What am I missing? — Mark Meuer
Go on Mark, I'll give you an upvote! After starting some work on EWS recently though, I fear the main issue may be that there just isn't that much web content / SO questions out there on EWS sadly. — Ted

Matt Weber Matt Weber · Accepted Answer · 2012-01-15T21:24:35

As you stated, supposedly an extended MAPI property named PR_DELETED_ON is set when an item gets deleted permanently from the Deleted Items folder, however, I've never run into this property myself either.

Instead, look at the value for the deleted item's PR_LAST_MODIFICATION_TIME property (0x30080040). This property stores a PT_SYSTIME value reflecting the date and time the item was last modified. This property is updated when an item is deleted, so you should be able to use it as an indicator as to when the item was deleted.

You stated you were using the RecoverableItemsDeletions enumeration value. This points to the Deletions subfolder underneath the inbox's Recoverable Items folder. This is where items go that are deleted from the Deleted Items folder. So, be aware that the value for the PR_LAST_MODIFICATION_TIME property of any item found in that folder will reflect the date and time that the item was deleted from the Deleted Items folder (unless the user soft-deleted it).

How can I determine the "deleted on" date of an item in Exchange using EWS?

1 Answers