After a migration from Enterprise Vault, during stage 2, it’s possible that items are removed from the user mailbox during the Shortcut deletion process (other than shortcuts).
When the Shortcut deletion process is triggered, Archive Shuttle starts to enumerate folders of a user mailbox and scan for IPM.Note.EnterpriseVault.Shortcut or any message class which ends with *.EnterpriseVault.Shortcut. Once collected, the deletion of the shortcuts will start, and it will remove all items with message class *.EnterpriseVault.Shortcut.
In most cases, only IPM.Note message classes are selected for archiving and shortcut creation, but in some environments, other can be selected, see below:
– IPM.Activity* – Journal messages
– IPM.Appointment* – Calendar items
– IPM.Contact* – Contact items
– IPM.Document* – Documents
– IPM.Note* – Interpersonal messages
– IPM.Post* – Message posted to a folder
– IPM.Stickynote* – Electronic sticky notes
– IPM.Task* – Tasks
– Report.IPM* – System messages
If some of the above are included into archiving, then the items are archived within Enterprise Vault, created. When the Shortcut deletion is running it looks like the entry below, and items are removed:
2017-03-08 22:54:57Z|8984| 26|TRACE| Scan|RS Recordset Count for folder [Calendar] is  [491 ms] 2017-03-08 22:54:57Z|8984| 26|TRACE| Scan|Found  items in folder [Calendar]. [4 ms] 2017-03-08 22:55:06Z|8984| 6| INFO| OnCoreCheckTimerElapsedImpl|Transmitting  chunk(s) to core 2017-03-08 22:55:06Z|8984| 34| INFO| OnCoreCheckTimerElapsedImpl|Transmitting  shortcut results to Core and waiting for answer 2017-03-08 22:55:07Z|8984| 34| INFO| OnCoreCheckTimerElapsedImpl|Got answer from Core. We need to process  items out of  2017-03-08 22:55:11Z|8984| 6| INFO| <ProcessShortcuts>b__0|Finished [/o=xxxxxxxxxx/cn=xxxxxxxxxx/cn=xxxxxxxxxx]. Success Items:  | Failed Items:  [15 s]
The items are removed because they have been archived by Enterprise Vault, and have an ArchiveID and SavesetID stamped on them.