Hello AB,
I understand you want to determine if those files from MTA\failed folder were moved.
As a short background, remember that all messages go through the Message Transfer Agent (MTA) which takes miliseconds before they get delivered, and we actually never notice a message there, until something breaks (i.e loss of communication with Exchange), therefore it is kept local in the MTA until communication or whatever is broken gets fixed, eventually if the issue is not resolved, those messages are passed into the failed folder and are left there. Once they reach the Failed folder, they remain there unless you move them back to the mta folder (basically copy/paste) so they can be delivered.
My action plan would be to:
1.Verify the time stamp of the messages in the failed folder.
2. Check the application and system logs. Go to start>run>eventvwr. Check the time stamps that match or are close to the ones in the messages. Try looking for UMR, DOH, Malex, Miu events. This might give you clues on what happened during that day that might have caused the issue.
3.If you had traces enabled on Tools Depot> Diagnostic tools> Unity Diagnostic tools>Micro traces
You can gather them by selecting Gather logs, based on the messages you found on the event viewer.
For a clear understanding of what a particular traces analyzes please check the link below: Troubleshooting Guide for Cisco Unity Release 5.x (With Microsoft Exchange) > Diagnostic Trace Utilities and Logs
http://www.cisco.com/en/US/docs/voice_ip_comm/unity/5x/troubleshooting/guide/ex/5xcutsg020e.html
Best Regards,
David Peck.
