Clarify the expected record
Identify the correspondence believed to be missing, why it is expected and when it was last seen. Folder changes, account transitions, search scope, retention behaviour and genuine deletion can produce similar visible gaps. A departure and a missing message are not, by themselves, evidence of misconduct.
Preserve the available sources
Coordinate account administration with proportionate preservation. Potential sources include the live mailbox, shared mailboxes, local stores, authorised archives, backups and other correspondents. Record disablement, licence changes, migrations, repair attempts and any work already undertaken by IT.
Authority, limits and next step
The organisation and its advisers should establish authority and boundaries for employee, personal or privileged material. The presence of a recoverable copy depends on the actual configuration and history; no general retention promise applies. A feasibility assessment can map surviving sources before a wider investigation is commissioned. Supply the event chronology, the platform and the specific evidential questions. The resulting report should separate located correspondence, unresolved gaps and any supported evidence of account activity from conclusions about a particular person's intent.