When the Enterprise Vault Journaling task receives a journaled message from Exchange Server 2007:
The list of recipients is extracted from the envelope message contents.
This list is not compared with recipients in the header of the attached message.
Uncategorized recipients found in the envelope message body are classed as Undisclosed recipients.
For example, recipients of messages that are sent over SMTP will be included in the recipient list in the envelope message body but will not be categorized.
A copy of the envelope message, complete with original message attached, will be passed to any external filters (for selective journaling or the Compliance Accelerator Journaling Connector).
When the message is archived, the envelope is stored in the Journal archive as a stream in the message saveset.
The journaling task cannot archive an envelope message from the journal mailbox if it cannot find the message body or the Message-ID, Recipients, and Sender tags in the envelope. For example, these can be stripped by antivirus applications that find suspicious messages.
The journaling task copies any envelope messages that it cannot archive to the folder Enterprise Vault Journaling Service/Failed To Copy.