If the attachment action is "REPLACE", users will see a file called Deleted Attachments.txt attached to messages that have had attachments deleted by the filter. When they open this file, it contains a list of the files that have been deleted.

The contents of this file are taken from the file, CF_Replace_Attachment.txt, in the Enterprise Vault directory (typically, C:\Program Files\Enterprise Vault). If required, you can modify the text of this file. For example, you may want to localize the descriptive text.