I need to collect all the email sent to and from a specific user.
Exchange was setup to save deleted items for 7 days. I need the information from the last 30 days. I have the transaction logs for that time period. If I do a search of all the logs for "firstname.lastname@example.org", I can see all the emails but they are not readable. I guess they are saved in some other format. Their should be only about 15 emails scattered in 9-10 log files.
My questions are?
1. What format are they saved in?
2. How can I get to the point of actually reading these emails, and seeing attachments if their are any?
3. Is their a utility that I can say suck all the email for "email@example.com" from the transaction logs and put them in this directory?