Solved

Exchange 2003: Investigate employees emails for sexual harassment accusation.

Posted on 2006-07-11
4
237 Views
Last Modified: 2010-03-06
I have been asked to retrieve all email from the two involved employees.

So our Administration can evaluate the validity and severity of the accusation.

I don’t know how to go about this.  My only guess is something with message tracking.

We will probably have to restore/retrieve/scan multiple backups; I do not think a retention policy has been set.

We have our exchange server’s Windows backup utility do a daily backup of system state & exchange, and weekly full backup, and monthly. These are archived to a local drive, tape backup, offsite server and monthly burned Ghost DVD.

Thank you in advance for your assistance.
0
Comment
Question by:Suburb-Man
  • 2
4 Comments
 
LVL 13

Accepted Solution

by:
hstiles earned 400 total points
ID: 17089349
Message tracking won;t be of huge use.  The feature that woul have been of use to you is message journalling whereby all mails to and from a specific mailstore are copied to another mailbox.  However, if you have not had this turned on, you need to do the following

You need to perform multiple mailbox restores to the recovery storage storage group, then Exmerge out the mailboxes from these two employees to pst files.  Name and date the file according to the date of the backup.  Then, you need to repeat for the next backup.

I guess how often you need to do this depends on how much evidence you are able to obtain from your restores.  If you have enough to take the case to tribunal (your solicitors would advise you of this) then you can stop, otherwise, you need to keep restoring.
0
 
LVL 8

Assisted Solution

by:bilbus
bilbus earned 100 total points
ID: 17091639
like hstiles said you need to enable message journalling.

Unless you do this there is no way to get these messages.

It is kind of useless doing a restore because if the user deletes the file after its sent its gone. Did the person being bothered keep any of the emails?
0
 
LVL 1

Author Comment

by:Suburb-Man
ID: 17092862
Thanks for the assistance, I'll enable message journalling.
What is the overhead hit for the extended service?
I remember seeing something called a "retention policy" in exchange, what would that do?

I'll being the process of parsing our backups.

Thanks again
0
 
LVL 8

Expert Comment

by:bilbus
ID: 17206067
not much, only thing you need to worry about is size, if you save it to a pub folder you can manage that.
0

Featured Post

The problems with reply email signatures

Do you wish that you could place an email signature under a reply? Well, unfortunately, you can't. That great Exchange/Office 365 signature you've created will just appear at the bottom of an email chain. What a pain! Is there really no way to solve this? Well, there might be...

Join & Write a Comment

Utilizing an array to gracefully append to a list of EmailAddresses
"Migrate" an SMTP relay receive connector to a new server using info from an old server.
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now