Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 281
  • Last Modified:

Exchange 2003: Investigate employees emails for sexual harassment accusation.

I have been asked to retrieve all email from the two involved employees.

So our Administration can evaluate the validity and severity of the accusation.

I don’t know how to go about this.  My only guess is something with message tracking.

We will probably have to restore/retrieve/scan multiple backups; I do not think a retention policy has been set.

We have our exchange server’s Windows backup utility do a daily backup of system state & exchange, and weekly full backup, and monthly. These are archived to a local drive, tape backup, offsite server and monthly burned Ghost DVD.

Thank you in advance for your assistance.
0
Suburb-Man
Asked:
Suburb-Man
  • 2
2 Solutions
 
hstilesCommented:
Message tracking won;t be of huge use.  The feature that woul have been of use to you is message journalling whereby all mails to and from a specific mailstore are copied to another mailbox.  However, if you have not had this turned on, you need to do the following

You need to perform multiple mailbox restores to the recovery storage storage group, then Exmerge out the mailboxes from these two employees to pst files.  Name and date the file according to the date of the backup.  Then, you need to repeat for the next backup.

I guess how often you need to do this depends on how much evidence you are able to obtain from your restores.  If you have enough to take the case to tribunal (your solicitors would advise you of this) then you can stop, otherwise, you need to keep restoring.
0
 
bilbusCommented:
like hstiles said you need to enable message journalling.

Unless you do this there is no way to get these messages.

It is kind of useless doing a restore because if the user deletes the file after its sent its gone. Did the person being bothered keep any of the emails?
0
 
Suburb-ManAuthor Commented:
Thanks for the assistance, I'll enable message journalling.
What is the overhead hit for the extended service?
I remember seeing something called a "retention policy" in exchange, what would that do?

I'll being the process of parsing our backups.

Thanks again
0
 
bilbusCommented:
not much, only thing you need to worry about is size, if you save it to a pub folder you can manage that.
0

Featured Post

[Webinar On Demand] Database Backup and Recovery

Does your company store data on premises, off site, in the cloud, or a combination of these? If you answered “yes”, you need a data backup recovery plan that fits each and every platform. Watch now as as Percona teaches us how to build agile data backup recovery plan.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now