Solved

Exchange 2003: Investigate employees emails for sexual harassment accusation.

Posted on 2006-07-11
4
270 Views
Last Modified: 2010-03-06
I have been asked to retrieve all email from the two involved employees.

So our Administration can evaluate the validity and severity of the accusation.

I don’t know how to go about this.  My only guess is something with message tracking.

We will probably have to restore/retrieve/scan multiple backups; I do not think a retention policy has been set.

We have our exchange server’s Windows backup utility do a daily backup of system state & exchange, and weekly full backup, and monthly. These are archived to a local drive, tape backup, offsite server and monthly burned Ghost DVD.

Thank you in advance for your assistance.
0
Comment
Question by:Suburb-Man
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 13

Accepted Solution

by:
hstiles earned 400 total points
ID: 17089349
Message tracking won;t be of huge use.  The feature that woul have been of use to you is message journalling whereby all mails to and from a specific mailstore are copied to another mailbox.  However, if you have not had this turned on, you need to do the following

You need to perform multiple mailbox restores to the recovery storage storage group, then Exmerge out the mailboxes from these two employees to pst files.  Name and date the file according to the date of the backup.  Then, you need to repeat for the next backup.

I guess how often you need to do this depends on how much evidence you are able to obtain from your restores.  If you have enough to take the case to tribunal (your solicitors would advise you of this) then you can stop, otherwise, you need to keep restoring.
0
 
LVL 8

Assisted Solution

by:bilbus
bilbus earned 100 total points
ID: 17091639
like hstiles said you need to enable message journalling.

Unless you do this there is no way to get these messages.

It is kind of useless doing a restore because if the user deletes the file after its sent its gone. Did the person being bothered keep any of the emails?
0
 
LVL 1

Author Comment

by:Suburb-Man
ID: 17092862
Thanks for the assistance, I'll enable message journalling.
What is the overhead hit for the extended service?
I remember seeing something called a "retention policy" in exchange, what would that do?

I'll being the process of parsing our backups.

Thanks again
0
 
LVL 8

Expert Comment

by:bilbus
ID: 17206067
not much, only thing you need to worry about is size, if you save it to a pub folder you can manage that.
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
If you troubleshoot Outlook for clients, you may want to know a bit more about the OST file before doing your next job. IMAP can cause a lot of drama if removed in the accounts without backing up.
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question