Solved

Exchange 2003: Investigate employees emails for sexual harassment accusation.

Posted on 2006-07-11
4
263 Views
Last Modified: 2010-03-06
I have been asked to retrieve all email from the two involved employees.

So our Administration can evaluate the validity and severity of the accusation.

I don’t know how to go about this.  My only guess is something with message tracking.

We will probably have to restore/retrieve/scan multiple backups; I do not think a retention policy has been set.

We have our exchange server’s Windows backup utility do a daily backup of system state & exchange, and weekly full backup, and monthly. These are archived to a local drive, tape backup, offsite server and monthly burned Ghost DVD.

Thank you in advance for your assistance.
0
Comment
Question by:Suburb-Man
  • 2
4 Comments
 
LVL 13

Accepted Solution

by:
hstiles earned 400 total points
ID: 17089349
Message tracking won;t be of huge use.  The feature that woul have been of use to you is message journalling whereby all mails to and from a specific mailstore are copied to another mailbox.  However, if you have not had this turned on, you need to do the following

You need to perform multiple mailbox restores to the recovery storage storage group, then Exmerge out the mailboxes from these two employees to pst files.  Name and date the file according to the date of the backup.  Then, you need to repeat for the next backup.

I guess how often you need to do this depends on how much evidence you are able to obtain from your restores.  If you have enough to take the case to tribunal (your solicitors would advise you of this) then you can stop, otherwise, you need to keep restoring.
0
 
LVL 8

Assisted Solution

by:bilbus
bilbus earned 100 total points
ID: 17091639
like hstiles said you need to enable message journalling.

Unless you do this there is no way to get these messages.

It is kind of useless doing a restore because if the user deletes the file after its sent its gone. Did the person being bothered keep any of the emails?
0
 
LVL 1

Author Comment

by:Suburb-Man
ID: 17092862
Thanks for the assistance, I'll enable message journalling.
What is the overhead hit for the extended service?
I remember seeing something called a "retention policy" in exchange, what would that do?

I'll being the process of parsing our backups.

Thanks again
0
 
LVL 8

Expert Comment

by:bilbus
ID: 17206067
not much, only thing you need to worry about is size, if you save it to a pub folder you can manage that.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
MSExchange ActiveSync Event ID 10008 3 39
exchane, activesync 4 21
Office 365 Maximum Recipients limitation 3 35
Exchange 2013 weird behavior 7 40
Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
This video discusses moving either the default database or any database to a new volume.

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question