Recovering email that was accidentally deleted

Running Windows Server 2003 with Exchange 2003 SP2, and Outlook 2003.

We have a user who likes to keep her email box nice and clean.  She often deletes emails and then wants them back, so I showed her how to go into the "Deleted Items" to get them back.  But since she learned about that, she regularly empties the Deleted Items folder.  Sometimes she STILL wants emails back, and since deleted item retention is enabled on I showed her how to select Deleted Items, go to Tools -> Recover Deleted Items and get them back.  Since she learned about that, she now appears to be deleting email from her Inbox, then emptying the deleted items folder, then going to Recover Deleted Items and deleting them from that location also (I didn't even know you could do that until she told me).

So now she has more email that is deleted that she wants back.  I think that deleted item retention will keep them for the specified 30 days, but I don't know where they go, or how to get to them after they have been removed from the Recover Deleted Items dumpster.  Can somebody tell me how to access these deleted, then deleted again, and even deleted again emails?
LVL 10
GuruGaryAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

redseatechnologiesCommented:
Hi GuruGary,

Deleted item retention puts the mail into the last area (tools, recover deleted items)

If she has deleted them from there, then you going to be restoring from tape.

I would do 3 things here;
1. exmerge all the mail out of her mailbox to see if it is still there (it won't be, but have a go, enable the option to get deleted mail) -> http://www.petri.co.il/download_exmerge.htm
2. disable the registry key so she cannot get into the recover deleted items (i understand why you added it, but she obviously isnt savvy enough to use it) -> http://support.microsoft.com/kb/Q246153
3. educate the user as to the definition of delete - and that when she hits the "yes, I am sure" button, she should be sure!!

And a little more reading about the process -> http://www.msexchange.org/tutorials/MF022.html

Hope that helps,

-red

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
chrislehrCommented:
Upgrade her to an etch a sketch, or remove all delete keys/buttons.
redseatechnologiesCommented:
You have delete keys on your etch a sketch?

My users just shake theirs, try restoring THAT from tape :)
Python 3 Fundamentals

This course will teach participants about installing and configuring Python, syntax, importing, statements, types, strings, booleans, files, lists, tuples, comprehensions, functions, and classes.

ECNSSMTCommented:
unless this individual is high up in th food chain, it can be easily resolved with an HR(or management) action, if you want to push it that way.  if you go that way, you can tell her that since she empties the Recover Deleted Items folder, her obsessive compulsiveness is circumventing a failsafe feature meant to help her.
If you can get an HR (or management) decree that states she cannot request a restore without their OK, it should cut that down.  (even more so if your company uses cost centers that allocates costs per the services provided intra-company wise)

Regards
GuruGaryAuthor Commented:
Thanks for your ideas, tips and suggestions.  So it sounds like the consensus is that the only way to get them back is to recover from a backup?  That surprises me, since I didn't think the deleted item retention would be that easy to circumvent!  I thought the purpose of the retention was more for security than email recovery.  To have no way for an employee to permanently delete an email for the specified period ... so in the event an employee does something they should not have done (like email themselves the customer database the day before they quit, etc.) there would be a track of them doing that (more than just being able to see they sent an email to themselves in the Message Tracking).

I haven't tried Exmerge yet, but I will try that tomorrow.  I also like the idea of the etch-a-sketch ... I think she would be more productive with that anyway.
GuruGaryAuthor Commented:
Hey, guys.  Sorry about the delay, and sorry the mod had to assign points for me.  We got busy for a while and I got way behind.

I finally got a few hours to test this, and wanted to update this question and post my results.

Redseatechnologies was right about needing to restore from backup once they are deleted from "Recover Deleted Items".  This very much surprises me, as I thought the deleted item retention was more of a security feature for the admins or owners of the company than another way for users to get their email back.  I am disappointed that Microsoft will let a user delete email from the deleted item recovery so easily.  So a user who is about to go to work for a competitor, or suspects they are about to get fired can forward confidential emails, contact lists, company secrets, etc. to their home email account, new employer or anywhere else, then delete from sent items and recycle bin, and then delete from deleted items and there would be no record (other than date/from/to that Exchange message tracking records) of what they did.

So although it appears the emails are really gone if deleted from the Deleted Item Recovery, I did test a couple more things.  ExMerge can get deleted->deleted as well as hard deleted or shift-deleted emails from all folders, where Deleted Item Recovery just gets them from the "Deleted Items" folder.  Another observation is that if a user deletes an email from Outlook with the black X icon, it appears to be a hard delete (i.e. does not show up in the deleted items folder, but you can get it back with ExMerge).

Another note is that you can use OWA to recover deleted->deleted items from the OWA Options menu.  You can also recover as hard-deleted or shift-deleted items in OWA by using "?cmd=showdeleted" in the URL.

Again, sorry for the delay in posting but I wanted to post my notes now that I finally got around to testing it.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.