Reading messages from an exchange server

Hi There,
    Like many other people in the IT industry, the owner of my company has walked up to me and said "We are suing our former employee, I want you to go through and print out his old/deleted/sent e-mails so we can dig up incriminating evidence on him".

     The server is exchange 2000, the client is Outlook.  If the user deleted the e-mails out of their inbox, sent items, and deleted items, is there a way to retreive the message?  Assume message tracking and journaling haven't been turned on.  If there's no way to do it, that's fine at least I'll know I've exausted every possibility and can tell him there's no way to do it.

     Owners of companies seem to be under the impression that all e-mails are tracked by the system and anything can be retreived.  I think that is not true unless journaling is turned on, and if it is turned on all the time for every mailbox, there would be a huge amount of disk space needed to keep all that info, do I have that right?  I've never investigated enough to reply to that idea with any kind of authority.

Thanks for any advice

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

If you have a backup you may be able to restore his mailbox and gain access to it.

What's your deleted items retention time set to? Normally this is set to seven days which means that you can recover deleted items using the Outlook Recover deleted items up to 7 days ago. Apart from that you need to restore the Information store from backup prior to the deletion and grab the mails from there. In Exchange 2000 this is a pain as there is no RSG and you need a recovery server.

How to recover or restore a single mailbox in Exchange 2000 Server

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
TG TranIT guyCommented:
If you did not change anything on your Exchange box, deleted items are retained for 30 days by default.  But if the employee has been gone longer than that, you are out of luck.

Another thing to look is archive,  Outlook autoarchive feature save data in PST on local machine.  It doesn't hurt to give it a look-see

And lastly, like Kutyi said, you can locate the mailbox from an old backup - keep in mind that if you did not perform brick-level backup, you would have to restore the whole information store and pull the mailbox out and this process is more complicated with the production box still humming along.  So, it boils down to how much work do you want to put into this
Malli BoppeCommented:
If you have full backup you use recover storage group feature in exchange 2003
prima854Author Commented:
Thanks for all the Comments.  I didn't see anyone talking about it too much, but it looks like by default if we have an exchange server, there isn't a way to just look at what the person's e-mail has been doing, other than going into their mailbox itself and digging around, as opposed to going in from the server and looking for some kind of log if journaling hasn't been turned on.

Other than  that I'll have to use a recovery server.  Thanks for everyone's help!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.