Reading messages from an exchange server

Hi There,
    Like many other people in the IT industry, the owner of my company has walked up to me and said "We are suing our former employee, I want you to go through and print out his old/deleted/sent e-mails so we can dig up incriminating evidence on him".

     The server is exchange 2000, the client is Outlook.  If the user deleted the e-mails out of their inbox, sent items, and deleted items, is there a way to retreive the message?  Assume message tracking and journaling haven't been turned on.  If there's no way to do it, that's fine at least I'll know I've exausted every possibility and can tell him there's no way to do it.

     Owners of companies seem to be under the impression that all e-mails are tracked by the system and anything can be retreived.  I think that is not true unless journaling is turned on, and if it is turned on all the time for every mailbox, there would be a huge amount of disk space needed to keep all that info, do I have that right?  I've never investigated enough to reply to that idea with any kind of authority.

Thanks for any advice

     
prima854Asked:
Who is Participating?
 
mass2612Connect With a Mentor Commented:
Hi,

What's your deleted items retention time set to? Normally this is set to seven days which means that you can recover deleted items using the Outlook Recover deleted items up to 7 days ago. Apart from that you need to restore the Information store from backup prior to the deletion and grab the mails from there. In Exchange 2000 this is a pain as there is no RSG and you need a recovery server.

How to recover or restore a single mailbox in Exchange 2000 Server
http://support.microsoft.com/kb/813337
0
 
KutyiCommented:
If you have a backup you may be able to restore his mailbox and gain access to it.
0
 
tgtranCommented:
If you did not change anything on your Exchange box, deleted items are retained for 30 days by default.  But if the employee has been gone longer than that, you are out of luck.

Another thing to look is archive,  Outlook autoarchive feature save data in PST on local machine.  It doesn't hurt to give it a look-see

And lastly, like Kutyi said, you can locate the mailbox from an old backup - keep in mind that if you did not perform brick-level backup, you would have to restore the whole information store and pull the mailbox out and this process is more complicated with the production box still humming along.  So, it boils down to how much work do you want to put into this
0
 
Malli BoppeCommented:
If you have full backup you use recover storage group feature in exchange 2003

http://www.msexchange.org/tutorials/Exchange_Server_2003_Mailbox_Recovery.html
0
 
prima854Author Commented:
Thanks for all the Comments.  I didn't see anyone talking about it too much, but it looks like by default if we have an exchange server, there isn't a way to just look at what the person's e-mail has been doing, other than going into their mailbox itself and digging around, as opposed to going in from the server and looking for some kind of log if journaling hasn't been turned on.

Other than  that I'll have to use a recovery server.  Thanks for everyone's help!
0
All Courses

From novice to tech pro — start learning today.