Solved

Is there a way to check if a user has deleted mail items?

Posted on 2009-04-07
4
363 Views
Last Modified: 2012-06-27
If mail has supposedly 'disappeared' from a group mailbox, is there a way to check i.e. through logs or something, if a specific user has deleted them?

The receipient policy in place would not have removed them as the emails were within the allowed timeframe.  Also, all emails in the inbox were reported to have just disappeared sometime between mid-morning and lunchtime and the receipient policy runs at 4am

Environment is Exchange 2003 SP2

Many thanks for any help.
0
Comment
Question by:sbickerstaff
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 8

Expert Comment

by:greesh_hem
ID: 24085989
If a particular user who is a member of that shared mailbox, and if he/she has deleted some emails then those emails would show up in that users deleted items. So you would need to look up each users deleted items to find those emails.
0
 
LVL 3

Author Comment

by:sbickerstaff
ID: 24086018
On the Thursday night backup, all the items are there.  On the Friday night backup, they aren't, only the few that were received on the Friday afternoon.  Using this Friday nite backup (after they 'disappeared') I've looked in the deleted items and recover deleted items for each user who has editor access, but there's nothing.

If the user did a shift + delete then it wouldn't go to their deleted items, but in a case like this, is there then anyway to track it?  We COULD restore the items, but we're trying to find out what has happened in there's a chance it could happen again.
0
 
LVL 14

Expert Comment

by:Raj-GT
ID: 24086059
You can use exmerge to search within the dumpster and recover all deleted mails within the retention period.

Exmerger > Extract and import > extract data > options > and Items from dumpster

0
 
LVL 25

Accepted Solution

by:
kieran_b earned 500 total points
ID: 24086078
Which also doesn't answer the question...

Long story short, no, not retrospectively - the best you could do is boost logging and then trawl through it in the future, but that is a whole world of hurt without using third party tools
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

We are happy to announce a brand new addition to our line of acclaimed email signature management products – CodeTwo Email Signatures for Office 365.
This article explains how to install and use the NTBackup utility that comes with Windows Server.
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

735 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question