Security access to Exchange 2003 E00 log files

ramitchell0954
ramitchell0954 used Ask the Experts™
on
We have had an incident where I need to access emails that were sent and received from an employee. I expect a subpoena for the emails soon, and will need to be able to print out the emails sent and received by this employee on a specific date. I have access to all the E00 logs.

Is there a preferable binary editor that will parse the E00 log files and put them in a readable/searchable format?

If this question has already been answered by a previous post, kindly direct me to that link.

Your comments and recommendations are appreciated.

R. Mitchell
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
I am not sure of any tool that can convert the log files to a readable format...

What you can try is restoring the mailbox of the user in the RSG... and then connecting it with a test user...
For reference... http://support.microsoft.com/kb/823176

you can then configure a profile for the test user in Outlook and get the mails required....

George SasIT Engineer

Commented:
Don't you have a backup of the exchange ?
You could simply create a recovery storage group , restore your database and get the e-mails in that way. Easyer than rebuilding a storage group with log file replay.

Here is a link describing the recovery options :
http://technet.microsoft.com/en-us/library/aa997761(EXCHG.65).aspx
Its not good to parse Exchange transaction log files...
as per LastLostLast you can restore your back to RSG and then use ExMerge (http://support.microsoft.com/kb/327304) then recover single mailbox or single mail with advanced options of Exmerge.
George SasIT Engineer

Commented:
That is what I was trying to tell him :)

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial