Solved

Forensically recover deleted mail from Exchange server

Posted on 2010-08-12
4
799 Views
Last Modified: 2013-11-14
Hi there,

I have a query more than a pressing problem but I'm interested to know the answer.

Exchange 2003 on server 2003. If email is deleted from a mailbox, the recover deleted items retention period has expired, a backup isnt available. Is it possible using anything, commercial forensic software if required, to ever retrieve that mail?  Basiclaly wondering how does the exchange database handle deleted items? Are they gone gone or ever traceable again? ( as a file on a hard disk might be if the sector hasnt been written over).

Bear in mind the server is still running fine, just can specific old deleted mail be tafgeted in any way for recovery.

Also, hat about a pst? Can indivual mail deleted from a pst be traced?
0
Comment
Question by:BGilhooley
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 3

Expert Comment

by:pmaribeiro
ID: 33421710
If the retention has expired and you dont have backups of that mailbox then you´re screwed.
Sad but true.
 
0
 
LVL 56

Accepted Solution

by:
andyalder earned 500 total points
ID: 33422944
They're not overwritten by zeros or anything when they expire but it's very likely that new emails have overwritten them by now or that the nightly online defrag has shuffled something on top of them.
0
 
LVL 56

Expert Comment

by:andyalder
ID: 33422980
Forgot to mention, OnTrack PowerControls is the tool for recovering exchange, but probably not worth even trying if the emails were deleted a while ago, http://www.ontrackpowercontrols.com/
0
 
LVL 1

Author Closing Comment

by:BGilhooley
ID: 33444546
Thanks Andy, yea was wondering how the database treated the disk space once mail deleted,
0

Featured Post

Revamp Your Training Process

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

After hours on line I found a solution which pointed to the inherited Active Directory permissions . You have to give/allow permissions to the "Exchange trusted subsystem" for the user in the Active Directory...
If you troubleshoot Outlook for clients, you may want to know a bit more about the OST file before doing your next job. IMAP can cause a lot of drama if removed in the accounts without backing up.
In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
Suggested Courses

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question