Forensically recover deleted mail from Exchange server
Posted on 2010-08-12
I have a query more than a pressing problem but I'm interested to know the answer.
Exchange 2003 on server 2003. If email is deleted from a mailbox, the recover deleted items retention period has expired, a backup isnt available. Is it possible using anything, commercial forensic software if required, to ever retrieve that mail? Basiclaly wondering how does the exchange database handle deleted items? Are they gone gone or ever traceable again? ( as a file on a hard disk might be if the sector hasnt been written over).
Bear in mind the server is still running fine, just can specific old deleted mail be tafgeted in any way for recovery.
Also, hat about a pst? Can indivual mail deleted from a pst be traced?