Solved

Forensically recover deleted mail from Exchange server

Posted on 2010-08-12
4
791 Views
Last Modified: 2013-11-14
Hi there,

I have a query more than a pressing problem but I'm interested to know the answer.

Exchange 2003 on server 2003. If email is deleted from a mailbox, the recover deleted items retention period has expired, a backup isnt available. Is it possible using anything, commercial forensic software if required, to ever retrieve that mail?  Basiclaly wondering how does the exchange database handle deleted items? Are they gone gone or ever traceable again? ( as a file on a hard disk might be if the sector hasnt been written over).

Bear in mind the server is still running fine, just can specific old deleted mail be tafgeted in any way for recovery.

Also, hat about a pst? Can indivual mail deleted from a pst be traced?
0
Comment
Question by:BGilhooley
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 3

Expert Comment

by:pmaribeiro
ID: 33421710
If the retention has expired and you dont have backups of that mailbox then you´re screwed.
Sad but true.
 
0
 
LVL 55

Accepted Solution

by:
andyalder earned 500 total points
ID: 33422944
They're not overwritten by zeros or anything when they expire but it's very likely that new emails have overwritten them by now or that the nightly online defrag has shuffled something on top of them.
0
 
LVL 55

Expert Comment

by:andyalder
ID: 33422980
Forgot to mention, OnTrack PowerControls is the tool for recovering exchange, but probably not worth even trying if the emails were deleted a while ago, http://www.ontrackpowercontrols.com/
0
 
LVL 1

Author Closing Comment

by:BGilhooley
ID: 33444546
Thanks Andy, yea was wondering how the database treated the disk space once mail deleted,
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
Each year, investment in cloud platforms grows more than 20% (https://www.immun.io/hubfs/Immunio_2016/Content/Marketing/Cloud-Security-Report-2016.pdf?submissionGuid=a8d80a00-6fee-4b85-81db-a4e28f681762) as an increasing number of companies begin to…
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
This Micro Tutorial will teach you how to reformat your flash drive. Sometimes your flash drive may have issues carrying files so this will completely restore it to manufacturing settings. Make sure to backup all files before reformatting. This w…

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question