Link to home
Start Free TrialLog in
Avatar of BGilhooley
BGilhooley

asked on

Forensically recover deleted mail from Exchange server

Hi there,

I have a query more than a pressing problem but I'm interested to know the answer.

Exchange 2003 on server 2003. If email is deleted from a mailbox, the recover deleted items retention period has expired, a backup isnt available. Is it possible using anything, commercial forensic software if required, to ever retrieve that mail?  Basiclaly wondering how does the exchange database handle deleted items? Are they gone gone or ever traceable again? ( as a file on a hard disk might be if the sector hasnt been written over).

Bear in mind the server is still running fine, just can specific old deleted mail be tafgeted in any way for recovery.

Also, hat about a pst? Can indivual mail deleted from a pst be traced?
Avatar of pmaribeiro
pmaribeiro

If the retention has expired and you dont have backups of that mailbox then you´re screwed.
Sad but true.
 
ASKER CERTIFIED SOLUTION
Avatar of Member_2_231077
Member_2_231077

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Forgot to mention, OnTrack PowerControls is the tool for recovering exchange, but probably not worth even trying if the emails were deleted a while ago, http://www.ontrackpowercontrols.com/
Avatar of BGilhooley

ASKER

Thanks Andy, yea was wondering how the database treated the disk space once mail deleted,