Solved

Forensically recover deleted mail from Exchange server

Posted on 2010-08-12
4
763 Views
Last Modified: 2013-11-14
Hi there,

I have a query more than a pressing problem but I'm interested to know the answer.

Exchange 2003 on server 2003. If email is deleted from a mailbox, the recover deleted items retention period has expired, a backup isnt available. Is it possible using anything, commercial forensic software if required, to ever retrieve that mail?  Basiclaly wondering how does the exchange database handle deleted items? Are they gone gone or ever traceable again? ( as a file on a hard disk might be if the sector hasnt been written over).

Bear in mind the server is still running fine, just can specific old deleted mail be tafgeted in any way for recovery.

Also, hat about a pst? Can indivual mail deleted from a pst be traced?
0
Comment
Question by:BGilhooley
  • 2
4 Comments
 
LVL 3

Expert Comment

by:pmaribeiro
ID: 33421710
If the retention has expired and you dont have backups of that mailbox then you´re screwed.
Sad but true.
 
0
 
LVL 55

Accepted Solution

by:
andyalder earned 500 total points
ID: 33422944
They're not overwritten by zeros or anything when they expire but it's very likely that new emails have overwritten them by now or that the nightly online defrag has shuffled something on top of them.
0
 
LVL 55

Expert Comment

by:andyalder
ID: 33422980
Forgot to mention, OnTrack PowerControls is the tool for recovering exchange, but probably not worth even trying if the emails were deleted a while ago, http://www.ontrackpowercontrols.com/
0
 
LVL 1

Author Closing Comment

by:BGilhooley
ID: 33444546
Thanks Andy, yea was wondering how the database treated the disk space once mail deleted,
0

Featured Post

Why spend so long doing email signature updates?

Do you spend loads of your time carrying out email signature updates? Not very interesting are they? Don’t let signature updates get you down. Let Exclaimer Cloud - Signatures for Office 365 make managing email signatures a breeze.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
Finding original email is quite difficult due to their duplicates. From this article, you will come to know why multiple duplicates of same emails appear and how to delete duplicate emails from Outlook securely and instantly while vital emails remai…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…
This video discusses moving either the default database or any database to a new volume.

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now