Solved

Forensically recover deleted mail from Exchange server

Posted on 2010-08-12
4
780 Views
Last Modified: 2013-11-14
Hi there,

I have a query more than a pressing problem but I'm interested to know the answer.

Exchange 2003 on server 2003. If email is deleted from a mailbox, the recover deleted items retention period has expired, a backup isnt available. Is it possible using anything, commercial forensic software if required, to ever retrieve that mail?  Basiclaly wondering how does the exchange database handle deleted items? Are they gone gone or ever traceable again? ( as a file on a hard disk might be if the sector hasnt been written over).

Bear in mind the server is still running fine, just can specific old deleted mail be tafgeted in any way for recovery.

Also, hat about a pst? Can indivual mail deleted from a pst be traced?
0
Comment
Question by:BGilhooley
  • 2
4 Comments
 
LVL 3

Expert Comment

by:pmaribeiro
ID: 33421710
If the retention has expired and you dont have backups of that mailbox then you´re screwed.
Sad but true.
 
0
 
LVL 55

Accepted Solution

by:
andyalder earned 500 total points
ID: 33422944
They're not overwritten by zeros or anything when they expire but it's very likely that new emails have overwritten them by now or that the nightly online defrag has shuffled something on top of them.
0
 
LVL 55

Expert Comment

by:andyalder
ID: 33422980
Forgot to mention, OnTrack PowerControls is the tool for recovering exchange, but probably not worth even trying if the emails were deleted a while ago, http://www.ontrackpowercontrols.com/
0
 
LVL 1

Author Closing Comment

by:BGilhooley
ID: 33444546
Thanks Andy, yea was wondering how the database treated the disk space once mail deleted,
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
The question appears often enough, how do I transfer my data from my old server to the new server while preserving file shares, share permissions, and NTFS permisions.  Here are my tips for handling such a transfer.
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question