Solved

Forensically recover deleted mail from Exchange server

Posted on 2010-08-12
4
786 Views
Last Modified: 2013-11-14
Hi there,

I have a query more than a pressing problem but I'm interested to know the answer.

Exchange 2003 on server 2003. If email is deleted from a mailbox, the recover deleted items retention period has expired, a backup isnt available. Is it possible using anything, commercial forensic software if required, to ever retrieve that mail?  Basiclaly wondering how does the exchange database handle deleted items? Are they gone gone or ever traceable again? ( as a file on a hard disk might be if the sector hasnt been written over).

Bear in mind the server is still running fine, just can specific old deleted mail be tafgeted in any way for recovery.

Also, hat about a pst? Can indivual mail deleted from a pst be traced?
0
Comment
Question by:BGilhooley
  • 2
4 Comments
 
LVL 3

Expert Comment

by:pmaribeiro
ID: 33421710
If the retention has expired and you dont have backups of that mailbox then you´re screwed.
Sad but true.
 
0
 
LVL 55

Accepted Solution

by:
andyalder earned 500 total points
ID: 33422944
They're not overwritten by zeros or anything when they expire but it's very likely that new emails have overwritten them by now or that the nightly online defrag has shuffled something on top of them.
0
 
LVL 55

Expert Comment

by:andyalder
ID: 33422980
Forgot to mention, OnTrack PowerControls is the tool for recovering exchange, but probably not worth even trying if the emails were deleted a while ago, http://www.ontrackpowercontrols.com/
0
 
LVL 1

Author Closing Comment

by:BGilhooley
ID: 33444546
Thanks Andy, yea was wondering how the database treated the disk space once mail deleted,
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
The question appears often enough, how do I transfer my data from my old server to the new server while preserving file shares, share permissions, and NTFS permisions.  Here are my tips for handling such a transfer.
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
This Micro Tutorial will teach you how to reformat your flash drive. Sometimes your flash drive may have issues carrying files so this will completely restore it to manufacturing settings. Make sure to backup all files before reformatting. This w…

756 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question