BGilhooley
asked on
Forensically recover deleted mail from Exchange server
Hi there,
I have a query more than a pressing problem but I'm interested to know the answer.
Exchange 2003 on server 2003. If email is deleted from a mailbox, the recover deleted items retention period has expired, a backup isnt available. Is it possible using anything, commercial forensic software if required, to ever retrieve that mail? Basiclaly wondering how does the exchange database handle deleted items? Are they gone gone or ever traceable again? ( as a file on a hard disk might be if the sector hasnt been written over).
Bear in mind the server is still running fine, just can specific old deleted mail be tafgeted in any way for recovery.
Also, hat about a pst? Can indivual mail deleted from a pst be traced?
I have a query more than a pressing problem but I'm interested to know the answer.
Exchange 2003 on server 2003. If email is deleted from a mailbox, the recover deleted items retention period has expired, a backup isnt available. Is it possible using anything, commercial forensic software if required, to ever retrieve that mail? Basiclaly wondering how does the exchange database handle deleted items? Are they gone gone or ever traceable again? ( as a file on a hard disk might be if the sector hasnt been written over).
Bear in mind the server is still running fine, just can specific old deleted mail be tafgeted in any way for recovery.
Also, hat about a pst? Can indivual mail deleted from a pst be traced?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Forgot to mention, OnTrack PowerControls is the tool for recovering exchange, but probably not worth even trying if the emails were deleted a while ago, http://www.ontrackpowercontrols.com/
ASKER
Thanks Andy, yea was wondering how the database treated the disk space once mail deleted,
Sad but true.