Retreive email content from Exchange Message Tracking Center
We have an employee that departed our employ on a bad note. We're concerned that she emailed her external email a list of clients and other items that are in serious breach of her employment contract.
I've been called in to see if I can find a copy of everything she may have sent herself because she has meticulously cleaned out her Outlook mailbox, yet a message search clearly shows certain suspicious behaviour.
The emails in question are circled in the screenshot attached. I want to know if i can find out the content of the message and what the attachments were.
All help will be greatly appreciated.
Untitled.png
I've been called in to see if I can find a copy of everything she may have sent herself because she has meticulously cleaned out her Outlook mailbox, yet a message search clearly shows certain suspicious behaviour.
The emails in question are circled in the screenshot attached. I want to know if i can find out the content of the message and what the attachments were.
All help will be greatly appreciated.
Untitled.png
ASKER
damn it... how can i check if i have journaling enabled (or turn it on for future (if this is a good idea))?
left on 20/09/2010.
deleted items from outlook, her archived .pst and emptied trash. Our deleted mail retention policy is only for 7 days.
mailbox is still available.
I thought i might me in luck because this particular exchange server is a child to my exchange server, but... it is POPing all mail onto it and therefor no longer exists on my server either.
left on 20/09/2010.
deleted items from outlook, her archived .pst and emptied trash. Our deleted mail retention policy is only for 7 days.
mailbox is still available.
I thought i might me in luck because this particular exchange server is a child to my exchange server, but... it is POPing all mail onto it and therefor no longer exists on my server either.
ASKER
the owners of the office in subject weren't suspicious of anything nasty until Monday this week.
So we may have missed the boat... but I really want to exhaust every avenue before i tell them that.
So we may have missed the boat... but I really want to exhaust every avenue before i tell them that.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
tried exmerge yesterday after scouring outlook and it's "recover deleted items". no go. :-(
any other suggestions?
is journaling a bad thing for server performance and storage?
any other suggestions?
is journaling a bad thing for server performance and storage?
no other suggestions sorry ...
for journaling it does eat storage (obviously) never had any serious performance issue with it though. but it is a most for most of my clients
for journaling it does eat storage (obviously) never had any serious performance issue with it though. but it is a most for most of my clients
ASKER
the one other hope i had, and already tried with no success was a "previous versions" search while exploring the exchange data folders (in particular the 'queues' folder).
I'm really sorry I do understand how bad the situation should be ...
do you send emails directly or through smart host ? maybe a copy on the smart-host
do you send emails directly or through smart host ? maybe a copy on the smart-host
ASKER
used to be directly until about 7 months ago. We were having too many relay issues. So we are now using a smart-host. Which is unfortunately our ISP.
If it came down to it, after a lot of effor they could probably subpoena the seizure of the user's private mailbox based on reasonable suspicion, but I doubt it will go anywhere near that stage.
If it came down to it, after a lot of effor they could probably subpoena the seizure of the user's private mailbox based on reasonable suspicion, but I doubt it will go anywhere near that stage.
ASKER
not quite the solution i was looking for, but good to know for future
when did she leave ? did she just delete items from outlook? is her mailbox still available ?