mirifexmso
asked on
users mailbox for someone about to get fired
Our boss just came to use with this email. Looking for some feedback as to where to maybe start. Sounds like someone is about to get fired and a lawsuit filed. more work for IT.
The mailbox size I don't know of any way to setup monitoring unless I have a spare PC setup with her Outlook profile running. Looking for ideas.
We run a barracuda backup server, so I think i can recover everything from there.
The network drive isn't what I am worried about, I got that under control but also looking for ideas.
Thanks !
"What we need to do now is (two things):
1 - Do a before and after on her mailbox size. As in has there been a dramatic change in size in the past week or so compared to today? Has it shrunk recently. Before and after sizes should be provided. If messages can be recovered they can then be put somewhere besides her email box. DO NOT RESTORE HER EMAIL BOX. If they cannot be restored to a different location without alerting her or messing her mailbox up or causing issues do not do anything to restore them.
2 - Do a before and after on her network drive size. Same as the mailbox - check to see if a bunch of data has been removed, transferred and/ or deleted. Provide the sizes before and after. If you find network files deleted - restore them to somewhere else that she cannot see - only we can. Use the Barracuda for this if needed or would work best. Do not do anything that would alert her.
Please let me know who is going to handle this and what you find. If you can do the size checks quickly just do that and let me know. The recovery can wait - the changes in size request is more immediate.
The mailbox size I don't know of any way to setup monitoring unless I have a spare PC setup with her Outlook profile running. Looking for ideas.
We run a barracuda backup server, so I think i can recover everything from there.
The network drive isn't what I am worried about, I got that under control but also looking for ideas.
Thanks !
"What we need to do now is (two things):
1 - Do a before and after on her mailbox size. As in has there been a dramatic change in size in the past week or so compared to today? Has it shrunk recently. Before and after sizes should be provided. If messages can be recovered they can then be put somewhere besides her email box. DO NOT RESTORE HER EMAIL BOX. If they cannot be restored to a different location without alerting her or messing her mailbox up or causing issues do not do anything to restore them.
2 - Do a before and after on her network drive size. Same as the mailbox - check to see if a bunch of data has been removed, transferred and/ or deleted. Provide the sizes before and after. If you find network files deleted - restore them to somewhere else that she cannot see - only we can. Use the Barracuda for this if needed or would work best. Do not do anything that would alert her.
Please let me know who is going to handle this and what you find. If you can do the size checks quickly just do that and let me know. The recovery can wait - the changes in size request is more immediate.
What version of Exchange are you using? Knowing which version will allow experts to give you the options avialble to you.
I believe newer versions also backup anything in the dumpster to a PST when exporting the mailbox.
If you are using a newer version of Exchange you could export the entire mailbox to a PST (done either via Outlook or via the server) which you can then open in Outlook without any issues from the user in question knowing about it.
You could also increase the dumpster/deleted items retention for the user to esnure they cannot permanently remove anything from their account any time soon.
As for network drive - I assume these are backed up and most decent backup software should allow you to recover files/folders to a different location.
I believe newer versions also backup anything in the dumpster to a PST when exporting the mailbox.
If you are using a newer version of Exchange you could export the entire mailbox to a PST (done either via Outlook or via the server) which you can then open in Outlook without any issues from the user in question knowing about it.
You could also increase the dumpster/deleted items retention for the user to esnure they cannot permanently remove anything from their account any time soon.
As for network drive - I assume these are backed up and most decent backup software should allow you to recover files/folders to a different location.
ASKER
This is Exchange 2010.
ASKER
Nick Rhode,
Can you display statistics from what the users mailbox was couple weeks ago ? we want to see if this user has been deleted emails over the course of the whole month.
Can you display statistics from what the users mailbox was couple weeks ago ? we want to see if this user has been deleted emails over the course of the whole month.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
To check the mailbox size you can run this powershell:
Get-MailboxStatistics [username] | ft DisplayName, TotalItemSize
There are a lot more things you can do with powershell and to view mailbox statistics and you can tailor them to what you need in specific.
Found here: http://help.outlook.com/en-us/140/Gg576861.aspx