Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


users mailbox for someone about to get fired

Posted on 2014-01-21
Medium Priority
Last Modified: 2016-05-19
Our boss just came to use with this email. Looking for some feedback as to where to maybe start. Sounds like someone is about to get fired and a lawsuit filed. more work for IT.  

The mailbox size I don't know of any way to setup monitoring unless I have a spare PC setup with her Outlook profile running. Looking for ideas.

We run a barracuda backup server, so I think i can recover everything from there.

The network drive isn't what I am worried about, I got that under control but also looking for ideas.

Thanks !

"What we need to do now is (two things):

1 - Do a before and after on her mailbox size.  As in has there been a dramatic change in size in the past week or so compared to today?  Has it shrunk recently.  Before and after sizes should be provided.  If messages can be recovered they can then be put somewhere besides her email box.  DO NOT RESTORE HER EMAIL BOX.  If they cannot be restored to a different location without alerting her or messing her mailbox up or causing issues do not do anything to restore them.

2 - Do a before and after on her network drive size.  Same as the mailbox - check to see if a bunch of data has been removed, transferred and/ or deleted.  Provide the sizes before and after.  If you find network files deleted - restore them to somewhere else that she cannot see - only we can.  Use the Barracuda for this if needed or would work best.  Do not do anything that would alert her.

Please let me know who is going to handle this and what you find.  If you can do the size checks quickly just do that and let me know.  The recovery can wait - the changes in size request is more immediate.
Question by:mirifexmso
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
LVL 22

Expert Comment

by:Nick Rhode
ID: 39797047
You could connect to her mailbox by giving yourself full access to it.  The mailbox then should populate in your outlook in which you can backup to PST.

To check the mailbox size you can run this powershell:

Get-MailboxStatistics [username] | ft DisplayName, TotalItemSize

There are a lot more things you can do with powershell and to view mailbox statistics and you can tailor them to what you need in specific.

Found here:
LVL 14

Expert Comment

by:Andy M
ID: 39797165
What version of Exchange are you using? Knowing which version will allow experts to give you the options avialble to you.

I believe newer versions also backup anything in the dumpster to a PST when exporting the mailbox.

If you are using a newer version of Exchange you could export the entire mailbox to a PST (done either via Outlook or via the server) which you can then open in Outlook without any issues from the user in question knowing about it.

You could also increase the dumpster/deleted items retention for the user to esnure they cannot permanently remove anything from their account any time soon.

As for network drive - I assume these are backed up and most decent backup software should allow you to recover files/folders to a different location.

Author Comment

ID: 39797181
This is Exchange 2010.
Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.


Author Comment

ID: 39797568
Nick Rhode,

Can you display statistics from what the users mailbox was couple weeks ago ? we want to see if this user has been deleted emails over the course of the whole month.
LVL 22

Assisted Solution

by:Nick Rhode
Nick Rhode earned 1000 total points
ID: 39797766
I don't think you can go back to show previous size etc and would have to rely on a backup.  However, exchange does have a retention policy of like 30 days when the recycle bin is empty.  Unless the user is emptying the recycle bin and opening up the Recover Deleted Items bin and purging them from there they are gone.  So if you were to login as the user and check the recover deleted items bin you would see the emails from the user emptying the recycle bin.
LVL 14

Accepted Solution

Andy M earned 1000 total points
ID: 39802852
I believe by default the deleted items retention is 14 days (think it's deleted mailboxes that are set to 30 days by default) but this can obviously be changed by whoever setup/looks after the exchange server.

As mentioned previously if you run a PST export of the mailbox from the server I'm sure this also exports all the deleted items/dumpster as well in Exchange 2010 (creates a separate folder in the PST with this in) so you'd have a copy of all the users emails from this moment to fall back/use as evidence.  As it's Exchange 2010 you can do this on the server without the user even knowing about it then just open the PST on any copy of Outlook as normal.

If the user has emptied the dumpster (and in my experience very few standard users know how to do this) then you'd have to go back to the actual backups from the Exchange server to look at them.

The following link explains how to export mailboxes to PST on Exchange 2010:

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Unified and professional email signatures help maintain a consistent company brand image to the outside world. This article shows how to create an email signature in Exchange Server 2010 using a transport rule and how to overcome native limitations …
On September 18, Experts Exchange launched the first installment of the Help Bell, a new feature for Premium Members, Team Accounts, and Qualified Experts. The Help Bell will serve as an additional tool to help teams increase question visibility.
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question