users mailbox for someone about to get fired

Posted on 2014-01-21
Last Modified: 2016-05-19
Our boss just came to use with this email. Looking for some feedback as to where to maybe start. Sounds like someone is about to get fired and a lawsuit filed. more work for IT.  

The mailbox size I don't know of any way to setup monitoring unless I have a spare PC setup with her Outlook profile running. Looking for ideas.

We run a barracuda backup server, so I think i can recover everything from there.

The network drive isn't what I am worried about, I got that under control but also looking for ideas.

Thanks !

"What we need to do now is (two things):

1 - Do a before and after on her mailbox size.  As in has there been a dramatic change in size in the past week or so compared to today?  Has it shrunk recently.  Before and after sizes should be provided.  If messages can be recovered they can then be put somewhere besides her email box.  DO NOT RESTORE HER EMAIL BOX.  If they cannot be restored to a different location without alerting her or messing her mailbox up or causing issues do not do anything to restore them.

2 - Do a before and after on her network drive size.  Same as the mailbox - check to see if a bunch of data has been removed, transferred and/ or deleted.  Provide the sizes before and after.  If you find network files deleted - restore them to somewhere else that she cannot see - only we can.  Use the Barracuda for this if needed or would work best.  Do not do anything that would alert her.

Please let me know who is going to handle this and what you find.  If you can do the size checks quickly just do that and let me know.  The recovery can wait - the changes in size request is more immediate.
Question by:mirifexmso
  • 2
  • 2
  • 2
LVL 22

Expert Comment

by:Nick Rhode
ID: 39797047
You could connect to her mailbox by giving yourself full access to it.  The mailbox then should populate in your outlook in which you can backup to PST.

To check the mailbox size you can run this powershell:

Get-MailboxStatistics [username] | ft DisplayName, TotalItemSize

There are a lot more things you can do with powershell and to view mailbox statistics and you can tailor them to what you need in specific.

Found here:
LVL 13

Expert Comment

by:Andy M
ID: 39797165
What version of Exchange are you using? Knowing which version will allow experts to give you the options avialble to you.

I believe newer versions also backup anything in the dumpster to a PST when exporting the mailbox.

If you are using a newer version of Exchange you could export the entire mailbox to a PST (done either via Outlook or via the server) which you can then open in Outlook without any issues from the user in question knowing about it.

You could also increase the dumpster/deleted items retention for the user to esnure they cannot permanently remove anything from their account any time soon.

As for network drive - I assume these are backed up and most decent backup software should allow you to recover files/folders to a different location.

Author Comment

ID: 39797181
This is Exchange 2010.
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why


Author Comment

ID: 39797568
Nick Rhode,

Can you display statistics from what the users mailbox was couple weeks ago ? we want to see if this user has been deleted emails over the course of the whole month.
LVL 22

Assisted Solution

by:Nick Rhode
Nick Rhode earned 250 total points
ID: 39797766
I don't think you can go back to show previous size etc and would have to rely on a backup.  However, exchange does have a retention policy of like 30 days when the recycle bin is empty.  Unless the user is emptying the recycle bin and opening up the Recover Deleted Items bin and purging them from there they are gone.  So if you were to login as the user and check the recover deleted items bin you would see the emails from the user emptying the recycle bin.
LVL 13

Accepted Solution

Andy M earned 250 total points
ID: 39802852
I believe by default the deleted items retention is 14 days (think it's deleted mailboxes that are set to 30 days by default) but this can obviously be changed by whoever setup/looks after the exchange server.

As mentioned previously if you run a PST export of the mailbox from the server I'm sure this also exports all the deleted items/dumpster as well in Exchange 2010 (creates a separate folder in the PST with this in) so you'd have a copy of all the users emails from this moment to fall back/use as evidence.  As it's Exchange 2010 you can do this on the server without the user even knowing about it then just open the PST on any copy of Outlook as normal.

If the user has emptied the dumpster (and in my experience very few standard users know how to do this) then you'd have to go back to the actual backups from the Exchange server to look at them.

The following link explains how to export mailboxes to PST on Exchange 2010:

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
This video discusses moving either the default database or any database to a new volume.
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question