Solved

users mailbox for someone about to get fired

Posted on 2014-01-21
7
9 Views
Last Modified: 2016-05-19
Our boss just came to use with this email. Looking for some feedback as to where to maybe start. Sounds like someone is about to get fired and a lawsuit filed. more work for IT.  

The mailbox size I don't know of any way to setup monitoring unless I have a spare PC setup with her Outlook profile running. Looking for ideas.

We run a barracuda backup server, so I think i can recover everything from there.

The network drive isn't what I am worried about, I got that under control but also looking for ideas.

Thanks !


"What we need to do now is (two things):

1 - Do a before and after on her mailbox size.  As in has there been a dramatic change in size in the past week or so compared to today?  Has it shrunk recently.  Before and after sizes should be provided.  If messages can be recovered they can then be put somewhere besides her email box.  DO NOT RESTORE HER EMAIL BOX.  If they cannot be restored to a different location without alerting her or messing her mailbox up or causing issues do not do anything to restore them.

2 - Do a before and after on her network drive size.  Same as the mailbox - check to see if a bunch of data has been removed, transferred and/ or deleted.  Provide the sizes before and after.  If you find network files deleted - restore them to somewhere else that she cannot see - only we can.  Use the Barracuda for this if needed or would work best.  Do not do anything that would alert her.

Please let me know who is going to handle this and what you find.  If you can do the size checks quickly just do that and let me know.  The recovery can wait - the changes in size request is more immediate.
0
Comment
Question by:mirifexmso
  • 2
  • 2
  • 2
7 Comments
 
LVL 22

Expert Comment

by:Nick Rhode
ID: 39797047
You could connect to her mailbox by giving yourself full access to it.  The mailbox then should populate in your outlook in which you can backup to PST.

To check the mailbox size you can run this powershell:

Get-MailboxStatistics [username] | ft DisplayName, TotalItemSize

There are a lot more things you can do with powershell and to view mailbox statistics and you can tailor them to what you need in specific.

Found here:  http://help.outlook.com/en-us/140/Gg576861.aspx
0
 
LVL 13

Expert Comment

by:Andy M
ID: 39797165
What version of Exchange are you using? Knowing which version will allow experts to give you the options avialble to you.

I believe newer versions also backup anything in the dumpster to a PST when exporting the mailbox.

If you are using a newer version of Exchange you could export the entire mailbox to a PST (done either via Outlook or via the server) which you can then open in Outlook without any issues from the user in question knowing about it.

You could also increase the dumpster/deleted items retention for the user to esnure they cannot permanently remove anything from their account any time soon.

As for network drive - I assume these are backed up and most decent backup software should allow you to recover files/folders to a different location.
0
 

Author Comment

by:mirifexmso
ID: 39797181
This is Exchange 2010.
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 

Author Comment

by:mirifexmso
ID: 39797568
Nick Rhode,

Can you display statistics from what the users mailbox was couple weeks ago ? we want to see if this user has been deleted emails over the course of the whole month.
0
 
LVL 22

Assisted Solution

by:Nick Rhode
Nick Rhode earned 250 total points
ID: 39797766
I don't think you can go back to show previous size etc and would have to rely on a backup.  However, exchange does have a retention policy of like 30 days when the recycle bin is empty.  Unless the user is emptying the recycle bin and opening up the Recover Deleted Items bin and purging them from there they are gone.  So if you were to login as the user and check the recover deleted items bin you would see the emails from the user emptying the recycle bin.
0
 
LVL 13

Accepted Solution

by:
Andy M earned 250 total points
ID: 39802852
I believe by default the deleted items retention is 14 days (think it's deleted mailboxes that are set to 30 days by default) but this can obviously be changed by whoever setup/looks after the exchange server.

As mentioned previously if you run a PST export of the mailbox from the server I'm sure this also exports all the deleted items/dumpster as well in Exchange 2010 (creates a separate folder in the PST with this in) so you'd have a copy of all the users emails from this moment to fall back/use as evidence.  As it's Exchange 2010 you can do this on the server without the user even knowing about it then just open the PST on any copy of Outlook as normal.

If the user has emptied the dumpster (and in my experience very few standard users know how to do this) then you'd have to go back to the actual backups from the Exchange server to look at them.

The following link explains how to export mailboxes to PST on Exchange 2010:

http://exchangeserverpro.com/export-mailboxes-exchange-server-2010-sp1/
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Easy CSR creation in Exchange 2007,2010 and 2013
Scam emails are a huge burden for many businesses. Spotting one is not always easy. Follow our tips to identify if an email you receive is a scam.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
In this video we show how to create a Shared Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Sha…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now