users mailbox for someone about to get fired

Posted on 2014-01-21
Last Modified: 2016-05-19
Our boss just came to use with this email. Looking for some feedback as to where to maybe start. Sounds like someone is about to get fired and a lawsuit filed. more work for IT.  

The mailbox size I don't know of any way to setup monitoring unless I have a spare PC setup with her Outlook profile running. Looking for ideas.

We run a barracuda backup server, so I think i can recover everything from there.

The network drive isn't what I am worried about, I got that under control but also looking for ideas.

Thanks !

"What we need to do now is (two things):

1 - Do a before and after on her mailbox size.  As in has there been a dramatic change in size in the past week or so compared to today?  Has it shrunk recently.  Before and after sizes should be provided.  If messages can be recovered they can then be put somewhere besides her email box.  DO NOT RESTORE HER EMAIL BOX.  If they cannot be restored to a different location without alerting her or messing her mailbox up or causing issues do not do anything to restore them.

2 - Do a before and after on her network drive size.  Same as the mailbox - check to see if a bunch of data has been removed, transferred and/ or deleted.  Provide the sizes before and after.  If you find network files deleted - restore them to somewhere else that she cannot see - only we can.  Use the Barracuda for this if needed or would work best.  Do not do anything that would alert her.

Please let me know who is going to handle this and what you find.  If you can do the size checks quickly just do that and let me know.  The recovery can wait - the changes in size request is more immediate.
Question by:mirifexmso
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
LVL 22

Expert Comment

by:Nick Rhode
ID: 39797047
You could connect to her mailbox by giving yourself full access to it.  The mailbox then should populate in your outlook in which you can backup to PST.

To check the mailbox size you can run this powershell:

Get-MailboxStatistics [username] | ft DisplayName, TotalItemSize

There are a lot more things you can do with powershell and to view mailbox statistics and you can tailor them to what you need in specific.

Found here:
LVL 13

Expert Comment

by:Andy M
ID: 39797165
What version of Exchange are you using? Knowing which version will allow experts to give you the options avialble to you.

I believe newer versions also backup anything in the dumpster to a PST when exporting the mailbox.

If you are using a newer version of Exchange you could export the entire mailbox to a PST (done either via Outlook or via the server) which you can then open in Outlook without any issues from the user in question knowing about it.

You could also increase the dumpster/deleted items retention for the user to esnure they cannot permanently remove anything from their account any time soon.

As for network drive - I assume these are backed up and most decent backup software should allow you to recover files/folders to a different location.

Author Comment

ID: 39797181
This is Exchange 2010.
Free Webinar: AWS Backup & DR

Join our upcoming webinar with experts from AWS, CloudBerry Lab, and the Town of Edgartown IT to discuss best practices for simplifying online backup management and cutting costs.


Author Comment

ID: 39797568
Nick Rhode,

Can you display statistics from what the users mailbox was couple weeks ago ? we want to see if this user has been deleted emails over the course of the whole month.
LVL 22

Assisted Solution

by:Nick Rhode
Nick Rhode earned 250 total points
ID: 39797766
I don't think you can go back to show previous size etc and would have to rely on a backup.  However, exchange does have a retention policy of like 30 days when the recycle bin is empty.  Unless the user is emptying the recycle bin and opening up the Recover Deleted Items bin and purging them from there they are gone.  So if you were to login as the user and check the recover deleted items bin you would see the emails from the user emptying the recycle bin.
LVL 13

Accepted Solution

Andy M earned 250 total points
ID: 39802852
I believe by default the deleted items retention is 14 days (think it's deleted mailboxes that are set to 30 days by default) but this can obviously be changed by whoever setup/looks after the exchange server.

As mentioned previously if you run a PST export of the mailbox from the server I'm sure this also exports all the deleted items/dumpster as well in Exchange 2010 (creates a separate folder in the PST with this in) so you'd have a copy of all the users emails from this moment to fall back/use as evidence.  As it's Exchange 2010 you can do this on the server without the user even knowing about it then just open the PST on any copy of Outlook as normal.

If the user has emptied the dumpster (and in my experience very few standard users know how to do this) then you'd have to go back to the actual backups from the Exchange server to look at them.

The following link explains how to export mailboxes to PST on Exchange 2010:

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
exchange 2007 5 36
Exchange 2016 OWA attachment issues 4 41
Fraud Email 22 71
Exchange 2016 - not receiving mail 17 35
Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
This article explains how to install and use the NTBackup utility that comes with Windows Server.
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit If you want to manage em…

735 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question