Solved

users mailbox for someone about to get fired

Posted on 2014-01-21
7
13 Views
Last Modified: 2016-05-19
Our boss just came to use with this email. Looking for some feedback as to where to maybe start. Sounds like someone is about to get fired and a lawsuit filed. more work for IT.  

The mailbox size I don't know of any way to setup monitoring unless I have a spare PC setup with her Outlook profile running. Looking for ideas.

We run a barracuda backup server, so I think i can recover everything from there.

The network drive isn't what I am worried about, I got that under control but also looking for ideas.

Thanks !


"What we need to do now is (two things):

1 - Do a before and after on her mailbox size.  As in has there been a dramatic change in size in the past week or so compared to today?  Has it shrunk recently.  Before and after sizes should be provided.  If messages can be recovered they can then be put somewhere besides her email box.  DO NOT RESTORE HER EMAIL BOX.  If they cannot be restored to a different location without alerting her or messing her mailbox up or causing issues do not do anything to restore them.

2 - Do a before and after on her network drive size.  Same as the mailbox - check to see if a bunch of data has been removed, transferred and/ or deleted.  Provide the sizes before and after.  If you find network files deleted - restore them to somewhere else that she cannot see - only we can.  Use the Barracuda for this if needed or would work best.  Do not do anything that would alert her.

Please let me know who is going to handle this and what you find.  If you can do the size checks quickly just do that and let me know.  The recovery can wait - the changes in size request is more immediate.
0
Comment
Question by:mirifexmso
  • 2
  • 2
  • 2
7 Comments
 
LVL 22

Expert Comment

by:Nick Rhode
ID: 39797047
You could connect to her mailbox by giving yourself full access to it.  The mailbox then should populate in your outlook in which you can backup to PST.

To check the mailbox size you can run this powershell:

Get-MailboxStatistics [username] | ft DisplayName, TotalItemSize

There are a lot more things you can do with powershell and to view mailbox statistics and you can tailor them to what you need in specific.

Found here:  http://help.outlook.com/en-us/140/Gg576861.aspx
0
 
LVL 13

Expert Comment

by:Andy M
ID: 39797165
What version of Exchange are you using? Knowing which version will allow experts to give you the options avialble to you.

I believe newer versions also backup anything in the dumpster to a PST when exporting the mailbox.

If you are using a newer version of Exchange you could export the entire mailbox to a PST (done either via Outlook or via the server) which you can then open in Outlook without any issues from the user in question knowing about it.

You could also increase the dumpster/deleted items retention for the user to esnure they cannot permanently remove anything from their account any time soon.

As for network drive - I assume these are backed up and most decent backup software should allow you to recover files/folders to a different location.
0
 

Author Comment

by:mirifexmso
ID: 39797181
This is Exchange 2010.
0
NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

 

Author Comment

by:mirifexmso
ID: 39797568
Nick Rhode,

Can you display statistics from what the users mailbox was couple weeks ago ? we want to see if this user has been deleted emails over the course of the whole month.
0
 
LVL 22

Assisted Solution

by:Nick Rhode
Nick Rhode earned 250 total points
ID: 39797766
I don't think you can go back to show previous size etc and would have to rely on a backup.  However, exchange does have a retention policy of like 30 days when the recycle bin is empty.  Unless the user is emptying the recycle bin and opening up the Recover Deleted Items bin and purging them from there they are gone.  So if you were to login as the user and check the recover deleted items bin you would see the emails from the user emptying the recycle bin.
0
 
LVL 13

Accepted Solution

by:
Andy M earned 250 total points
ID: 39802852
I believe by default the deleted items retention is 14 days (think it's deleted mailboxes that are set to 30 days by default) but this can obviously be changed by whoever setup/looks after the exchange server.

As mentioned previously if you run a PST export of the mailbox from the server I'm sure this also exports all the deleted items/dumpster as well in Exchange 2010 (creates a separate folder in the PST with this in) so you'd have a copy of all the users emails from this moment to fall back/use as evidence.  As it's Exchange 2010 you can do this on the server without the user even knowing about it then just open the PST on any copy of Outlook as normal.

If the user has emptied the dumpster (and in my experience very few standard users know how to do this) then you'd have to go back to the actual backups from the Exchange server to look at them.

The following link explains how to export mailboxes to PST on Exchange 2010:

http://exchangeserverpro.com/export-mailboxes-exchange-server-2010-sp1/
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Follow this checklist to learn more about the 15 things you should never include in an email signature from personal quotes, animated gifs and out-of-date marketing content.
Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…
This video discusses moving either the default database or any database to a new volume.

943 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now