deleted evidence exchange 2010

Is there anyway in exchange 2010 to get a report of what time

A.. what time emails were deleted by a user and subsequently moved to the deleted items folder

B.. emptied from a deleted items folder into the recover deleted items folder

C.. the date and time a user purged emails from the recover deleted items folder so they were no longer recoverable
LVL 3
pma111Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Kash2nd Line EngineerCommented:
I am not sure without Auditing it is quite possible though. You need to enable mailbox auditing >>> http://technet.microsoft.com/en-gb/library/ff459232%28v=exchg.141%29.aspx
0
David Paris VicenteSystems and Comunications  Administrator Commented:
Hi,

By default Mailbox Owners are not audit because this will generate a lot of data.

If you enable audit logging for a user you can access to the mailbox audit log by PowerShell or through ECP.

For auditing a mailbox you have to enable it through Powershell
Ex: Set-Mailbox <Username> -AuditEnabled $true
then
Set-Mailbox <Username> -AuditOwner update,move,MoveToDeletedItems,SoftDelete,HardDelete

For reference you can check here Set-Mailbox


Then you can access to the audit by the ways I mention above.

Hope this helps.
Regards
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
pma111Author Commented:
Is there a command to see if mailbox auditing is enabled
0
David Paris VicenteSystems and Comunications  Administrator Commented:
Yes.
get-mailbox <username> | fl *audit*

Open in new window

0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Office

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.