HI there, Thanks for the info.
I have informed the client, and we are awaiting word from their solictors to see what the next step is. Graeme 2009/10/23 James Wells <[email protected]> > I'd recommend calling a forensic service (I almost always use Iron > Mountain). Given enough of your config information, they can restore > tapes much faster than you can, and feed them into a discovery engine, > exporting only the emails you need to PST. > > They can also sign off on chain of custody, secure transport, etc if > required.... > > --James > > > On 10/23/09, Michael B. Smith <[email protected]> wrote: > > yes, you can do that. > > > > i am, in fact, doing that for a number of my own customers right now. > > > > you work out a rhythm after a while... > > > > ________________________________ > > From: Graeme Carstairs [[email protected]] > > Sent: Friday, October 23, 2009 11:17 AM > > To: MS-Exchange Admin Issues > > Subject: Retrivein old e-mails mentioning a specific user Exchange 2007 > > > > Hi All, > > > > One of our customers has just found out why we recommended and quoted > them > > an e-mail archival system. > > > > One of their employees has left and has since started proceedings for > > constructive dismissal. > > > > HIs lawyer requested copies of every e-mail that mentions his name, and > the > > client passed the request to the users who would have been cited as being > > involved 1st. > > > > They retrieved all the e-mails they could and they were passed to his > > lawyer. > > > > > > Of course you can all guess what happened next, he claims that he knows > for > > a fact there were other e-mails sent by these people that mentioned him, > > that haven't bee passed on and therefore these people have deliberately > > deleted them so as to avoid incriminating themselves. > > > > So now we get called in to see what we can do for them. > > > > They have a single mailbox server Exchange 2007 setup, and it is backed > up > > fully to tape every night, they keep there weekly tapes for a year and > there > > monthly tapes indefinitely. > > > > My thinking is to do this in a way that would be seen as safe, would be > to > > setup a lab with a DC and and exchange server restored form the original > > site backups, and then go back to the 1st tape available after the start > > date that the e-mail is requested from, (it is looking like 8 months) > then > > restoring the AD, and then the Exchange databases. > > > > I am not sure if we can then force the undeletion of all deleted items, > and > > then search the store for all mails with his name in the subject, to, > from, > > cc, bcc and message body fields. > > > > Moving that into an archive PST file, and then lather rinse repeat for > each > > and every tape. > > > > Putting the files onto a USB HDD and giving it to the lawyer. > > > > Is this a workable solution, or does anyone have any better ideas. > > > > Of course once completed the e-mail archiver quote is getting reissued > > immediately. > > > > TIA > > > > Graeme > > > > > > -- > > Good news everyone, you have just received and e-mail from me! > > > > Ted Turner<http://www.brainyquote.com/quotes/authors/t/ted_turner.html> > - > > "Sports is like a war without the killing." > > > > -- > Sent from my mobile device > > -- Good news everyone, you have just received and e-mail from me! Ogden Nash <http://www.brainyquote.com/quotes/authors/o/ogden_nash.html> - "The trouble with a kitten is that when it grows up, it's always a cat."
