Reconstructing all of a user's mailbox data

We do, however, have all the log files from the time the Exchange server was installed. Is there a way to reconstruct these users' Inboxes and Sent Items entries (even for things that were subsequently deleted) from the log files only?

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Microsoft Exchange Server Backup and Disaster Recovery Fixing DPM 2007 inconsistent replica errors in Exchange Server New high availability features in Exchange Server 2010 Restore contacts from an Exchange public folder Exchange Server 2007 SP2 reinstates built-in backup capabilities Working with continuous replication in Exchange Server 2007 How a bare-metal restore affects Microsoft Outlook 2007 performance Testing a passive database for corruption in Exchange Server 2007 Implement CCR to improve Exchange Server 2007 mailbox reliability Use the RecoverServer switch to rebuild a failed Exchange 2007 server Recovering deleted items after an Exchange 2003 migration Microsoft Exchange Server Backup and Disaster Recovery Research Microsoft Exchange Server Mailbox Management Troubleshoot 'System Attendant' error messages in OWA Relocating Outlook email messages on a hosted Exchange 2007 server Performing advanced search queries in Microsoft Outlook 2007 Exchange Server 2010 public beta rolls out new features Microsoft Exchange Server email archiving tutorial Using the Export-Mailbox command in Exchange Server 2007 How Windows Desktop Search works in Microsoft Outlook 2007 ExMerge gotchas to watch for when migrating Exchange 2003 mailboxes Migrating mailboxes across domains with the Exchange Management Console When to use Move Mailbox Wizard or ExMerge to move Exchange mailboxes David Sengupta: Server Administration Changing email address formats in Exchange Server 2003 Should you remove .STM files from Exchange Server 2003? Exchange users receiving email addressed to legacy users Pushing a public calendar out from a private Exchange account Import and export .PST files in Exchange Server 2007 Editing Exchange Server public folder permissions Search and index Microsoft Outlook 2007 public folders Troubleshooting Microsoft Exchange Server Event ID error 6009 Can't delete old Microsoft Outlook public folders Can't create mailboxes after virtualizing Microsoft Exchange Server

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary messaging server  (SearchExchange.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

This is a great question. There is a field called "e-discovery" (electronic discovery) that applies to the kind of investigation you are performing. I have been doing a lot of thinking and writing in this area of late, as pretty well any investigation these days is touching on email.

I'm not positive I understand which log files you are referring to (I am assuming you mean transaction log files), but that said, there is no feasible way to re-construct a comprehensive view of all messages for these two employees. The only way you would have this information is if you had a compliance archive in place for the duration of these employees' tenures with your company; and if you had explicitly configured the compliance archive to bifurcate all messages sent/received by these mailboxes.

That said, I'll explain what I believe are the best steps, given the data you're working with. Essentially, you need to make sure you are addressing all email content from each of the following four "silos" of Exchange storage:

1. Online data: Whatever is in their mailboxes and dumpsters today.

2. Backup data: Whatever mailbox instances you have, for every generation of backup tape you possess that relate to the servers hosting these mailboxes.

3. To manage these first two "silos," you may need to locate and recover mailbox instances for these two employees from all your daily, weekly, monthly and yearly tapes, spanning whatever number of months or years these employees worked for your company.

   This can be extremely costly and time-consuming, so you may want to look at third-party solutions on the market to assist in search-and-recovery, rather than building recovery servers corresponding to all these backups. Two solutions exist that I'm aware of, Quest Recovery Manager for Exchange (disclosure: I work for Quest Software) and Ontrack PowerControls.

   Numerous outsourcing companies also provide recovery services that you may wish to consider, depending on the priority of this content and the budget you have available.

   Silos two and three focus on stray data.

4. PSTs: If you have access to any PSTs on the workstations these employees used, or on their network shares, search these as well.

5. Offline data: Finally, if you're trying to be really thorough (which is my assumption), search computers and network shares associated with these accounts for .MSG files. You should also inspect any mobile devices (such as iPAQs, BlackBerrys, smartphones, etc.) that were used by these users to see if any additional messages exist that have gone under the radar.

Do you have comments on this Ask the Expert Q&A? Let us know.