When you delete an item from an Exchange Server database, multiple database pages are deleted. But the deleted pages are not actually removed from the Exchange database; they are simply flagged as being available.
Since messages in deleted pages remain intact until they are eventually overwritten by new data, some people believe this constitutes a security risk. If the Exchange database fell into the wrong hands, deleted messages could potentially be extracted from it. As such, many security experts recommend configuring Exchange Server so that deleted database pages are overwritten by a string of zeros rather than just being flagged as available.
Zeroing out deleted database pages might be good for security, but it is terrible for performance -- it can almost double the number of I/O cycles consumed by the Exchange database. I personally don't think deleted Exchange database pages pose enough of a security threat to warrant the performance impact incurred.
Yes, someone could potentially get their hands on deleted messages if the database were compromised. If someone compromises your Exchange Server information store though, you've got much bigger problems than the contents of a few deleted messages.
To control the zeroing out of deleted Exchange database pages:
Open Exchange System Manager and navigate to Administrative Groups -> your administrative group -> Servers -> your server -> the storage group for which you want to set the option.
Right click on the Exchange storage group and select Properties.
Use the checkbox to enable or disable the zeroing of deleted database pages.
Figure A: Modify deleted database pages via storage group properties.
Brien M. Posey, MCSE Brien M. Posey, MCSE, is a Microsoft Most Valuable Professional for his work with Exchange Server, and has previously received Microsoft's MVP award for Windows Server and Internet Information Server (IIS). Brien has served as CIO for a nationwide chain of hospitals and was once responsible for the Department of Information Management at Fort Knox. As a freelance technical writer, Brien has written for Microsoft, TechTarget, CNET, ZDNet, MSD2D, Relevant Technologies and other technology companies. You can visit Brien's personal Web site at http://www.brienposey.com.
TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.