Is Journaling too late? You may need to use the deleted item retention to check all mailbox folders for any "hard" deletes also.
XCLN: How to Recover Items That Have Been Hard Deleted http://support.microsoft.com/default.aspx?scid=kb;en-us;246153 That way if something got "moved" from Sent or ANY folder in the mailbox to a PST you will be able to recover it. (They won't ever touch the Deleted folder) Nikki Peterson [Outlook MVP] -----Original Message----- From: Mellott, Bill [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 31, 2004 7:20 AM To: Exchange Discussions Subject: RE: capturing a users mail I my case here..to do this type thing I generally access the full mail box and then I go to deleted item and do a recover deleted item's cause well without that..well you might miss stuff then I do and exmerge and make up a PST for said user now this all assumes the typical user has no clue as to purge their deleted items in my case Im instructed to do this for given user everyday....yup it's a PITA 2 cents bill -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Hague, Jeff Sent: Wednesday, March 31, 2004 8:31 AM To: Exchange Discussions Subject: capturing a users mail I have been tasked with copying a users mailbox who is suspected of "illegal" activity. This is something that I have never had to do "incognito". I need to get the inbox and sent items (at least) without alerting the user that this has happened. I can give myself access to the mailbox and then either log in using Outlook/MAPI or Outlook Express/POP3 but I am concerned that either method will mark the mail that I copy as having been read, possibly alerting the user that something is up. Does anyone have any suggestions for doing this? Jeff PS - Policy states that this is allowed so I am not concerned from a liability standpoint - the "Powers that be" want this done covertly though in case their suspicions are wrong... _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
