Hi All, One of our customers has just found out why we recommended and quoted them an e-mail archival system.
One of their employees has left and has since started proceedings for constructive dismissal. HIs lawyer requested copies of every e-mail that mentions his name, and the client passed the request to the users who would have been cited as being involved 1st. They retrieved all the e-mails they could and they were passed to his lawyer. Of course you can all guess what happened next, he claims that he knows for a fact there were other e-mails sent by these people that mentioned him, that haven't bee passed on and therefore these people have deliberately deleted them so as to avoid incriminating themselves. So now we get called in to see what we can do for them. They have a single mailbox server Exchange 2007 setup, and it is backed up fully to tape every night, they keep there weekly tapes for a year and there monthly tapes indefinitely. My thinking is to do this in a way that would be seen as safe, would be to setup a lab with a DC and and exchange server restored form the original site backups, and then go back to the 1st tape available after the start date that the e-mail is requested from, (it is looking like 8 months) then restoring the AD, and then the Exchange databases. I am not sure if we can then force the undeletion of all deleted items, and then search the store for all mails with his name in the subject, to, from, cc, bcc and message body fields. Moving that into an archive PST file, and then lather rinse repeat for each and every tape. Putting the files onto a USB HDD and giving it to the lawyer. Is this a workable solution, or does anyone have any better ideas. Of course once completed the e-mail archiver quote is getting reissued immediately. TIA Graeme -- Good news everyone, you have just received and e-mail from me! Ted Turner <http://www.brainyquote.com/quotes/authors/t/ted_turner.html> - "Sports is like a war without the killing."
