I'd recommend calling a forensic service (I almost always use Iron Mountain). Given enough of your config information, they can restore tapes much faster than you can, and feed them into a discovery engine, exporting only the emails you need to PST.
They can also sign off on chain of custody, secure transport, etc if required.... --James On 10/23/09, Michael B. Smith <mich...@owa.smithcons.com> wrote: > yes, you can do that. > > i am, in fact, doing that for a number of my own customers right now. > > you work out a rhythm after a while... > > ________________________________ > From: Graeme Carstairs [loonyto...@gmail.com] > Sent: Friday, October 23, 2009 11:17 AM > To: MS-Exchange Admin Issues > Subject: Retrivein old e-mails mentioning a specific user Exchange 2007 > > Hi All, > > One of our customers has just found out why we recommended and quoted them > an e-mail archival system. > > One of their employees has left and has since started proceedings for > constructive dismissal. > > HIs lawyer requested copies of every e-mail that mentions his name, and the > client passed the request to the users who would have been cited as being > involved 1st. > > They retrieved all the e-mails they could and they were passed to his > lawyer. > > > Of course you can all guess what happened next, he claims that he knows for > a fact there were other e-mails sent by these people that mentioned him, > that haven't bee passed on and therefore these people have deliberately > deleted them so as to avoid incriminating themselves. > > So now we get called in to see what we can do for them. > > They have a single mailbox server Exchange 2007 setup, and it is backed up > fully to tape every night, they keep there weekly tapes for a year and there > monthly tapes indefinitely. > > My thinking is to do this in a way that would be seen as safe, would be to > setup a lab with a DC and and exchange server restored form the original > site backups, and then go back to the 1st tape available after the start > date that the e-mail is requested from, (it is looking like 8 months) then > restoring the AD, and then the Exchange databases. > > I am not sure if we can then force the undeletion of all deleted items, and > then search the store for all mails with his name in the subject, to, from, > cc, bcc and message body fields. > > Moving that into an archive PST file, and then lather rinse repeat for each > and every tape. > > Putting the files onto a USB HDD and giving it to the lawyer. > > Is this a workable solution, or does anyone have any better ideas. > > Of course once completed the e-mail archiver quote is getting reissued > immediately. > > TIA > > Graeme > > > -- > Good news everyone, you have just received and e-mail from me! > > Ted Turner<http://www.brainyquote.com/quotes/authors/t/ted_turner.html> - > "Sports is like a war without the killing." > -- Sent from my mobile device
