RE: Recovering messages from Exchange server 2007 (UNCLASSIFIED)

2010-07-26 Thread Peter Johnson
Do you have the request in e-mail? Keep it just in case :)

Regards
[cid:image001.jpg@01CB2CD8.BA944B70]

Peter Johnson
I.T Architect
United Kingdom: +44 1285 658542
South Africa: +27 11 252 1100
Swaziland: +268 442 7000
Fax:+27 11 974 7130
Mobile: +2783 306 0019
peter.john...@peterstow.com


This email message (including attachments) contains information which may be 
confidential and/or legally privileged. Unless you are the intended recipient, 
you may not use, copy or disclose to anyone the message or any information 
contained in the message or from any attachments that were sent with this 
email, and If you have received this email message in error, please advise the 
sender by email, and delete the message. Unauthorised disclosure and/or use of 
information contained in this email may result in civil and criminal liability. 
Everything in this e-mail and attachments relating to the official business of 
Peterstow Aquapower is proprietary to the company.

Caution should be observed in placing any reliance upon any information 
contained in this e-mail, which is not intended to be a representation or 
inducement to make any decision in relation to Peterstow Aquapower. Any 
decision taken based on the information provided in this e-mail, should only be 
made after consultation with appropriate legal, regulatory, tax, technical, 
business, investment, financial, and accounting advisors. Neither the sender of 
the e-mail, nor Peterstow Aquapower shall be liable to any party for any 
direct, indirect or consequential damages, including, without limitation, loss 
of profit, interruption of business or loss of information, data or software or 
otherwise.

The e-mail address of the sender may not be used, copied, sold, disclosed or 
incorporated into any database or mailing list for spamming and/or other 
marketing purposes without the prior consent of Peterstow Aquapower.
No warranties are created or implied that an employee of Peterstow Aquapower 
and/or a contractor of Peterstow Aquapower is authorized to create and send 
this e-mail.
 [cid:image002.jpg@01CB2CD8.BA944B70]
From: James Rankin [mailto:kz2...@googlemail.com]
Sent: 23 July 2010 15:45
To: MS-Exchange Admin Issues
Subject: Re: Recovering messages from Exchange server 2007 (UNCLASSIFIED)

It was requested by a director and the Chief exec, so I'm presuming my backside 
is proverbially covered.
On 23 July 2010 14:38, Kent, Larry CTR US USA 
larry.k...@us.army.milmailto:larry.k...@us.army.mil wrote:
Classification: UNCLASSIFIED
Caveats: NONE
I would make sure that you have management's approval or your company lawyer's 
approval. You can't legally view all of someone's email without reasonable 
cause, even if it is on company owned equipment.  Even then your search/viewing 
must be limited to whatever search criteria you are looking for.

From: Richard Stovall [mailto:rich...@gmail.commailto:rich...@gmail.com]
Sent: Friday, July 23, 2010 9:21 AM
To: MS-Exchange Admin Issues
Subject: Re: Recovering messages from Exchange server 2007

Do you have any sort of edge device or a similar service?  I often recover 
messages for users from our Barracuda.  (We also relay outbound messages 
through it to take advantage of the invalid bounce suppression feature.)

On Fri, Jul 23, 2010 at 9:14 AM, John Bowles 
john.bow...@wlkmmas.orgmailto:john.bow...@wlkmmas.org wrote:
You can track messages, but you cannot view the contents of the message.  
That's if you have message tracking already enabled prior to these messages 
having  been sent/received.


John Bowles


From: James Rankin [kz2...@googlemail.com]
Sent: Friday, July 23, 2010 8:36 AM
To: MS-Exchange Admin Issues
Subject: Re: Recovering messages from Exchange server 2007
Is anything usable in the message tracking tool?
On 23 July 2010 13:25, John Bowles 
john.bow...@wlkmmas.orgmailto:john.bow...@wlkmmas.org wrote:
Can only do that if you have journaling installed or if you have a viable email 
archiving solution.


John Bowles


From: James Rankin [kz2...@googlemail.com]
Sent: Friday, July 23, 2010 7:59 AM
To: MS-Exchange Admin Issues
Subject: Recovering messages from Exchange server 2007
Greetings Exchange gurus

What's the easiest way to view all messages that were sent by a particular user 
on a particular day in the past week? I need this for some cloak-and-dagger 
investigative purposes - I suppose I could just grant myself permissions to the 
user's mailbox and forward myself all their Sent Items, but a) would they be 
able to tell I'd done this? and b) I'm assuming this wouldn't cover any stuff 
they may have permanently deleted?

I presume there must be other ways to achieve this - I apologise for my lack of 
Exchange knowledge, I am not an Exchange bod by any stretch of the imagination.

TIA,



JRR

--
On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into the 
machine wrong figures, will the right answers come out

RE: Recovering messages from Exchange server 2007

2010-07-23 Thread John Bowles
Can only do that if you have journaling installed or if you have a viable email 
archiving solution.


John Bowles


From: James Rankin [kz2...@googlemail.com]
Sent: Friday, July 23, 2010 7:59 AM
To: MS-Exchange Admin Issues
Subject: Recovering messages from Exchange server 2007

Greetings Exchange gurus

What's the easiest way to view all messages that were sent by a particular user 
on a particular day in the past week? I need this for some cloak-and-dagger 
investigative purposes - I suppose I could just grant myself permissions to the 
user's mailbox and forward myself all their Sent Items, but a) would they be 
able to tell I'd done this? and b) I'm assuming this wouldn't cover any stuff 
they may have permanently deleted?

I presume there must be other ways to achieve this - I apologise for my lack of 
Exchange knowledge, I am not an Exchange bod by any stretch of the imagination.

TIA,



JRR

--
On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into the 
machine wrong figures, will the right answers come out?' I am not able rightly 
to apprehend the kind of confusion of ideas that could provoke such a question.



Re: Recovering messages from Exchange server 2007

2010-07-23 Thread James Rankin
Is anything usable in the message tracking tool?

On 23 July 2010 13:25, John Bowles john.bow...@wlkmmas.org wrote:

  Can only do that if you have journaling installed or if you have a viable
 email archiving solution.


 John Bowles

--
 *From:* James Rankin [kz2...@googlemail.com]
 *Sent:* Friday, July 23, 2010 7:59 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Recovering messages from Exchange server 2007

  Greetings Exchange gurus

 What's the easiest way to view all messages that were sent by a particular
 user on a particular day in the past week? I need this for some
 cloak-and-dagger investigative purposes - I suppose I could just grant
 myself permissions to the user's mailbox and forward myself all their Sent
 Items, but a) would they be able to tell I'd done this? and b) I'm assuming
 this wouldn't cover any stuff they may have permanently deleted?

 I presume there must be other ways to achieve this - I apologise for my
 lack of Exchange knowledge, I am not an Exchange bod by any stretch of the
 imagination.

 TIA,



 JRR

 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.




-- 
On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
the machine wrong figures, will the right answers come out?' I am not able
rightly to apprehend the kind of confusion of ideas that could provoke such
a question.


RE: Recovering messages from Exchange server 2007

2010-07-23 Thread John Bowles
You can track messages, but you cannot view the contents of the message.  
That's if you have message tracking already enabled prior to these messages 
having  been sent/received.


John Bowles


From: James Rankin [kz2...@googlemail.com]
Sent: Friday, July 23, 2010 8:36 AM
To: MS-Exchange Admin Issues
Subject: Re: Recovering messages from Exchange server 2007

Is anything usable in the message tracking tool?

On 23 July 2010 13:25, John Bowles 
john.bow...@wlkmmas.orgmailto:john.bow...@wlkmmas.org wrote:
Can only do that if you have journaling installed or if you have a viable email 
archiving solution.


John Bowles


From: James Rankin [kz2...@googlemail.commailto:kz2...@googlemail.com]
Sent: Friday, July 23, 2010 7:59 AM
To: MS-Exchange Admin Issues
Subject: Recovering messages from Exchange server 2007

Greetings Exchange gurus

What's the easiest way to view all messages that were sent by a particular user 
on a particular day in the past week? I need this for some cloak-and-dagger 
investigative purposes - I suppose I could just grant myself permissions to the 
user's mailbox and forward myself all their Sent Items, but a) would they be 
able to tell I'd done this? and b) I'm assuming this wouldn't cover any stuff 
they may have permanently deleted?

I presume there must be other ways to achieve this - I apologise for my lack of 
Exchange knowledge, I am not an Exchange bod by any stretch of the imagination.

TIA,



JRR

--
On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into the 
machine wrong figures, will the right answers come out?' I am not able rightly 
to apprehend the kind of confusion of ideas that could provoke such a question.




--
On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into the 
machine wrong figures, will the right answers come out?' I am not able rightly 
to apprehend the kind of confusion of ideas that could provoke such a question.



Re: Recovering messages from Exchange server 2007

2010-07-23 Thread Richard Stovall
Do you have any sort of edge device or a similar service?  I often recover
messages for users from our Barracuda.  (We also relay outbound messages
through it to take advantage of the invalid bounce suppression feature.)

On Fri, Jul 23, 2010 at 9:14 AM, John Bowles john.bow...@wlkmmas.orgwrote:

  You can track messages, but you cannot view the contents of the message.
 That's if you have message tracking already enabled prior to these
 messages having  been sent/received.


 John Bowles

--
 *From:* James Rankin [kz2...@googlemail.com]
 *Sent:* Friday, July 23, 2010 8:36 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Re: Recovering messages from Exchange server 2007

  Is anything usable in the message tracking tool?

 On 23 July 2010 13:25, John Bowles john.bow...@wlkmmas.org wrote:

  Can only do that if you have journaling installed or if you have a
 viable email archiving solution.


 John Bowles

--
 *From:* James Rankin [kz2...@googlemail.com]
 *Sent:* Friday, July 23, 2010 7:59 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Recovering messages from Exchange server 2007

Greetings Exchange gurus

 What's the easiest way to view all messages that were sent by a particular
 user on a particular day in the past week? I need this for some
 cloak-and-dagger investigative purposes - I suppose I could just grant
 myself permissions to the user's mailbox and forward myself all their Sent
 Items, but a) would they be able to tell I'd done this? and b) I'm assuming
 this wouldn't cover any stuff they may have permanently deleted?

 I presume there must be other ways to achieve this - I apologise for my
 lack of Exchange knowledge, I am not an Exchange bod by any stretch of the
 imagination.

 TIA,



 JRR

 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.




 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.




Re: Recovering messages from Exchange server 2007

2010-07-23 Thread James Rankin
Actually, we have an IronPort. I forgot all about it. There is a message
tracking function on there that may be of use, cheers!

On 23 July 2010 14:20, Richard Stovall rich...@gmail.com wrote:

 Do you have any sort of edge device or a similar service?  I often recover
 messages for users from our Barracuda.  (We also relay outbound messages
 through it to take advantage of the invalid bounce suppression feature.)

 On Fri, Jul 23, 2010 at 9:14 AM, John Bowles john.bow...@wlkmmas.orgwrote:

  You can track messages, but you cannot view the contents of the
 message.  That's if you have message tracking already enabled prior to these
 messages having  been sent/received.


 John Bowles

--
 *From:* James Rankin [kz2...@googlemail.com]
 *Sent:* Friday, July 23, 2010 8:36 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Re: Recovering messages from Exchange server 2007

  Is anything usable in the message tracking tool?

 On 23 July 2010 13:25, John Bowles john.bow...@wlkmmas.org wrote:

  Can only do that if you have journaling installed or if you have a
 viable email archiving solution.


 John Bowles

--
 *From:* James Rankin [kz2...@googlemail.com]
 *Sent:* Friday, July 23, 2010 7:59 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Recovering messages from Exchange server 2007

Greetings Exchange gurus

 What's the easiest way to view all messages that were sent by a
 particular user on a particular day in the past week? I need this for some
 cloak-and-dagger investigative purposes - I suppose I could just grant
 myself permissions to the user's mailbox and forward myself all their Sent
 Items, but a) would they be able to tell I'd done this? and b) I'm assuming
 this wouldn't cover any stuff they may have permanently deleted?

 I presume there must be other ways to achieve this - I apologise for my
 lack of Exchange knowledge, I am not an Exchange bod by any stretch of the
 imagination.

 TIA,



 JRR

 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.




 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.





-- 
On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
the machine wrong figures, will the right answers come out?' I am not able
rightly to apprehend the kind of confusion of ideas that could provoke such
a question.


Re: Recovering messages from Exchange server 2007

2010-07-23 Thread Rob Sargent
Assuming you still have the Tracking Logs for the period in question, then
download and install the 30-day trial of Quest MessageStats (
www.quest.com/messagestats).  In the admin console you can identify certain
mailboxes on which you want detailed information (auditing tab), and then
set up a gathering task for the tracking logs on the servers.  Wait for data
to be imported, then from the reports console run the Mailbox Sent Audits
report.

Rob
On Fri, Jul 23, 2010 at 7:59 AM, James Rankin kz2...@googlemail.com wrote:

 Greetings Exchange gurus

 What's the easiest way to view all messages that were sent by a particular
 user on a particular day in the past week? I need this for some
 cloak-and-dagger investigative purposes - I suppose I could just grant
 myself permissions to the user's mailbox and forward myself all their Sent
 Items, but a) would they be able to tell I'd done this? and b) I'm assuming
 this wouldn't cover any stuff they may have permanently deleted?

 I presume there must be other ways to achieve this - I apologise for my
 lack of Exchange knowledge, I am not an Exchange bod by any stretch of the
 imagination.

 TIA,



 JRR

 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.




RE: Recovering messages from Exchange server 2007 (UNCLASSIFIED)

2010-07-23 Thread Kent, Larry CTR US USA
Classification: UNCLASSIFIED
Caveats: NONE

I would make sure that you have management's approval or your company
lawyer's approval. You can't legally view all of someone's email without
reasonable cause, even if it is on company owned equipment.  Even then
your search/viewing must be limited to whatever search criteria you are
looking for.

 

From: Richard Stovall [mailto:rich...@gmail.com] 
Sent: Friday, July 23, 2010 9:21 AM
To: MS-Exchange Admin Issues
Subject: Re: Recovering messages from Exchange server 2007

 

Do you have any sort of edge device or a similar service?  I often
recover messages for users from our Barracuda.  (We also relay outbound
messages through it to take advantage of the invalid bounce suppression
feature.)

 

On Fri, Jul 23, 2010 at 9:14 AM, John Bowles john.bow...@wlkmmas.org
wrote:

You can track messages, but you cannot view the contents of the message.
That's if you have message tracking already enabled prior to these
messages having  been sent/received.

 

 

John Bowles 

 



From: James Rankin [kz2...@googlemail.com]
Sent: Friday, July 23, 2010 8:36 AM
To: MS-Exchange Admin Issues
Subject: Re: Recovering messages from Exchange server 2007

Is anything usable in the message tracking tool?

On 23 July 2010 13:25, John Bowles john.bow...@wlkmmas.org wrote:

Can only do that if you have journaling installed or if you have a
viable email archiving solution.

 

 

John Bowles 

 



From: James Rankin [kz2...@googlemail.com]
Sent: Friday, July 23, 2010 7:59 AM
To: MS-Exchange Admin Issues
Subject: Recovering messages from Exchange server 2007

Greetings Exchange gurus

What's the easiest way to view all messages that were sent by a
particular user on a particular day in the past week? I need this for
some cloak-and-dagger investigative purposes - I suppose I could just
grant myself permissions to the user's mailbox and forward myself all
their Sent Items, but a) would they be able to tell I'd done this? and
b) I'm assuming this wouldn't cover any stuff they may have permanently
deleted?

I presume there must be other ways to achieve this - I apologise for my
lack of Exchange knowledge, I am not an Exchange bod by any stretch of
the imagination.

TIA,



JRR

-- 
On two occasions...I have been asked, 'Pray, Mr Babbage, if you put
into the machine wrong figures, will the right answers come out?' I am
not able rightly to apprehend the kind of confusion of ideas that could
provoke such a question.




-- 
On two occasions...I have been asked, 'Pray, Mr Babbage, if you put
into the machine wrong figures, will the right answers come out?' I am
not able rightly to apprehend the kind of confusion of ideas that could
provoke such a question.

 

Classification: UNCLASSIFIED
Caveats: NONE



Re: Recovering messages from Exchange server 2007

2010-07-23 Thread James Rankin
Thanks, will give this a try if nothing solid is forthcoming from the
IronPort

On 23 July 2010 14:35, Rob Sargent rbsr...@gmail.com wrote:

 Assuming you still have the Tracking Logs for the period in question, then
 download and install the 30-day trial of Quest MessageStats (
 www.quest.com/messagestats).  In the admin console you can identify
 certain mailboxes on which you want detailed information (auditing tab), and
 then set up a gathering task for the tracking logs on the servers.  Wait for
 data to be imported, then from the reports console run the Mailbox Sent
 Audits report.

 Rob
 On Fri, Jul 23, 2010 at 7:59 AM, James Rankin kz2...@googlemail.comwrote:

 Greetings Exchange gurus

 What's the easiest way to view all messages that were sent by a particular
 user on a particular day in the past week? I need this for some
 cloak-and-dagger investigative purposes - I suppose I could just grant
 myself permissions to the user's mailbox and forward myself all their Sent
 Items, but a) would they be able to tell I'd done this? and b) I'm assuming
 this wouldn't cover any stuff they may have permanently deleted?

 I presume there must be other ways to achieve this - I apologise for my
 lack of Exchange knowledge, I am not an Exchange bod by any stretch of the
 imagination.

 TIA,



 JRR

 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.





-- 
On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
the machine wrong figures, will the right answers come out?' I am not able
rightly to apprehend the kind of confusion of ideas that could provoke such
a question.


Re: Recovering messages from Exchange server 2007 (UNCLASSIFIED)

2010-07-23 Thread James Rankin
It was requested by a director and the Chief exec, so I'm presuming my
backside is proverbially covered.

On 23 July 2010 14:38, Kent, Larry CTR US USA larry.k...@us.army.milwrote:

  Classification: UNCLASSIFIED
 Caveats: NONE

 I would make sure that you have management’s approval or your company
 lawyer’s approval. You can’t legally view all of someone’s email without
 reasonable cause, even if it is on company owned equipment.  Even then your
 search/viewing must be limited to whatever search criteria you are looking
 for.



 *From:* Richard Stovall [mailto:rich...@gmail.com]
 *Sent:* Friday, July 23, 2010 9:21 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Re: Recovering messages from Exchange server 2007



 Do you have any sort of edge device or a similar service?  I often recover
 messages for users from our Barracuda.  (We also relay outbound messages
 through it to take advantage of the invalid bounce suppression feature.)



 On Fri, Jul 23, 2010 at 9:14 AM, John Bowles john.bow...@wlkmmas.org
 wrote:

 You can track messages, but you cannot view the contents of the message.
 That's if you have message tracking already enabled prior to these
 messages having  been sent/received.





 John Bowles


--

 *From:* James Rankin [kz2...@googlemail.com]
 *Sent:* Friday, July 23, 2010 8:36 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Re: Recovering messages from Exchange server 2007

 Is anything usable in the message tracking tool?

 On 23 July 2010 13:25, John Bowles john.bow...@wlkmmas.org wrote:

 Can only do that if you have journaling installed or if you have a viable
 email archiving solution.





 John Bowles


--

 *From:* James Rankin [kz2...@googlemail.com]
 *Sent:* Friday, July 23, 2010 7:59 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Recovering messages from Exchange server 2007

 Greetings Exchange gurus

 What's the easiest way to view all messages that were sent by a particular
 user on a particular day in the past week? I need this for some
 cloak-and-dagger investigative purposes - I suppose I could just grant
 myself permissions to the user's mailbox and forward myself all their Sent
 Items, but a) would they be able to tell I'd done this? and b) I'm assuming
 this wouldn't cover any stuff they may have permanently deleted?

 I presume there must be other ways to achieve this - I apologise for my
 lack of Exchange knowledge, I am not an Exchange bod by any stretch of the
 imagination.

 TIA,



 JRR

 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.




 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.



 Classification: UNCLASSIFIED
 Caveats: NONE




-- 
On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
the machine wrong figures, will the right answers come out?' I am not able
rightly to apprehend the kind of confusion of ideas that could provoke such
a question.


Re: Recovering messages from Exchange server 2007 (UNCLASSIFIED)

2010-07-23 Thread Richard Stovall
I absotively agree.  My presumption was that the necessary safeguards are in
place.

On Fri, Jul 23, 2010 at 9:38 AM, Kent, Larry CTR US USA 
larry.k...@us.army.mil wrote:

  Classification: UNCLASSIFIED
 Caveats: NONE

 I would make sure that you have management’s approval or your company
 lawyer’s approval. You can’t legally view all of someone’s email without
 reasonable cause, even if it is on company owned equipment.  Even then your
 search/viewing must be limited to whatever search criteria you are looking
 for.



 *From:* Richard Stovall [mailto:rich...@gmail.com]
 *Sent:* Friday, July 23, 2010 9:21 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Re: Recovering messages from Exchange server 2007



 Do you have any sort of edge device or a similar service?  I often recover
 messages for users from our Barracuda.  (We also relay outbound messages
 through it to take advantage of the invalid bounce suppression feature.)



 On Fri, Jul 23, 2010 at 9:14 AM, John Bowles john.bow...@wlkmmas.org
 wrote:

 You can track messages, but you cannot view the contents of the message.
 That's if you have message tracking already enabled prior to these
 messages having  been sent/received.





 John Bowles


--

 *From:* James Rankin [kz2...@googlemail.com]
 *Sent:* Friday, July 23, 2010 8:36 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Re: Recovering messages from Exchange server 2007

 Is anything usable in the message tracking tool?

 On 23 July 2010 13:25, John Bowles john.bow...@wlkmmas.org wrote:

 Can only do that if you have journaling installed or if you have a viable
 email archiving solution.





 John Bowles


--

 *From:* James Rankin [kz2...@googlemail.com]
 *Sent:* Friday, July 23, 2010 7:59 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Recovering messages from Exchange server 2007

 Greetings Exchange gurus

 What's the easiest way to view all messages that were sent by a particular
 user on a particular day in the past week? I need this for some
 cloak-and-dagger investigative purposes - I suppose I could just grant
 myself permissions to the user's mailbox and forward myself all their Sent
 Items, but a) would they be able to tell I'd done this? and b) I'm assuming
 this wouldn't cover any stuff they may have permanently deleted?

 I presume there must be other ways to achieve this - I apologise for my
 lack of Exchange knowledge, I am not an Exchange bod by any stretch of the
 imagination.

 TIA,



 JRR

 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.




 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.



 Classification: UNCLASSIFIED
 Caveats: NONE



Re: Recovering messages from Exchange server 2007 (UNCLASSIFIED)

2010-07-23 Thread Richard Stovall
Hopefully physically, as well.  :)

On Fri, Jul 23, 2010 at 9:44 AM, James Rankin kz2...@googlemail.com wrote:

 It was requested by a director and the Chief exec, so I'm presuming my
 backside is proverbially covered.


 On 23 July 2010 14:38, Kent, Larry CTR US USA larry.k...@us.army.milwrote:

  Classification: UNCLASSIFIED
 Caveats: NONE

 I would make sure that you have management’s approval or your company
 lawyer’s approval. You can’t legally view all of someone’s email without
 reasonable cause, even if it is on company owned equipment.  Even then your
 search/viewing must be limited to whatever search criteria you are looking
 for.



 *From:* Richard Stovall [mailto:rich...@gmail.com]
 *Sent:* Friday, July 23, 2010 9:21 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Re: Recovering messages from Exchange server 2007



 Do you have any sort of edge device or a similar service?  I often recover
 messages for users from our Barracuda.  (We also relay outbound messages
 through it to take advantage of the invalid bounce suppression feature.)



 On Fri, Jul 23, 2010 at 9:14 AM, John Bowles john.bow...@wlkmmas.org
 wrote:

 You can track messages, but you cannot view the contents of the message.
 That's if you have message tracking already enabled prior to these
 messages having  been sent/received.





 John Bowles


--

 *From:* James Rankin [kz2...@googlemail.com]
 *Sent:* Friday, July 23, 2010 8:36 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Re: Recovering messages from Exchange server 2007

 Is anything usable in the message tracking tool?

 On 23 July 2010 13:25, John Bowles john.bow...@wlkmmas.org wrote:

 Can only do that if you have journaling installed or if you have a viable
 email archiving solution.





 John Bowles


--

 *From:* James Rankin [kz2...@googlemail.com]
 *Sent:* Friday, July 23, 2010 7:59 AM
 *To:* MS-Exchange Admin Issues
 *Subject:* Recovering messages from Exchange server 2007

 Greetings Exchange gurus

 What's the easiest way to view all messages that were sent by a particular
 user on a particular day in the past week? I need this for some
 cloak-and-dagger investigative purposes - I suppose I could just grant
 myself permissions to the user's mailbox and forward myself all their Sent
 Items, but a) would they be able to tell I'd done this? and b) I'm assuming
 this wouldn't cover any stuff they may have permanently deleted?

 I presume there must be other ways to achieve this - I apologise for my
 lack of Exchange knowledge, I am not an Exchange bod by any stretch of the
 imagination.

 TIA,



 JRR

 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.




 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.



 Classification: UNCLASSIFIED
 Caveats: NONE




 --
 On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into
 the machine wrong figures, will the right answers come out?' I am not able
 rightly to apprehend the kind of confusion of ideas that could provoke such
 a question.




RE: Recovering messages from Exchange server 2007

2010-07-23 Thread Steve Hart
Message tracking will give you a list of the messages, but not the contents.

I often use this script to create html lists of emails for tracking purposes.

Get-MessageTrackingLog -Server email server -EventID RECEIVE -sender 
sender's email -Start start date -End end date | ConvertTo-Html 
Timestamp, EventID, ClientIP, Sender, {$_.Recipients}, MessageSubject, 
ServerIp, ServerHostname, {$_.RecipientStatus} | Set-Content full path to 
output filename


That will give you a list of all messages the user sent.  If you need to know 
what's in them, you'll need another tool.




Steve Hart
Network Administrator
503.491.4343 -Direct | 503.492.8160 - Fax

From: James Rankin [mailto:kz2...@googlemail.com]
Sent: Friday, July 23, 2010 5:37 AM
To: MS-Exchange Admin Issues
Subject: Re: Recovering messages from Exchange server 2007

Is anything usable in the message tracking tool?
On 23 July 2010 13:25, John Bowles 
john.bow...@wlkmmas.orgmailto:john.bow...@wlkmmas.org wrote:
Can only do that if you have journaling installed or if you have a viable email 
archiving solution.


John Bowles


From: James Rankin [kz2...@googlemail.commailto:kz2...@googlemail.com]
Sent: Friday, July 23, 2010 7:59 AM
To: MS-Exchange Admin Issues
Subject: Recovering messages from Exchange server 2007
Greetings Exchange gurus

What's the easiest way to view all messages that were sent by a particular user 
on a particular day in the past week? I need this for some cloak-and-dagger 
investigative purposes - I suppose I could just grant myself permissions to the 
user's mailbox and forward myself all their Sent Items, but a) would they be 
able to tell I'd done this? and b) I'm assuming this wouldn't cover any stuff 
they may have permanently deleted?

I presume there must be other ways to achieve this - I apologise for my lack of 
Exchange knowledge, I am not an Exchange bod by any stretch of the imagination.

TIA,



JRR

--
On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into the 
machine wrong figures, will the right answers come out?' I am not able rightly 
to apprehend the kind of confusion of ideas that could provoke such a question.



--
On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into the 
machine wrong figures, will the right answers come out?' I am not able rightly 
to apprehend the kind of confusion of ideas that could provoke such a question.