Re: Retrivein old e-mails mentioning a specific user Exchange 2007

[Graeme Carstairs]

HI there,

Thanks for the info.

I have informed the client, and we are awaiting word from their solictors to
see what the next step is.

Graeme


2009/10/23 James Wells 

> I'd recommend calling a forensic service (I almost always use Iron
> Mountain). Given enough of your config information, they can restore
> tapes much faster than you can, and feed them into a discovery engine,
> exporting only the emails you need to PST.
>
> They can also sign off on chain of custody, secure transport, etc if
> required
>
> --James
>
>
> On 10/23/09, Michael B. Smith  wrote:
> > yes, you can do that.
> >
> > i am, in fact, doing that for a number of my own customers right now.
> >
> > you work out a rhythm after a while...
> >
> > 
> > From: Graeme Carstairs [loonyto...@gmail.com]
> > Sent: Friday, October 23, 2009 11:17 AM
> > To: MS-Exchange Admin Issues
> > Subject: Retrivein old e-mails mentioning a specific user Exchange 2007
> >
> > Hi All,
> >
> > One of our customers has just found out why we recommended and quoted
> them
> > an e-mail archival system.
> >
> > One of their employees has left and has since started proceedings for
> > constructive dismissal.
> >
> > HIs lawyer requested copies of every e-mail that mentions his name, and
> the
> > client passed the request to the users who would have been cited as being
> > involved 1st.
> >
> > They retrieved all the e-mails they could and they were passed to his
> > lawyer.
> >
> >
> > Of course you can all guess what happened next, he claims that he knows
> for
> > a fact there were other e-mails sent by these people that mentioned him,
> > that haven't bee passed on and therefore these people have deliberately
> > deleted them so as to avoid incriminating themselves.
> >
> > So now we get called in to see what we can do for them.
> >
> > They have a single mailbox server Exchange 2007 setup, and it is backed
> up
> > fully to tape every night, they keep there weekly tapes for a year and
> there
> > monthly tapes indefinitely.
> >
> > My thinking is to do this in a way that would be seen as safe, would be
> to
> > setup a lab with a DC and and exchange server restored form the original
> > site backups, and then go back to the 1st tape available after the start
> > date that the e-mail is requested from, (it is looking like 8 months)
> then
> > restoring the AD, and then the Exchange databases.
> >
> > I am not sure if we can then force the undeletion of all deleted items,
> and
> > then search the store for all mails with his name in the subject, to,
> from,
> > cc, bcc and message body fields.
> >
> > Moving that into an archive PST file, and then lather rinse repeat for
> each
> > and every tape.
> >
> > Putting the files onto a USB HDD and giving it to the lawyer.
> >
> > Is this a workable solution, or does anyone have any better ideas.
> >
> > Of course once completed the e-mail archiver quote is getting reissued
> > immediately.
> >
> > TIA
> >
> > Graeme
> >
> >
> > --
> > Good news everyone, you have just received and e-mail from me!
> >
> > Ted Turner<http://www.brainyquote.com/quotes/authors/t/ted_turner.html>
>  -
> > "Sports is like a war without the killing."
> >
>
> --
> Sent from my mobile device
>
>


-- 
Good news everyone, you have just received and e-mail from me!

Ogden Nash <http://www.brainyquote.com/quotes/authors/o/ogden_nash.html>  -
"The trouble with a kitten is that when it grows up, it's always a cat."

Re: Retrivein old e-mails mentioning a specific user Exchange 2007

[James Wells]

I'd recommend calling a forensic service (I almost always use Iron
Mountain). Given enough of your config information, they can restore
tapes much faster than you can, and feed them into a discovery engine,
exporting only the emails you need to PST.

They can also sign off on chain of custody, secure transport, etc if
required

--James


On 10/23/09, Michael B. Smith  wrote:
> yes, you can do that.
>
> i am, in fact, doing that for a number of my own customers right now.
>
> you work out a rhythm after a while...
>
> 
> From: Graeme Carstairs [loonyto...@gmail.com]
> Sent: Friday, October 23, 2009 11:17 AM
> To: MS-Exchange Admin Issues
> Subject: Retrivein old e-mails mentioning a specific user Exchange 2007
>
> Hi All,
>
> One of our customers has just found out why we recommended and quoted them
> an e-mail archival system.
>
> One of their employees has left and has since started proceedings for
> constructive dismissal.
>
> HIs lawyer requested copies of every e-mail that mentions his name, and the
> client passed the request to the users who would have been cited as being
> involved 1st.
>
> They retrieved all the e-mails they could and they were passed to his
> lawyer.
>
>
> Of course you can all guess what happened next, he claims that he knows for
> a fact there were other e-mails sent by these people that mentioned him,
> that haven't bee passed on and therefore these people have deliberately
> deleted them so as to avoid incriminating themselves.
>
> So now we get called in to see what we can do for them.
>
> They have a single mailbox server Exchange 2007 setup, and it is backed up
> fully to tape every night, they keep there weekly tapes for a year and there
> monthly tapes indefinitely.
>
> My thinking is to do this in a way that would be seen as safe, would be to
> setup a lab with a DC and and exchange server restored form the original
> site backups, and then go back to the 1st tape available after the start
> date that the e-mail is requested from, (it is looking like 8 months) then
> restoring the AD, and then the Exchange databases.
>
> I am not sure if we can then force the undeletion of all deleted items, and
> then search the store for all mails with his name in the subject, to, from,
> cc, bcc and message body fields.
>
> Moving that into an archive PST file, and then lather rinse repeat for each
> and every tape.
>
> Putting the files onto a USB HDD and giving it to the lawyer.
>
> Is this a workable solution, or does anyone have any better ideas.
>
> Of course once completed the e-mail archiver quote is getting reissued
> immediately.
>
> TIA
>
> Graeme
>
>
> --
> Good news everyone, you have just received and e-mail from me!
>
> Ted Turner<http://www.brainyquote.com/quotes/authors/t/ted_turner.html>  -
> "Sports is like a war without the killing."
>

-- 
Sent from my mobile device

RE: Retrivein old e-mails mentioning a specific user Exchange 2007

[Michael B. Smith]

yes, you can do that.

i am, in fact, doing that for a number of my own customers right now.

you work out a rhythm after a while...


From: Graeme Carstairs [loonyto...@gmail.com]
Sent: Friday, October 23, 2009 11:17 AM
To: MS-Exchange Admin Issues
Subject: Retrivein old e-mails mentioning a specific user Exchange 2007

Hi All,

One of our customers has just found out why we recommended and quoted them an 
e-mail archival system.

One of their employees has left and has since started proceedings for 
constructive dismissal.

HIs lawyer requested copies of every e-mail that mentions his name, and the 
client passed the request to the users who would have been cited as being 
involved 1st.

They retrieved all the e-mails they could and they were passed to his lawyer.


Of course you can all guess what happened next, he claims that he knows for a 
fact there were other e-mails sent by these people that mentioned him, that 
haven't bee passed on and therefore these people have deliberately deleted them 
so as to avoid incriminating themselves.

So now we get called in to see what we can do for them.

They have a single mailbox server Exchange 2007 setup, and it is backed up 
fully to tape every night, they keep there weekly tapes for a year and there 
monthly tapes indefinitely.

My thinking is to do this in a way that would be seen as safe, would be to 
setup a lab with a DC and and exchange server restored form the original site 
backups, and then go back to the 1st tape available after the start date that 
the e-mail is requested from, (it is looking like 8 months) then restoring the 
AD, and then the Exchange databases.

I am not sure if we can then force the undeletion of all deleted items, and 
then search the store for all mails with his name in the subject, to, from, cc, 
bcc and message body fields.

Moving that into an archive PST file, and then lather rinse repeat for each and 
every tape.

Putting the files onto a USB HDD and giving it to the lawyer.

Is this a workable solution, or does anyone have any better ideas.

Of course once completed the e-mail archiver quote is getting reissued 
immediately.

TIA

Graeme


--
Good news everyone, you have just received and e-mail from me!

Ted Turner<http://www.brainyquote.com/quotes/authors/t/ted_turner.html>  - 
"Sports is like a war without the killing."

Retrivein old e-mails mentioning a specific user Exchange 2007

[Graeme Carstairs]

Hi All,
One of our customers has just found out why we recommended and quoted them
an e-mail archival system.

One of their employees has left and has since started proceedings for
constructive dismissal.

HIs lawyer requested copies of every e-mail that mentions his name, and the
client passed the request to the users who would have been cited as being
involved 1st.

They retrieved all the e-mails they could and they were passed to his
lawyer.


Of course you can all guess what happened next, he claims that he knows for
a fact there were other e-mails sent by these people that mentioned him,
that haven't bee passed on and therefore these people
have deliberately deleted them so as to avoid incriminating themselves.

So now we get called in to see what we can do for them.

They have a single mailbox server Exchange 2007 setup, and it is backed up
fully to tape every night, they keep there weekly tapes for a year and there
monthly tapes indefinitely.

My thinking is to do this in a way that would be seen as safe, would be to
setup a lab with a DC and and exchange server restored form the original
site backups, and then go back to the 1st tape available after the start
date that the e-mail is requested from, (it is looking like 8 months) then
restoring the AD, and then the Exchange databases.

I am not sure if we can then force the undeletion of all deleted items, and
then search the store for all mails with his name in the subject, to, from,
cc, bcc and message body fields.

Moving that into an archive PST file, and then lather rinse repeat for each
and every tape.

Putting the files onto a USB HDD and giving it to the lawyer.

Is this a workable solution, or does anyone have any better ideas.

Of course once completed the e-mail archiver quote is getting reissued
immediately.

TIA

Graeme


-- 
Good news everyone, you have just received and e-mail from me!

Ted Turner   -
"Sports is like a war without the killing."