Employee's shady e-mails

[snplman]

We had an employee who basically sent out a few e-mails before she left. She was sure to delete the e-mails she sent from her sent folder and to clean out most of her inbox as well as company files, trying to start her own business.

Of course, I can track the e-mails and find out where she sent them, however, I cannot determine what was in those e-mails.

Is there anyway to view the contents of an e-mail that was already sent, but has been deleted by the user?

I'm going to retrieve the rest of the e-mails from the inbox and sent items for the previous days from the backup tape incase there were others sent.

We are going to be bringing legal action against this person, and I need some documentation.

If anyone has gone through something similiar, I would appreciate any tips, suggestions, and important things to consider/document, etc.

Thanks.

 

[snplman]

I should mention that I'm on Exchange Server 5.5 (SP$).

Also, am I right in assuming that if I save the Tracking logs from the tracking.log folder, that i will be able view the tracking information for those dates indefinately?

Thanks.

 

[jonarden]

Technical: If you do bricklevel backups of mailboxes, use a backup rotation and save those tapes this would be the easiest way to check e-mail contents.

Legal: (Questions for you to consider for your own protection) Does your company have a written e-mail policy? Who has asked you to do this? Have you spoken directly with your company attorney and been asked/authorized to do this? Did anyone put that authorization in writing? If not, why not? Finally, if you should find that you are uncomfortable with this situation, remember; your company attorney works for the company, you may want to speak to an attorney you hire (and trust) who works for you and can advise you how to protect your interests.

 

[Timebomb]

One quick option that might work, depending on how this person deleted. If you haven't deleted the account, use Outlook to access the accout. Click on the "Deleted Items" folder. Click on Tools - Recover deleted items. You might, MIGHT, find the items there.

Hope it helps, and good luck. I would not like to be in your position.



Tom Backus
Network Administrator
Hitchcock Industries
Bloomington, Minnesota.
backust@hitchcockusa.com

 

[devastator]

Timbomb is correct. If you have a retention period set for deleted items on Exchange and the employee didn't delete by hitting shift delete or go into recover deleted items and removed them from there, then you may be able to recover the items rather easily.

There are a lot of if's though......