Exchange Storage and backup data

[mfalomir]

Im new to exchange

If one of my users deletes and email, and it also empties his Deleted Mail Folder, there is no chance at all that I could find some data or backup in my exchange server , regarding those emails that he previously deleted from his mailbox and trash as well ?

Thanks in advanced

 

[zbnet]

Is it a new email they deleted, or could it be on the previous night's backup?

 

[mfalomir]

it's a new one ...

thanks

 

[zbnet]

Well, the email is technically still in the store even after it's been deleted, just like a file is still on a hard disk after it's been deleted, but the space is marked as free and can be overwritten again by new mail. Besides, there aren't any (publically available) tools that can read the raw content of Exchange db files and extract message content.

The email is also still in the transaction logs (unless you have circular logging enabled, in which case the log with the email in it will be overwritten in due course), but the problem is still the same - the lack of tools to extract the email from the log file. You could spend days with a hex viewer and still not find anything meaningful. Building a restore machine won't help either, as even if you restored last night's backup and replayed today's log files, the delete is still a transaction in the file and so will recreate production for you as now.

Perhaps you need to put this occasion down to experience, and if this stuff is really important to you, buy some email journelling capacity...?

 

[mfalomir]

I see, thanks for your help

 

[cmeagan656]

There is one long shot. Do you have your Exchange server set to retain deleted items for any period of time? If so, if the user goes to his deleted items folder and (assuming a version of Outlook for the mail client) goes tools ->recover deleted items they should find any items which were deleted withing the retention period.

Again, its a long shot and depends on if (or for how long) you retain delted items and when the user deleted the email.

Cheers.

 

[zbnet]

Yeap, that's worth checking, just in case the user doesn't know to do a shift-delete, or hasn't purged the deleted items folder themselves.