Forensics on Exchange mailboxes? 1

[EricDM606]

Good afternoon everybody,

I've been asked to conduct some forensic investigations on mailboxes in my organization's domain. Is there a software tool recommended by users here that will allow me to perform searches on the Exchange 5.5 & 2000 mailboxes for certain keywords or criteria without me having to log on as the user and use his/her mailbox directly?

Eric M.

 

[zbnet]

Discovery Attender (

http://www.sherpasoftware.com/DAEOverview.shtml)

is functionally able, and almost certainly cheaper than the competition.

 

[EricDM606]

I got a hold of Discovery Attender, it worked very well on the Exchange 5.5 system. However, I'm having trouble getting any results on the Exchange 2000 system... It says my account has the insufficient credentials. I looked for "Exchange Admin" credentials but I couldn't find them on my DC. Any ideas?

Eric M.

 

[zbnet]

2000 works differently to 5.5 in this respect, there is no Exchange Service Account after 5.5.

This link should hopefully help you out:

http://www.petri.co.il/grant_full_mailbox_rights_on_exchange_2000_2003.htm