Forensics Exchange 2007

[gb0mb]

I have been asked by a customer to give them the ability to view email stored on their exchange server. They wish to view a users email correspondence for legal reasons. I am not a forensics person but I am sure I someone can inform me of a toll that would meet their needs.

Thanks

Gb0mb

........99.9% User Error........

 

[xmsre]

I'd go with third party tools. Ontrack's Powercontrols utility makes such leagal searches fairly painless.

http://www.ontrack.com/powercontrols

 

[SirCam]

We use Symantec's Discovery Accelerator. It's pretty comprehensive in examining not only a user's email store but the journal mailbox as well.

 

[billberge]

Are they doing any Journaling? You can get what you need from there.

 

[58sniper]

Is this a one time look into the mail currently in the mailbox? If so, you can export the mail to a .pst file (you'd want to do this for a legal hold anyways).

If there is a need to watch all activity in the mailbox, that's a little different.

Pat Richard
Microsoft Exchange MVP

 

[SirCam]

Without Journaling enabled you may not capture all emails sent to and from the user. They can easily delete any emails from the view and without going into their mailbox and restoring them, an obviously intrusive method, you may not get a full representation of what the user has been doing. If you choose to use Journaling, you will need find a 3rd party application which can target specific senders, recipients, etc, as Journaling will capture all users email (unless you are using Exchange 2007 which can journal specific users). We journal over 150,000 messages a day. Without a 3rd party app to use, this info would be useless. (Imagine Outlook trying to view several million messages - not going to happen.)

 

[GrimR]

Our one office uses GFI MailArchiver, needs SQL

 

[gb0mb]

Thank you all for the insight. I will be looking into all ideas mentioned.

Gb0mb

........99.9% User Error........