Discussion Locked

Recover Deleted Email

0 helpful
9 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have been told that a person can retrieve email, even after removing them form Deleted Items in Outlook.
A) Is this true?
B) Is it a program that you do this with or simply knowing where Windows puts them. I'm assuming the files are encrypted somehow.

I have a couple users that I am suspicious of violating our emial policy but I can't take any hard evidence to management because they remove items form their Deleted Items folder.

9 replies

by tony.colgrove

If you have set deleted item retention (avail. in Ex5.5 and Ex2000), you can recover the messages from the Outlook client (version 8.03 or higher). To recover click on the deleted items folder and select Tools> Recover Deleted Items.
This works aslong the deleted item was sent to the delete folder, if a user did a shift-delete, it is unrecoverable.

by mckaytech

It depends on your system but yes, quite often, "deleted" messages can sometimes still be found in personal folders, archive (*.pst) files or in the Exchange database itself. The question is how much time you have to invest in the project. If it'soutside e-mail, chances are that a copy also resides somewhere on the Internet. And again, the question is how much is it worth to recover it? For a sexual harassment or industrial espionage case, it might be worth it. For your garden-variety e-mail violator who occasionally uses his/her company account to send a Happy Birthday note to a relative, it's pretty hard to make a business case for prosecuting the violation.

The better answer is to implement logging or Message Tracking and let your users know exactly what you're doing. That way, you have evidence of the message before they ever get it. It tends to bring e-mail mischief to a rapid halt and doesn't waste your time looking for a needle in a haystack.

paul

by suemvp

Why did you reject the answer from tony.colgrove? Deleted Item Retention is the name of the feature that you were told about. If this feature is active, the items are retained on the Exchange Server for a set period of time, during which they can berecovered.

This discussion is closed to new replies.