[OT] MS-Exchange-2000 Deleted Item Restoring

In Exchange 5.5 you open your deleted items and look for Recover Deleted
items. If it is grayed out then it is not set up. I set mine up a few months
back.

Jim Moore

-----Original Message-----
From: Todd Caughey [mailto:caugheyt@...]
Sent: Tuesday, March 04, 2003 9:01 AM
To: vantage@yahoogroups.com
Subject: [Vantage] [OT] MS-Exchange-2000 Deleted Item Restoring

Our HR Manager's son, an Army battlefield medical technician, has just been
transfered to Kuwait. The Army sent her his new email address but aparently
it looked like spam and she deleted it without realizing what it was until
she spotted it just as she emptied her deleted items folder. The message
was received and deleted on the same day so not backed up overnight.
Needless to say she is very anxious to get it back if at all possible.

I had noticed that there a a deleted item recovery option within Outlook Web
Access so I tried that for her and it showed no items. I am hoping that
this is because the deleting was not done through web access and that the
message is still available in the store but still within the deleted message
retention period. We just recently switched to Exchange-2000 so I am not
really familiar with the mechanics of dealing with deleted item recovery. I
do notice that the 'Deleted Items Recovery" option under "Tools" is grayed
out. Does this mean we do not have a retention period set up? Is the
message permanently gone? Isn't there a default retention period?

Any advice to possibly help a worried Mom stay in touch with her son?

Thanks,
-Todd Caughey
Our HR Manager's son, an Army battlefield medical technician, has just been transfered to Kuwait. The Army sent her his new email address but aparently it looked like spam and she deleted it without realizing what it was until she spotted it just as she emptied her deleted items folder. The message was received and deleted on the same day so not backed up overnight. Needless to say she is very anxious to get it back if at all possible.

I had noticed that there a a deleted item recovery option within Outlook Web Access so I tried that for her and it showed no items. I am hoping that this is because the deleting was not done through web access and that the message is still available in the store but still within the deleted message retention period. We just recently switched to Exchange-2000 so I am not really familiar with the mechanics of dealing with deleted item recovery. I do notice that the 'Deleted Items Recovery" option under "Tools" is grayed out. Does this mean we do not have a retention period set up? Is the message permanently gone? Isn't there a default retention period?

Any advice to possibly help a worried Mom stay in touch with her son?

Thanks,
-Todd Caughey




[Non-text portions of this message have been removed]
Todd:

Is your exchange server creating a log file? If it is, and if you are also
logging these to the event viewer on exchange server, this is the way I do
it in Exchange 5.5:

Check event viewer for the approximate receipt time of the e-mail, then open
received mail, find the logged item stored in the archive (it is probably
named something stupid like CXF4WK4). Go to the exchsrvr folder, imcdata,
in, archive and search the archive file for that stupid id name. If you
aren't logging these to event viewer, you could do a search on the exchsrvr
folder for your user's name, advance search with the date frame.

I don't know how much logging and such has changed in 2000, and I don't know
if you even have logging turned on, but everyone should -- it has saved me
on many many occasions. And truly doesn't take up much disk space, cause
everything is refined down to plain text in the archive. I go in and dump
all the old messages from time to time.

This is also a good way to see how a virus came into your world (from a
forensic point of view), because executables don't work from these archives.


Best of luck,
Lydia