Deleted messages being stored because of the deleted message retain policy
Asked By
10 points
N/A
Posted on - 07/27/2013
Keeping in mind that export mailbox command may be utilized to copy messages over to administrator inbox if based on search criteria accomplished by use of message discovery for the messages that exist in user mailbox.
So how can I do this for deleted messages being stored because of the deleted message retain policy?
Here is a Scenario: Let’s say a user receives a sensitive email, He then decides to delete it after he/she reads it. Then the manager asks for that message that was deleted by the user. Or in another case he/she asks for all messages received by the user on given periods of time.
If the message was in the user's mailbox, I could have exported to copy it into admin mail box and given it to the manager. I could also use the log of message tracking, Form this I can easily tell what the message was all about.
Is it possible for retrieval of the message from the messenger or in that case the internal ID extracted from tracking logs?
But, gaining access to that mailbox is the only trick that seems to be left so that I’d mount it to my Outlook, retrieve the message, copy and delete the message (This will astonish the user when he/she sees the message again in his/her inbox then it disappears after a while).
Is it possible to do anything with the shell?
Keeping in mind that I am using Exchange 2007, I would appreciate any examples.
