Find all Email Corespondence to Company B.....

Let's say you have been tasked with finding all corespondent email between your company and company B.... Let's just say icon_wink.gif. But to make it a bit more challenging you have to find all the actual emails and gather them together (in a folder/public folder of some sorts) for management to review and later print some of them out. So, just having the references that are in ESM Message Tracking Center won't work (Unless you know something I don't....which is very likely icon_smile.gif). Management wants you to sort through all 50 mailboxes in your exchange 2003 sp2 database.

What's a lonely Admin to do?


My only thought is to have to open all the mailboxes one by one on the server and do a search for company B, then move the emails into a public folder. That will probably take a couple weeks icon_sad.gif **prays someone has a script**
WIP: CCENT/CCNA (.....probably)

Comments

  • cnfuzzdcnfuzzd Member Posts: 208
    For Exchange 2003, as far as I am aware, your options are limited...

    I would copy the database into a test environment. Then use exmerge to merge all the mailboxes into one mailbox. Then sort. Sounds painful, but possibly faster that the alternative.

    John
    __________________________________________

    Work In Progress: BSCI, Sharepoint
  • HeroPsychoHeroPsycho Inactive Imported Users Posts: 1,940
    Buy Enterprise Vault.
    Good luck to all!
  • Chivalry1Chivalry1 Member Posts: 569
    There are some pretty good archival and e-discovery packages out there for Exchange. I would restore your email databases to a test exchange server. Download a "Trail" version of one these products. It will index all email and give you the ability to search for the requested information.

    This also would be the optimal time to explain to management how important it is to have technology such as this. This is likely steaming from a legal case. Outside of that you are pretty much stuck.

    Sidenote: Your company could be held legally liable for information contained in email. So you would want to inform your management that they may want to act on this sooner rather than later.
    "The recipe for perpetual ignorance is: be satisfied with your opinions and
    content with your knowledge. " Elbert Hubbard (1856 - 1915)
  • blargoeblargoe Self-Described Huguenot NC, USAMember Posts: 4,174 ■■■■■■■■■□
    My answer is that's it's really too late for your company to have implemented the solution that they really need for this problem. All you have left is email that that your users haven't yet deleted, and there isn't a pretty way to sort through it.

    Does your manager really know the magnitude of what you're being asked? I'd really push for a third party solution to sort this out for you, but you're still stuck with a restored copy on a test server I think. If there's any hint that people in your office are being investigated for wrongdoing related to dealings with company B, that data will disappear of the production system quickly.
    IT guy since 12/00

    Recent: 11/2019 - RHCSA (RHEL 7); 2/2019 - Updated VCP to 6.5 (just a few days before VMware discontinued the re-cert policy...)
    Working on: RHCE/Ansible
    Future: Probably continued Red Hat Immersion, Possibly VCAP Design, or maybe a completely different path. Depends on job demands...
  • NetAdmin2436NetAdmin2436 Member Posts: 1,076
    Very good ideas.

    I have GFI MailEssentials and MailSecurity and so I'm playing around with GFI's MailArchiver now. Ugh, I wish I had this setup prior.

    I love how some people will delete emails from their inbox, but not their sent items. Whooops....Busted! icon_smile.gif I guess these same people don't understand daily tape backups as well.

    Anyways, I think I'm pretty well set now. Thanks again gents!
    WIP: CCENT/CCNA (.....probably)
  • blargoeblargoe Self-Described Huguenot NC, USAMember Posts: 4,174 ■■■■■■■■■□
    Depending on how critical it is that mail is retrieved, you could go back as many days old as your earliest tape back restored to a test server, plus whatever your deleted item retention is if you log in to the mailboxes and use the recover deleted items feature. I was in a REALLY crappy situation one time where a company brought me in way too late and they paid me to do that. It was THAT important.
    IT guy since 12/00

    Recent: 11/2019 - RHCSA (RHEL 7); 2/2019 - Updated VCP to 6.5 (just a few days before VMware discontinued the re-cert policy...)
    Working on: RHCE/Ansible
    Future: Probably continued Red Hat Immersion, Possibly VCAP Design, or maybe a completely different path. Depends on job demands...
Sign In or Register to comment.