Exchange server getting all emails from 2 users with phrase "xyz"

[holden j caufield]

I have 3 or 4 users who corresponded with company xyz, I need to search through all their emails with the phrase "xyz" and put it on an external drive for an auditor. Problem is some of these emails date to 2005.

The backups were done via backup exec back then on a physical server. The current setup, Exchange is a a virtual and the backups are veeam. So half the backups are exchange 2003 physical via symantec and half are exchange 2010 with veeam backups. Maybe exmerge to export pst and search but I do have all users pw and physical access to their machines so I can access all their current and archived emails. What's the best way to transport all these emails with the phrase xyz into a neat and orderly form.

 

[imagoon]

Basically you will likely need to purchase an app that can do all of this (reading exchange 2003 DB's mostly.) Exchange 2010 can't open the previous 2003 databases. So in order to use your backups, you will need to install Exchange 2003 (on a different domain since you can't add 2003 to a 2010 Exchange environment cleanly.)

This is going to be a ton of manual work to get the messages in to something basic like .msg format. From there you can make a pdf or what not. However, without an application that is designed for retention (ie not backups and PSTs) you are practically never going be sure you got everything.

If I was doing this type of work on a consultant level, I wouldn't bat an eye at saying I would want to bill for around 160 hours since you mentioned a) backup exec b) exchange 2003 c) pst files. Significantly more if I was told I need to go through all copies of the backups to look for "deleted correspondence."

Exchange 2010 itself would be simple as it has built in support to do searches on mailboxes and export those messages to a .pst file. I do that part on a regular basis. In reality, if these types of requests will come up, your company needs to make a decision on how to handle it. Typically 1) Set a retention period. 1a) use Exchange policies to enforce it. 2) use retention polices so that messages deleted from mailboxes are not deleted until retention expires. 3) retain old accounts in the current mail system or in an alternate purpose built retention system.

 

[inachu]

Average industry standard email retention is 2 years.

 

[holden j caufield]

Basically you will likely need to purchase an app that can do all of this (reading exchange 2003 DB's mostly.) Exchange 2010 can't open the previous 2003 databases. So in order to use your backups, you will need to install Exchange 2003 (on a different domain since you can't add 2003 to a 2010 Exchange environment cleanly.)

This is going to be a ton of manual work to get the messages in to something basic like .msg format. From there you can make a pdf or what not. However, without an application that is designed for retention (ie not backups and PSTs) you are practically never going be sure you got everything.

If I was doing this type of work on a consultant level, I wouldn't bat an eye at saying I would want to bill for around 160 hours since you mentioned a) backup exec b) exchange 2003 c) pst files. Significantly more if I was told I need to go through all copies of the backups to look for "deleted correspondence."

Exchange 2010 itself would be simple as it has built in support to do searches on mailboxes and export those messages to a .pst file. I do that part on a regular basis. In reality, if these types of requests will come up, your company needs to make a decision on how to handle it. Typically 1) Set a retention period. 1a) use Exchange policies to enforce it. 2) use retention polices so that messages deleted from mailboxes are not deleted until retention expires. 3) retain old accounts in the current mail system or in an alternate purpose built retention system.

Thanks for taking the time. Luckily I had the archived pst on the local machines, just going to give myself access to there mailboxes and I should have most of everything we need. I think veeam also have built in support to search text through exchange, but I think the overhead is too much on the backup job, has anyone tried that option. I may look into enabling this feature.

 

[imagoon]

Thanks for taking the time. Luckily I had the archived pst on the local machines, just going to give myself access to there mailboxes and I should have most of everything we need. I think veeam also have built in support to search text through exchange, but I think the overhead is too much on the backup job, has anyone tried that option. I may look into enabling this feature.

Depending on the audit, that may not be enough. Local .pst = untracked messages with no way to verify anything in the trail hasn't been deleted.

As for Exchange, you shouldn't be logging in to their mail. You should be using Search-Mailbox command to export what you need.

Veeam has Veeam Explorer for Exchange which is free / included with the Veeam backup. However you need to open each and every database and search. It isn't indexed.

 

[Genx87]

This is why having some kind of email archive with a defined retention policy is a must in todays world. Going back to 2005 and multiple versions of exchange? Ouch!!!!!!!!!!!!!!!!

 

[holden j caufield]

FYI for anyone else stuck in this option there is a legal discovery multi mailbox server search option. It spits out the emails and a csv file.

 

[holden j caufield]

Exchange 2010 itself would be simple as it has built in support to do searches on mailboxes and export those messages to a .pst file. I do that part on a regular basis. In reality, if these types of requests will come up, your company needs to make a decision on how to handle it. Typically 1) Set a retention period. 1a) use Exchange policies to enforce it. 2) use retention polices so that messages deleted from mailboxes are not deleted until retention expires. 3) retain old accounts in the current mail system or in an alternate purpose built retention system.

Edit:

Nevermind figured it out. Thanks