Exchange logs recovery

15 pts.
Tags:
Exchange 2003
Exchange 2003 administration
Exchange migration
Exchange Server 2003
Exchange Server 2003 administration
Hi, I would like some advices, tips or tools that can help me achieve the following:

A company had a exchange 2003 mail server, but after some time they migrated. Now, i have backup tapes from before the migration and I was tasked to review the access logs of the mailboxes, just to be sure that a worker did not access another worker mailbox (dont ask how, but it was possible, its very bad and we already know this). I have tried several tools but all seem to focus on restoring mails and mailboxes, not these logon trails.

The Exchange was configured to leave no trails whatsoever, but in the First Storage Group -> Mailbox Store -> Logons, we can see this trails. I only have some files like the EDB and was wondering if these kind of logs were recoverable and if they were part of the EDB or how can i access them from backed up versions. Thanx!



Software/Hardware used:
Exchange Digiscope

Answer Wiki

Thanks. We'll let you know when a new response is added.

Although very helpful, there are no such logs in Exchange. The basic theory is, If a user wasn’t supposed to access a mailbox, he/she shouldn’t have the permissions to do so.

Discuss This Question: 1  Reply

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • Chrono08
    Well yeah the First Storage Group -> Mailbox Store -> Logons are not exactly logs, but they can show some user activity. We discovered that users did access other worker's mailboxes and it was shown there. Now I want to know if there is a way to recover this registries from a EDB file. If they can, then we can restore the EDB file from another date and see if there is such activities going on. Do you guys know a way to recover the First Storage Group -> Mailbox Store -> Logons???
    15 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following