Notifications
Clear all
Topic starter
07/12/2020 7:19 pm
we got a Microsft Exchange, on a virtual server the hyper visor is vmware.
A mail box has been deleted. I am thinking to obtain the file of the VM and open it with the last version of autopsy. In your opinion may we find data about the deleted mailbox?
thanks
11/12/2020 7:43 am
The mailbox may still be in the mailbox database sitting as disabled. Typical retention policy assigned to user mailboxes is 30 days, after which you may have problems recovering it. As for VM searching, you may need some tinkering with VM snapshots and converting the image to be readable in Autopsy.Â
Topic starter
11/12/2020 8:27 am
ok many thanks