Deleted Email Security

I had a couple of questions this week questioning the ability to recovered deleted email. The questions weren't from users who wanted to recover accidently deleted email, but from users who receive sensitive information by email, including personal information and credit card numbers, and need to comply with a new Massachusetts law addressing the security of personal information in the event of a data breach. They are aware that forensic methods exist that can recover deleted files from a hard drive but wanted to know if an average (or above average) user or a hacker could recover messages after the Deleted items folder is emptied.

When Outlook is configured to use a PST and you use Shift+Delete (recommended for messages you don't want recovered) or Delete then empty the Deleted items folder, someone would need to use a third party application to have any chance of recovering the messages. As time passes and new mail arrives or after the PST is compacted, the ability to recover deleted messages go down dramatically.

Using Outlook with Exchange complicates matters. If the network is secure, the data will be secure but there are more places where the messages may be stored. Deleted items could be covered by a Deleted Item Retention policy in Exchange, preventing the user from deleting the messages from Recover Deleted Items. If the user deleted the items using Shift+Delete, they may look deleted but will be accessible in Recover Deleted Items when the DumpsterAlwaysOn key is enabled. If the organization archives messages as they arrive they could be somewhere in the network. So many places to look, but with proper network security, the data will be secure.

To set the DumpsterAlwaysOn key, open the registry editor and browse to
HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\Client\Options.
Create a DWORD with the value of DumpsterAlwaysOn and data value of 1

Use Group Policy to disable/enable 'recover deleted items' in Outlook for users without admin rights on the workstation
http://support.microsoft.com/kb/924217 

For a list of tools which may allow someone to recover deleted items from a PST see
To repair a damaged Personal Folders PST file
http://www.slipstick.com/problems/scanpst.asp 

PST Policy Administrator - compact PSTs automatically
http://www.sherpasoftware.com/microsoft-exchange-products/pst-policy-administrator.shtml 

Meeting Forward Notifications

When a recipient of a meeting request forwards it to others, a notification is sent to the organizer, informing them the meeting was forwarded. This notification is generated and sent to the organizer each time the meeting request is forwarded.

Administrators can run a cmdlet in the EMS that will move the meeting forward notifications to the organizer's Deleted Item folder after they are processed by the calendar attendant. The notifications will still be generated but will be somewhat less annoying.

To do this, the administrator needs to run the following cmdlet

Set-MailboxCalendarSettings -Identity "usermailbox" -RemoveForwardedMeetingNotifications $true

To change the setting for all the mailboxes on Exchange 2007, the cmdlet is

Get-Mailbox -ResultSize unlimited | Set-MailboxCalendarSettings -RemoveForwardedMeetingNotifications $true

If the administrator doesn’t want to configure this on the server, the organizer can use a rule that deletes messages with the words "Meeting Forward Notifications" in the subject line. Rules may be necessary with Outlook 2007 as the notifications may remain in the Inbox when SP2 is installed.

End-users who want to avoid generating these notifications will need to forward the meeting requests as attachments, either as an iCalendar or by inserting the meeting into a message (as an attachment). Remember, you should always get permission from the organizer before forwarding the meeting request to others.

For more information on Set-MailboxCalendarSettings, see
http://technet.microsoft.com/en-us/library/aa996340.aspx