Scanning Microsoft Exchange

Introduction

This article shall serve as a guide on scanning your Microsoft Exchange server/s with Card & Data Recon.

At the bottom of the article, we will also look into offline scanning of the Exchange Information Store as well as Outlook .PST backup files.

 

Live scanning of MS Exchange

Prerequisites

  • Sufficient CR/DR Advanced Licenses for each mailbox present in your Exchange server (1 license per mailbox)
  • Credentials of each mailbox account
  • IMAP service enabled & started on the Mailbox and CAS server (if using one)
  • Hostname of Mailbox and/or CAS server (if using one)

 

Setting up credentials

The first thing you need to do is to set up your Exchange credentials for each mailbox in CR/DR so that you don't run into any authentication and/or mailbox access errors when running a scan.

On the main page, simply click on the credentials button shown in the screenshot below:

Then in the pop-up window, click on '+Add' and select 'Microsoft Exchange (MAPI)' to add your mailbox credentials.
Repeat this step for each mailbox you have.

Target location = Mailbox name
Username = Login ID of mailbox user (Can be 'DOMAIN\USER' or just 'USER')

 

Starting the scan

Once done setting up all credentials, head back to the main page and click on the target location button shown in the screenshot below:

In the accompanying pop-up window, you may choose to change the default target location or add your Exchange server as an additional target to scan by clicking on the respective buttons.
(Licenses would be utilized accordingly)

Select 'Microsoft Exchange (MAPI)' under 'Email' and enter your Exchange server (or CAS) hostname followed by your mailbox name.
Repeat this step for each mailbox you have.

Once finished adding all your mailboxes, you may head back to the main page and start the scan.

 

Offline scanning of Microsoft Exchange Information Store

Card & Data Recon includes the ability to understand and natively decode Microsoft Exchange Information Store files which include .EDB and .STM formats.
This is achieved by performing a file-system scan of a location where a copy or backup of the Information Store is located.

Instructions

  1. Stop the Microsoft Exchange Information Store service
  2. Copy the Information Store files (.EDB/STM) to a backup location which is accessible by CR/DR
  3. Run a file scan on that location

Notes

  • Masking is NOT supported for .EDB/STM files
  • 'Permanent Delete' option will erase the ENTIRE Information Store file

 

 

Offline scanning of Microsoft Outlook Data files

Card & Data Recon also includes the ability to search the content of Microsoft Outlook Data files (.PST/OST), which are used by Outlook to store emails locally.

Instructions

  1. Export/backup your Outlook Data files to a backup location which is accessible by CR/DR
    A guide can be found here
  2. Run a file scan on that location

Notes

  • Masking is NOT supported for .PST/OST files
  • 'Permanent Delete' option will erase the ENTIRE Outlook Data file

 

 

All information in this article is accurate and true as of the last edited date.

Have more questions? Submit a request

0 Comments

Please sign in to leave a comment.