MIT Media Lab investigation uses calendar info

I read MIT Will Investigate Media Lab's Ties to Jeffrey Epstein Following Director's Resignation as just another "yeah, people will do just about anything for money" article until I came to this part:

On Ito’s calendar, which typically listed the full names of participants in meetings, Epstein was identified only by his initials. Epstein’s direct contributions to the lab were recorded as anonymous.

(underlining mine)

THIS is really interesting!

If you want to know how to do stuff like this forensically (or even proactively) in Exchange or Office 365 let us know -- our wheels are already turning on this and a few other things.  

Exporting Contacts to a CSV file using the EWS Managed API and Powershell

Exporting Contacts to a CSV file using the EWS Managed API and Powershell by Glen Scales will show you how to get this information OUT of Exchange server-side if you want to.

Normally we see people wanting to put this information INTO Exchange server-side, but there are legit reasons for wanting this capability:  archiving crucial customer data from former employees, saving vital contact data, legal discovery, migrating to Google, etc.

For the same reasons you will want to check out his scripts in Export the GAL or Address list with EWS to Vcards in 2013 MEC sample 1.

Arm yourselves with knowledge.

Exchange Database Size Growth Post Undo -- LitigationHoldEnabled

Customers ask us how much space will Exchange require post-migration if they have to rollback (aka our UNDO.)  We typically suggest it's somewhere around 4x the size of the interim Access database,  and double the size of the Oracle Beehive tablespace.  This has been an inexact science, particularly since email continues to flow in (and out) of the organization during the UNDO process. 


One contributing factor to the space bloat is the "LitigationHoldEnabled" feature:  post-undo Exchange continues to hold onto deleted items (as it should!) Microsoft's Exchange team released an article and script that shows how to calculate the database Exchange 2010 and 2013 Database Growth Reporting Script.  It is certainly not needed for during testing --  you can always delete and re-create the exchange stores.  Rather, it's something to bookmark just in case you need to figure out why your DB storage requirements jump significantly.

Legal Discovery in Archived Meeting Maker Data

Necessity truly is the mother of invention.

I know, cliche does not become us, but it's apt in this case.

The topic is legal discovery.  A client has scads of backups of Meeting Maker server data back to the turn of the century and needs to do legal discovery on it. 

Our previous modus operandi required a full calendar insertion (meaning significant computer lab resources and expertise) and a PST export.  But after noodling on this we thought -- let's use our tool that we originally built for Zimbra insertions!  It produces ICS files which we inserted into Zimbra but are also readable in Outlook and as text!

Here's how it works:

We convert Meeting Maker export into our intermediate Access format and run zinsert (either for one user or the entire server of users if you prefer).

If you use a text editor to look at them they look like this (readable, but let's face it, geeky):

If you list them as an external file in Outlook (which does not involve IMPORTING them) - they look a lot more like calendars:

and can even be searched and displayed as a list:

Compliance, legal discovery, and your Meeting Maker data

Remember to look at calendars as part of the legal discovery process.

Last year we migrated a university (sorry, I can't give out the name here). During the migration, the CIO wondered why legal discovery solutions only focus on email (because it’s the only data that can be easily read, and there is a lot of it).

He saw their calendar data in a database and mentioned they might need to revisit their historic calendaring data (via Meeting Maker) for legal discovery or forensic analysis.

We’re calendaring guys. Reading calendar data is what we do, we said, so let us know if you need it.

Last month they asked if we could extract calendar items for a set of users. The caveat: they wanted the output to contain all meetings, agendas, appointments, along with the names of all people they met with in an easy to read format.

The "easy to read format" was the really hard part.

However, we believe in the old virtues of hard work and entrepreneurial solutions. We also noticed that since the Microsoft Exchange base is growing and the Meeting Maker base continues to contract that we'd rather solve this on Exchange.

We had their Meeting Maker data in an Access database. We could have written some code to expand the calendar data. But this method seemed pointless since Sumatra’s insertion into Exchange does most of that work already. So our solution was to take advantage of Exchange - insert their data into our test lab, and then create a tool to read the calendar data directly from Exchange.

The report contains ALL calendar entries (meetings and appointments), showing with organizer, subject, date, attendees, including the agenda.

For current Sumatra clients who can’t wait to try this, here’s the command syntax for a report of Bela Bartok’s calendar in 2008 (it would all go on one command line but we format here for clarity):

suExchange2007.exe
/usersrc:alias
/user:bela_bartok
/cmd:report_all
/dtstart:”1/1/2008”
/dtend:”12/31/2008”

Note: If you do not want to see the agenda, you can use the /cmd:report switch. It’s much faster!