Hi

Our backup team currently uses Exchange Management Shell to export mailboxes restored from backups to PST. The concern we're encountering is that the restored pst files reflect the date time stamp of the date the restoration work was done.

We're doing this work for litigation related purposes - where presenting evidence that we can show has been untouched by us is important. Is there some way of ensuring the restored .pst reflects the source storage date and time as opposed to the restoration date and time?

Thanks!

I would ask the backup vendor. I dont think this is really an Exchange question.

I believe backups were done at that point through TSM. However, my understanding is that the issue is with Exchange as the team has been able to restore other files with the correct date/ time stamp preserved - as in this case they are simply copying the files from backup server to make available to the legal team.

The backup team says that this is not possible with Exchange as they restore the old backups to a separate Exchange database and from there export to PST using Exchange Management Shell.  At this point the dates are not preserved and the restoration date time is placed on the restored pst files.

Any thoughts?

So I need to understand your issue more, but in general the underlying record CREATE date will always change when exporting/migrating a new record into PST or alternate Exchange database, however the important sent/received information should be preserved for your court case

Our DigiScope product http://www.lucid8.com/product/digiscope.asp preserves all the forensic information you should need, but again tell me more.  Perhaps you could provide a step by step illustration of your situation with images here and then we can guide you further