Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


xpd



Chief Trash Bandit
10029 posts

Uber Geek

Mod Emeritus
Trusted
Lifetime subscriber

# 239298 11-Jul-2018 10:02
Send private message

User on Office 365 for email, gets spammed with 7000+ emails – the usual porn, drugs stuff.  Most went into the Junk folder. User deletes them all, then after approx. 4+ days we get requested to investigate what happened. When checking the Office 365 admin control panel and the incoming email stats, theres no sign of those 7000 emails ever hitting Office 365.  User does not have multiple accounts or anything setup, just the single O365 email account.

 

I tried a recover deleted items, and only found a single spammy email.

 

So where the hell did these emails come from, and/or why did O365 not see them in its stats as incoming email ? Any ideas or things to check ? Users systems have been checked over and virus/malware free.

 

 





XPD / Gavin / DemiseNZ

 

Server : i5-3470s @ 3.50GHz  16GB RAM  Win 10 Pro    Workstation : i5-3570K @ 3.40GHz  20GB RAM  RX580 4GB Win 10 Pro    Console : Xbox One

 

https://www.xpd.co.nz - Games, emulation, geekery, and my attempts at photography.     Now on BigPipe 100/100 and 2Talk

 

Emulation - The art of getting your $4000 PC to run an 80's system - and still fails.

 

Add me on Steam


Create new topic
2633 posts

Uber Geek

Trusted
Lifetime subscriber

  # 2054278 11-Jul-2018 12:32
Send private message

Wow...  that's an odd one.  SOmone could have dragged and dropped the messages into his folders (unlikely) but that doesn't explain why they aren't in the dumpster.  It's possible that Mickeysoft had a failure and then cleaned it up but that's not necessarily likely either.

 

365 Audit logs are off by default from memory and only kept for 7 days, but maybe have a look in case I'm wrong.  I think these are in the Security & Compliance area.





"4 wheels move the body.  2 wheels move the soul."

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

376 posts

Ultimate Geek


  # 2054330 11-Jul-2018 13:39
Send private message

Dynamic:

 

Wow...  that's an odd one.  SOmone could have dragged and dropped the messages into his folders (unlikely) but that doesn't explain why they aren't in the dumpster.  It's possible that Mickeysoft had a failure and then cleaned it up but that's not necessarily likely either.

 

365 Audit logs are off by default from memory and only kept for 7 days, but maybe have a look in case I'm wrong.  I think these are in the Security & Compliance area.

 

 

 

 

Pretty sure they are off by default, but they are kept longer than 7 days. Looking at mine they go back several months until the day we enabled auditing.

 

 

 

If they have retention policy enabled Security & Compliance you can use eDiscovery to dump the email box out as a csv, then look for the folder "\Recoverable Items\DiscoveryHolds". Depending on the policy config you can find a copy of hard deleted emails in here.


 
 
 
 


846 posts

Ultimate Geek

Subscriber

  # 2054333 11-Jul-2018 13:47
Send private message

If the messages were shift-deleted directly in the Junk container they wont be recoverable using recover deleted items on the deleted items container. Use MFC-Mapi (or 'dumpsteralwayson' registry key if it still works) to try and recover the deleted items in Junk. Consider a retention policy or litigation hold for more control in future. Are you using the exchange message trace function to search for them?








Go Hawks!
945 posts

Ultimate Geek

Trusted
Subscriber

  # 2054491 11-Jul-2018 18:21
Send private message

Just for confirmation, what was the mail client in use?  Was it Outlook on the Web, or the Outlook client?

 

I'll do a couple of checks in the next couple of hours, but I'm just wondering if the emails were "bcc'd" and thus not showing in the audits?

 

 


Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

D Link ANZ launches EXO Smart Mesh Wi Fi Routers with McAfee protection
Posted 15-Oct-2019 11:31


Major Japanese retailer partners with smart New Zealand technology IMAGR
Posted 14-Oct-2019 10:29


Ola pioneers one-time passcode feature to fight rideshare fraud
Posted 14-Oct-2019 10:24


Spark Sport new home of NZC matches from 2020
Posted 10-Oct-2019 09:59


Meet Nola, Noel Leeming's new digital employee
Posted 4-Oct-2019 08:07


Registrations for Sprout Accelerator open for 2020 season
Posted 4-Oct-2019 08:02


Teletrac Navman welcomes AI tech leader Jens Meggers as new President
Posted 4-Oct-2019 07:41


Vodafone makes voice of 4G (VoLTE) official
Posted 4-Oct-2019 07:36


2degrees Reaches Milestone of 100,000 Broadband Customers
Posted 1-Oct-2019 09:17


Nokia 1 Plus available in New Zealand from 2nd October
Posted 30-Sep-2019 17:46


Ola integrates Apple Pay as payment method in New Zealand
Posted 25-Sep-2019 09:51


Facebook Portal to land in New Zealand
Posted 19-Sep-2019 18:35


Amazon Studios announces New Zealand as location for its upcoming series based on The Lord of the Rings
Posted 18-Sep-2019 17:24


The Warehouse chooses Elasticsearch service
Posted 18-Sep-2019 13:55


Voyager upgrades core network to 100Gbit
Posted 18-Sep-2019 13:52



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.