No announcement yet.

email movement tracing ?

  • Filter
  • Time
  • Show
Clear All
new posts

  • email movement tracing ?

    Ok so, one of our employees has an email that somehow magically ended up in the deleted items folder.
    This user syncronises using an iPhone while out of the office, and read the email. Back in the office, could not find the email.
    Eventually found it in the deleted items.

    Now apparently it's "out of the realms of possibility" that this employee could have even accidentily deleted or moved the email.

    So what I'd like to know is if it's possible to dig enough into the mailstore, and find out when that email ended up in the deleted items folder..

    We don't have any really heavy logging enabled - so this may be a fruitless chase, but I thought i'd try....
    Please do show your appreciation to those who assist you by leaving Rep Point

  • #2
    Re: email movement tracing ?

    You can download and Install ExInsight from here:

    It's a real-time monitoring tool for Exchange mailboxes. If it happens again, you will be able to track the event.


    • #3
      Re: email movement tracing ?

      Do the obvious and check if the user has any client side rules running in outlook. Assuming you have tracking logs enabled check them as that will show delivery to the users inbox and the time of delivery. Theres only 2 places it will arrive and that will be the junkmail folder or the inbox. It wont arrive in the deleted items folder unless there was some other intervention by a 3rd party tool or an Outlook rule. Also check the permissions in AD as to who else has access to their mailbox, delegates etc.


      • #4
        Re: email movement tracing ?

        imprety sure noone else has access.

        I know it was delivered to the inbox - i've checked tracking, and manager is certain he saw it on his iphone.

        I'll have to consider. I just wanted an opportunity to smack it to the manager, who, in reality, is a fucking moron.

        "what has changed with exchangre today ?"
        'nothing. i've been showing newstarter around Active Directory - that's all we've done'
        2 minutes pass
        "no someone has definitely done soemthing or changed something, i'm getting a certificate error"

        well, fuckin no, nothing changed.

        I hate my manager.
        Please do show your appreciation to those who assist you by leaving Rep Point


        • #5
          Re: email movement tracing ?

          Nothing says "Professional Satisfaction" like an I-Told-You-So moment with an annoying superior. Does he have pointy hair?
          Wesley David
          LinkedIn | Careers 2.0
          Microsoft Certifications: MCSE 2003 | MCSA:Messaging 2003 | MCITP:EA, SA, EST | MCTS: a'plenty | MCDST
          Vendor Neutral Certifications: CWNA
          Blog: || Twitter: @Nonapeptide || GTalk, Reader and Google+: [email protected] || Skype: Wesley.Nonapeptide
          Goofy kitten avatar photo from Troy Snow:


          • #6
            Re: email movement tracing ?

            hehh.. no..
            Please do show your appreciation to those who assist you by leaving Rep Point


            • #7
              Re: email movement tracing ?

              There must be an IT equivalent of the military "the most dangerous thing you will ever meet is a 2nd Lieutenant with a map"

              Something like "a manager with access to google"

              Met this too many times myself -- people who think that, just because they have configured a home WiFi network, they know everything about IT. No-one would act that way about law, or even about their car, but everyone thinks they know our job better than we do
              Tom Jones
              MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
              PhD, MSc, FIAP, MIITT
              IT Trainer / Consultant
              Ossian Ltd

              ** Remember to give credit where credit is due and leave reputation points where appropriate **