>From System Manager? No. System Manager tells you practically nothing about folders and individual items in a mailbox.
What you can do, if you don't want to be detected spying on this guy, is restore a copy of the mailbox from the relevant period to your recovery server and open the mailbox there. In fact, you might be required to do that if the employee has done anything to cover his tracks. Ed Crowley MCITP MCSE+I MCSE+M MCTS MVP "There are seldom good technological solutions to behavioral problems." -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Braun, Charles Sent: Monday, September 15, 2008 5:33 PM To: Exchange Discussions Subject: Advanced tracking of messages I have gotten the following request. All approvals have been granted for me to complete everything that has been asked of me, I just need to know what if anything I can actually do using the native tools in Exchange 2003: The names have been changed to protect the innocent. === So & So I am conducting an investigation and need to review emails sent to John Smith. Approval to retrieve this information has been granted by Joe Blow. I would like authorization to communicate directly with IT regarding this matter. For reference, the Such & Such Department, PSU file number is 2008-01-001. The email was sent on September 4, 2008. The period of time I am interested in is September 4, 2008, through September 11, 2008, at 1000 hrs. I have attached a snap shot of the original email that was sent out for reference by IT. I need to determine the following: 1) Confirmation that the email was received by his account: [EMAIL PROTECTED] 2) Whether or not the email was opened a) The email may have been opened from a remote location using the internet b) The date the email was opened 3) Whether or not any of the attachments were opened 4) Whether or not the email was forwarded to anyone a) If forwarded, to who === Is any of this possible to find out from within System Manager and without me actually logging in to the mailbox in question where I could check sent items etc to see if it was forwarded and so forth? _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
