I thought about restoring the mailbox. That would not show me much more though than if the person had forwarded the message (find in sent items) and even that is not 100% accurate as the person could possibly have deleted it from sent items.
It doesn't seem that I am going to be much help to the investigation process this time around. Is there any sort of advanced logging or tracking that I might be able to turn on in the event I get a request like this in the future? I know that if there is such a thing, that it would be a huge resource hog, but I am sure that the question will at least be asked by those in charge when I break the news to them that I can't provide much in this case. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
