E-mail trail logs


I have a unique situation where i am trying to find some log information for an e-mail that was forwarded from a user's mailbox. The problem is that the e-mail shows forwarded and time of forward, but has been deleted from the sent items.

Is there a way to trace who it was forwarded to?

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Is this exchange or outlook? You need to provide more info.

If you have Exchange, then you could refer the Message Tracking in Exchange System Manager and check to whom the user had forwarded to.
damehtaAuthor Commented:
Sorry, exchange 2003 and the message in question was forwarded more then 24 hours back.
Do you have Deleted Items Retention set up?
If so, you could recover the message, even if it was hard deleted from the sent items.
To do that, you need to make a small registry change on the client, as described in: http://support.microsoft.com/kb/246153/en-us

If you have tracking logs enabled, you could also use message tracking. There is an excellent tool available that helps you with reading the tracking logs. http://www.advsoft.info/en/products/maildetective/
The trial version is already extremely useful for finding as much information as is available.

Hope this helps.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
The first question has to be whether message tracking was enabled? If it wasn't then there is very little you can do. Deleted item recovery or a backup might show you who the message was forwarded to, but if the user is savvy enough to clear everything before the backups run, then your options are limited.

Message tracking has to be enabled before the event, not after.

damehtaAuthor Commented:
Thanks for the information, the Deleted Item recovery was off (enabled now) and the message tracking as well.

I was able to locate some information from the logs about the particular message as the user was an OWA user.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.