Determining the true time stamp on an email

I need to identify in Windows Exchange 2003 when an external email was actually sent.  The time stamp that the receiver has on the email that was sent to her is for Wednesday, June 11, 2008 6:12 AM.  The time stamp that the sender shows from her sent email is Tuesday, June 10, 2008 4:06 PM.  My question is this how can I check within Exchange, to see when that message was sent?  Is there a way to check this?
usts-pwAsked:
Who is Participating?
 
wtstaddCommented:
You can look at the header information, it will have the time stamps that are true.
0
 
usts-pwAuthor Commented:
I have looked at this.  What I am concerned about is that the sender sent herself a forwarded email and then took that timestamp information and changed it, then sent that to her boss.  I am also going to log onto her machine and check her sent items in hope that she has not deleted that.  I was really trying to see if there was some auditing in Exchange that shows all of the emails in there true unaltered states that I could look.  Make sense?
0
 
wtstaddCommented:
You can look at the SMTP Logs in \Windows\System32\LogFiles\SMTPSVC

You might be able to get enough information from the e-mail to find it in those logs.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.