EMail Chain of Custody Probe

I have a SENDER who sent an email (see attached) on 10/14 (according to what's displayed in her sent items box).  SENDER insists she sent the email on that date.  The RECIPIENT shows THAT email as SENT on 10/18 in the header on his machine.  Server Message Tracking shows only ONE of the 4 emails sent between the two for this subject on 10/20.  

SENDER suspects internal email problem.  No DELAY messages were received by the SENDER (As far as I know).

I need to get the forensics right on this one because this is an email toxic (no tolerance for error) environment.  How do I:

a) outrule an internal problem?
b) show that the email may have been added to the SENDERS Delayed email schedule
c) reconcile the differences displayed for the sent date on the SENDER/RECIPIENT'S Machines.

Footnotes: SENDER is an Exec Secretary who routinely uses the delayed email function. RECIPIENT is a part timer who's laptop is usually in sleep mode several times a week. No other staff (of 40) report similar issues. SENDER has had corrupted Outlook cache issues before...  No other staff (of 40) report similar issues.  No other staff has had (reported) anything similar. SENDERS display of the email in Sent Items
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

The headers on the recipients copy would show if it were delayed along the way..
Even if hopping through different timezones: It should still have say 6Mins after the hour the whole way on all of the timestamps: i.e. 12:06:10 +/-timezone.
Normally it should only take seconds to traverse the path to the mailbox.

So, did they receive these 4 emails sent back and forth? Or just one?
LTWadminAuthor Commented:
FDiskWizard: There's no header information in the SENDER or RECIPIENT'S email.  The two users are here locally - members of the same (single) domain and under the same roof...
Yes, realized after sending that this was all INTERNAL.
If user submited at 10am, and delayed until 11am it would not show in as submitted in message tracking until 11am...  The recipient's copy should show the SENT and Received timestamps.

You mentioned only 1 of 4 emails showed in tracking...
Do your message tracking logs go back more than a couple of days?

doubtful, but maybe your user has a bad address in contacts for this person? Or do your message logs go back sever
I had something similar not long ago. I had a bad email address on a contact. I sent the email, no errors, but he didn't get it. It didn't show in tracking because I was tracking the wrong address... :)
So, you may want to track on the sender's display name only for sent or received.

C++ 11 Fundamentals

This course will introduce you to C++ 11 and teach you about syntax fundamentals.

I did a couple of tests... the first two had a different SENT vs Received time (sent is shown when email is opened..) The 3rd test, I just submitted, let it sit in the Outboux, and let it deliver in 5 mins. The first two I think I had opened/edited delivery after they were sitting in the Outbox. The timestamps varied.

The 3rd had the exact same time stamp... but in Sent-Items shows close to 6mins before.

I just did another with < 2 min delay like the first two. it had different timestamps. It also went over the a.m. to PM (noon)
Odd/interesting stuff. Don't know if any of that helps, but throwing it out there.

OK, one more track to lead you down... based on the theory that maybe the emails were stuck in the Outbox. The image had a early a.m. timestamp.. Maybe just turned on PC/laptop?

Track emails from the sender around that time - see if say 5 emails went at about the same time. It's hard to type/send 5 emails per minute...

Any rules in her Outlook to auto-delay emails being sent?
LTWadminAuthor Commented:
FDiskWizard: Thanks for this feedback.  I did the email tracking for the entire month (and every way you might slice and dice) and only one email in the sequence (spanning from October 4th -20th) showed up - the one on the 20th.  This actually DOES support your theory that the SENDER may not have used the correct address on the 14th.  

Either way, the fact that you thought through trying to reproduce the problem - and can may be enough exoneration in and of itself.  In other words, there may be a time stamp bug...  
Oh, check this.... In Outlook using Field Chooser there is a field under Date & Time fields called "Defer Until"

That shows the Delayed time on the sender's side or recipient's side.... if the user submitted as "delay delivery" in Outlook. :)

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
LTWadminAuthor Commented:
FDiskWizard: Good one.  I'll have a look ASAP!
So, did that work out for you?
LTWadminAuthor Commented:
Thanks for your help - I don't think any one response hit the mark in this case but your responses were useful.  
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.