Link to home
Create AccountLog in
Avatar of t38
t38

asked on

Find out when an email in Outlook Deleted Items was deleted

Hi, There are emails in a former employees Deleted Items folder, I need to find when they were deleted -- can I do this?

Exchange 2003
ASKER CERTIFIED SOLUTION
Avatar of WebDevEM
WebDevEM
Flag of United States of America image

Link to home
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
See answer
Avatar of t38
t38

ASKER

Thanks but that doesn't seem to do it - I added the 'modified' field to deleted items  as suggested but that just tells me it was last modified on Saturday 16th and I know for certain it wasn't deleted then.  
I had hoped the exchange tracking tool might do it but obviously that's not interested in the email after it's delivered to the mailbox..
I did some more searching and so far it sounds like that's the closest option, though as you found it's not always accurate.  Some people insist it works, and others will show proof it doesn't, so I suspect it may vary depending on what else is happening with your environment.  (smartphone synchronizing, virus scans, etc... anything else that may update the email and the timestamp along with it.)  Some of the discussions I've found out there actually come out and say "can't be done".  If you have enough access to server logs and traffic (maybe firewall logs?) there must be some way of tracking it though.  

If this is important to find, maybe it would help to use the Request Attention link below your original question and have the question added to other topics such as Digital Forensics to see if they have any more input?

http://www.pcreview.co.uk/forums/outlook-2003-sort-deleted-items-deleted-date-time-t3663510.html

http://www.outlook-tips.net/tips/tip-183-sort-messages-by-deleted-date/

http://answers.microsoft.com/en-us/mac/forum/macoffice2011-macoutlook/using-outlook-2011-mac-how-do-i-sort-by-deleted/d660b3d4-9f9f-479c-b4a3-05b2b7c60727?msgId=d8cff40f-7d12-47cb-9ee5-d84dc5593132
Avatar of t38

ASKER

Result is not a reflection on the answer given as it appears to be the best option available but it doesn't do what I need.  Thanks for your input though.