evidence of viewed emails via outlook 2010.

pma111
pma111 used Ask the Experts™
on
would there be any forensics artefacts on a windows 7/10 machine, specific to any emails viewed via outlook 2010, e.g. subject titles or the such like. I wondered if jump lists may have entries for outlook, and then each specific email be classed as a 'file'? Or any other locations where outlook 2010 forensics artefacts may reside. I want to prove ideally the subject titles of any recently opened emails. I am also looking from the exchange side as well, but client side would help also in this instance.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Exec Consultant
Distinguished Expert 2018
Commented:
May want to take a look at this
....the search-mailbox with log level full is what I use to find out whether or not it's been read but was just wondering if there was any way to find a timestamp for when it was read (without relying on read receipt that is)....

MESSAGE WAS OPENED

Each and every message has a series of fields within it and one of them is the "Read" field.  The default value of this field depends upon;

A. the location of the sender, i.e. internal or external user
B. If internal the identity of the sender  themselves can change the value as well
 
Here is what my testing revealed using Exchange 2010 SP1 RU2 and Outlook 2010

* Sending myself a message made the default value of the "Read" field "48" however the moment I opened that message the value changes to "1073".  I tested this 20 different times and the results were the same.

If a message was sent by anyone else within my firm to myself the Read value is by default "16" , however the moment I open any of these messages the value always changes to "1041"....
https://social.technet.microsoft.com/Forums/azure/en-US/524e2812-f209-485e-966e-5e44a3cc1785/find-date-and-time-of-when-email-was-read?forum=exchange2010

The tool illustrated is DigiScope
https://www.lucid8.com/DigiScope/HowItWorks
Michael B. SmithManaging Consultant

Commented:
There is no way to certify when or by whom a message is first read. You can read the current status. That's all.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial