Outlook Forensics
Almost forgot the basics. It's Exchange 2003 with Outlook 2003.
"Warren Guffey" wrote in message
...
I have a situation in which my boss wants to know if I can prove if someone
was actually viewing another person's mailbox. The user had rights to the
other person's mailbox but denies actually reading anything. Upon
inspection the mailbox in question was not in the folder list but I have
been given the task of proving or disproving that the user actually
accessed the mailbox. I have checked on local log files or dat files but
couldn't find anything to help. Isn't there a log in Exchange to find this
information, not just last login but a history of logins? Is there any
other software or service that would be able to show when a user may attach
or detach a mailbox? Any help or direction would be appreciated as I am
under some heavy pressure here to accomplish this task.
|