Outlook Forensics

[Warren Guffey]

I have a situation in which my boss wants to know if I can prove if someone
was actually viewing another person's mailbox. The user had rights to the
other person's mailbox but denies actually reading anything. Upon inspection
the mailbox in question was not in the folder list but I have been given the
task of proving or disproving that the user actually accessed the mailbox. I
have checked on local log files or dat files but couldn't find anything to
help. Isn't there a log in Exchange to find this information, not just last
login but a history of logins? Is there any other software or service that
would be able to show when a user may attach or detach a mailbox? Any help
or direction would be appreciated as I am under some heavy pressure here to
accomplish this task.

 

[Warren Guffey]

Almost forgot the basics. It's Exchange 2003 with Outlook 2003.

 

[Warren Guffey]

Almost forgot the basics. It's Exchange 2003 with Outlook 2003.

 

[F. H. Muffman]

Almost forgot the basics. It's Exchange 2003 with Outlook 2003.

http://www.msexchange.org/tutorials...ess-Exchange-System-Manager-Event-Viewer.html

 

[Roady [MVP]]

You can enable Auditing for this on Exchange. Of course you need to
configure this beforehand and not afterwards; it won't be logged if auditing
isn't configured.