RE: Sent/Received User's emails Amendment at the S erver[Scanned]

  • From: Sarbjit Singh Gill <ssgill@xxxxxxxxxxxxxxxxxxxx>
  • To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
  • Date: Wed, 8 Sep 2004 16:38:12 +0800

I would have replied the same as Simon too (especially the 
genius part). 

The immediate thought was like changing the time on the 
exchange server and the DCs before the mail got modified and 
re-setting it back after the backup/modification.

 I am not sure if it works but it like bluffing every into 
going early by changing everybody watch, wall clock, PC 
times etc to show 5pm when in actual fact it is 3:00pm. You 
need to hijack the Radio Stations as well into giving you a 
false time etc.

/Gill


---- Original message ----
>Date: Wed, 8 Sep 2004 09:12:25 +0100
>From: "Simon Bound" <simon.bound@xxxxxxxxxxxxxxxxxxxx>  
>Subject: [exchangelist] RE: Sent/Received User's emails 
Amendment at the S     erver[Scanned]  
>To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
>
>   http://www.MSExchange.org/
>   I'd agree with Sarbjit.
>    
>   The user with the printed copy is on sticky ground
>   if it went say to court, and you can prove that when
>   you restored the mailbox on the day he left, the
>   mail was intact as it should be. You've got a e-mail
>   genius working for you if he/she should change an
>   e-mail on a backup tape or even create a mail and
>   get it onto the tape with corrects times and dates -
>   this applies even if someone was able to tamper with
>   a live mail without changing date and time stamps.
>   Get the guy to put his money where his mouth (or
>   printed e-mail) is !! Of course he could have the
>   correct e-mail and your company wish to change
>   what's on the tape but I'd hope not !!!!!
>    
>   Simon
>
>     -----Original Message-----
>     From: Hazem Mustafa
>     [mailto:hazemmustafa@xxxxxxxxxxx]
>     Sent: Wednesday, September 08, 2004 8:58 AM
>     To: [ExchangeList]
>     Subject: [exchangelist] RE: Sent/Received User's
>     emails Amendment at the S erver[Scanned]
>
>     http://www.MSExchange.org/
>     Gill.. you are right I know that, the point is the
>     end user is a big figure in the company (used to
>     be) if he insists that his copy of the old sent
>     email is different than the one we can get from
>     the server, we have to give a report to our senior
>     showing him that if it did happen then we can
>     trace it, the user from his side says that some
>     admin knows how to do things without leaving a
>     trace in IT, so we have to report to our senior
>     that if it could have been done then we could
>     follow it and trace it by several means...etc, but
>     we are not aware of away to access and modify a
>     user old sent email and save the changes
>     afterword, how should we do that and where should
>     we start the trace from ? is it true that there
>     are ways of doing it without leaving a trace?
>     meaning that all Modify date/time, or message
>     source or MAPI changes and how ? yes we have a
>     backup but he can always claims that the admin in
>     question is in charge of the backup too so he can
>     make the c! hanges at the backup tap too some
>     how like restore the email in question make  some
>     changes at it and saved it again, other words, we
>     want to know if a smart admin can do these changes
>     to an old user's sent email in a smart way that's
>     difficult to trace ? what are the methods ? I was
>     thinking of the message source code or the
>     modifying the MAPI , I did read about MAPI access
>     to Ms Outlook source message code but Idont know
>     how it works, never tried it, I will sent you that
>     article
>
>     Please advise
>
>     Sarbjit Singh Gill <ssgill@xxxxxxxxxxxxxxxxxxxx>
>     wrote:
>
>       http://www.MSExchange.org/
>
>       This is not the direct answer just yet, but how
>       do you
>       verify the printout the use has is a genuine
>       printout of the
>       sent email ? He could have typed it in a word
>       processor.
>
>       You could also restore a previous backup of the
>       exchange
>       mailbox store (maybe on the day he/she had sent
>       the mail)
>       and verify it's content.
>
>       More later..
>
>       ---- Original message ----
>       >Date: Wed, 8 Sep 2004 07:18:38 +0100 (BST)
>       >From: Hazem Mustafa <HAZEMMUSTAFA@xxxxxxxxxxx>
>       >Subject: [exchangelist] RE: Sent/Received
>       User's emails
>       Amendment at the S     erver
>       >To: "[ExchangeList]"
>       <EXCHANGELIST@xxxxxxxxxxxxx>
>       >
>       > http://www.MSExchange.org/
>       > I will put it in other way , the user left,
>       his mail
>       > of course was kept at the server, he holds a
>       print
>       > out of one of h! is old sent emails, the admin
>       of
>       > course can still access the user's mails and
>       mailbox
>       > although the user doesn't exist no more and
>       his
>       > machine has been formated, this is what I
>       meant when
>       > said the email was deleted, deleted from his
>       > workstation and the mail box can not be
>       accessed at
>       > one time by more that one person which is the
>       admin,
>       > so there wouldn't be any conflict of using
>       this
>       > mailbox and contradicting each other with
>       regards to
>       > the concept of a certain email, the user as
>       > according to his old printed email has got a
>       > different text than the email produced and
>       accessed
>       > by the admin from the user email box at the
>       server,
>       > the user accuses the admin to have tampered
>       with his
>       > old sent email, the admin denies, I want to
>       know is
>       > it possible and could an admin access a user
>       account
>       > , change his the content of one of the sent
>       emails
>       > keeping all the old! da! te and reference
>       without
>       > being traced ? how could it be done with no
>       trace ?
>       > and is it possible after editing a user sent
>       email
>       > to change it ? and would the changes be saved
>       or the
>       > text retained its original text once its
>       closed and
>       > it doesn't hold the changes
>       >
>       > Please advise
>       >
>       > Sarbjit Singh Gill
>       <SSGILL@xxxxxxxxxxxxxxxxxxxx>
>       > wrote:
>       >
>       > http://www.MSExchange.org/
>       >
>       > I am not sure how to answer this, but once the
>       > mail is
>       > deleted, how you going ot see it's last
>       modified
>       > date.
>       >
>       > Anyway the management policies do not modify
>       > content.
>       >
>       > Gill
>       >
>       > ---- Original message ----
>       > >Date: Wed, 8 Sep 2004 05:05:31 +0100 (BST)
>       > >From: Hazem Mustafa
>       <HAZEMMUSTAFA@xxxxxxxxxxx>
>       > >Subject: [exchangelist] RE: Sent/Received
>       User's
>       > emails
>       > Amendment at the S erver
>       > >To: "[ExchangeList]"
>       <EXCHANGELIST@xxxxxxxxxxxxx>
>       > >
>       > > http://www.MSExchange.org/
>       > > Thanks Gill
>       > > but what about the Modified date/Time ?
>       wouldn't
>       > > show that changes have been done to that
>       email
>       > > supposing that the policy is configured to
>       > delete
>       > > mails from the user's sent folder ?
>       > >
>       > > Sarbjit Singh Gill
>       <SSGILL@xxxxxxxxxxxxxxxxxxxx>
>       > > wrote:
>       > >
>       > > http://www.MSExchange.org/
>       > >
>       > > If the admin runs the Mailbox Management
>       > > Receipient Policy,
>       > > and the policy is configured to delete mails
>       > from
>       > > the user's
>       > > sent folder, then it would happen.
>       > >
>       > > > We have a user who complained that some
>       > > > information has been deleted from his sent
>       to
>       > a
>       > > > recipient email !! he is accusing the
>       admin,
>       > is
>       > > that
>       > > > technically possible to be done ?
>       > > >
>       > > >
>       > >
>       > > Sarbjit Singh Gill
>       > > ssgill@xxxxxxxxxxxxxxxxxxxx
>       > >
>       > >
>       >
>       -----------------------------------------------------
-
>       > > List Archives:
>       > > http://www.webelists.com/cgi/lyris.pl?
>       > enter=exchangelist
>       > > Exchange Newsletters:
>       > >
>       http://www.msexchange.org/pages/newsletter.asp
>       > > Exchange FAQ:
>       > >
>       >
>       http://www.msexchange.org/pages/larticle.asp?type=FAQ
>       > >
>       >
>       -----------------------------------------------------
-
>       <B!
>       > R>> Other Internet Software Marketing Sites:
>       > > World of ! Windows Networking:
>       > > http://www.windowsnetworking.com
>       > > Leading Network Software Directory:
>       > > http://www.serverfiles.com
>       > > No.1 ISA Server Resource Site:
>       > > http://www.isaserver.org
>       > > ! Windows Security Resource Site:
>       > > http://www.windowsecurity.com/
>       > > Network Security Library:
>       http://www.secinf.net/
>       > > Windows 2000/NT Fax Solutions:
>       > > http://www.ntfaxfaq.com
>       > >
>       >
>       -----------------------------------------------------
-
>       > > You are currently subscribed to this
>       > > MSEXchange.org Discussion List as:
>       > > hazemmustafa@xxxxxxxxxxx
>       > > To unsubscribe visit
>       > > http://www.webelists.com/cgi/lyris.pl?
>       > enter=exchangelist
>       > > Report abuse to listadmin@xxxxxxxxxxxxxx
>       > >
>       > >
>       ------------------------------------------------
>       > >
>       > > ALL-NEW Yahoo! Messenger - all new features
>       -
>       > even
>       > > more fun!
>       > >
>       >
>       -----------------------------------------------------
-
>       > > List Archives:
>       > >
>       > http://www.webelists.com/cgi/lyris.pl?
>       enter=exchangelist
>       > > Exchange Newsletters:
>       > >
>       http://www.msexchange.org/pages/newsletter.asp
>       > > Exchange FAQ:
>       > >
>       >
>       http://www.msexchange.org/pages/larticle.asp?type=FAQ
>       > >
>       >
>       -----------------------------------------------------
-
>       > > Other Internet Software Marketing Sites:
>       World
>       > of
>       > > Windows Networking:
>       > http://www.windowsnetworking.com
>       > > Leading Network Software Directory:
>       > > http://www.serverfiles.com No.1 ISA Server
>       > Resource
>       > > Site: http://www.isaserver.org Windows
>       Security
>       > > Resource Site:
>       http://www.windowsecurity.com/
>       > > Network Security Library:
>       http://www.secinf.net/
>       > > Windows 2000/NT Fax Solutions:
>       > > http://www.ntfaxfaq.com
>       > >
>       >
>       -----------------------------------------------------
-
>       > > You are currently subscribed to this
>       > MSEXchange.org
>       > > Discussion List as:
>       ssgill@xxxxxxxxxxxxxxxxxxxx
>       > To
>       > > unsubscribe visit
>       > >
>       > http://www.webelists.com/cgi/lyris.pl?
>       enter=exchangelist
>       > > Report abuse to listadmin@xxxxxxxxxxxxxx
>       >
>       > Sarbjit Singh Gill
>       > ssgill@xxxxxxxxxxxxxxxxxxxx
>       >
>       >
>       -----------------------------------------------------
-
>       > List Archives:
>       > http://www.webelists.com/cgi/lyris.pl?
>       enter=exchangelist
>       > Exchange Newsletters:
>       > http://www.msexchange.org/pages/newsletter.asp
>       > Exchange FAQ:
>       >
>       http://www.msexchange.org/pages/larticle.asp?type=FAQ
>       >
>       -----------------------------------------------------
-
>       > Other Internet Software Marketing Sites:
>       > World of Windows Networking:
>       > http://www.windowsnetworking.com
>       > Leading Network Software Directory:
>       > http://www.serverfiles.com
>       > No.1 ISA Server Resource Site:
>       > http://www.isaserver.org
>       > Windows Security Resource Site! :
>       > http://www.windowsecurity.com/
>       > Network Security Library:
>       http://www.secinf.net/
>       > Windows 2000/NT Fax Solutions:
>       > http://www.ntfaxfaq.com
>       >
>       -----------------------------------------------------
-
>       > You are currently subscribed to this
>       > MSEXchange.org Discussion List as:
>       > hazemmustafa@xxxxxxxxxxx
>       > To unsubscribe visit
>       > http://www.webelists.com/cgi/lyris.pl?
>       enter=exchangelist
>       > Report abuse to listadmin@xxxxxxxxxxxxxx
>       >
>       >
>       ------------------------------------------------
>       >
>       > ALL-NEW Yahoo! Messenger - all new features -
>       even
>       > more fun!
>       >
>       -----------------------------------------------------
-
>       > List Archives:
>       >
>       http://www.webelists.com/cgi/lyris.pl?
enter=exchangelist
>       > Exchange Newsletters:
>       > http://www.msexchange.org/pages/newsletter.asp
>       > Exchange FAQ:
>       >
>       http://www.msexchange.org/pages/larticle.asp?type=FAQ
>       >
>       -----------------------------------------------------
-
>       > Other Internet Software Marketing Sites: World
>       of
>       > Windows Networking:
>       http://www.windowsnetworking.com
>       > Leading Network Software Directory:
>       > http://www.serverfiles.com No.1 ISA Server
>       Resource
>       > Site: http://www.isaserver.org Windows
>       Security
>       > Resource Site: http://www.windowsecurity.com/
>       > Network Security Library:
>       http://www.secinf.net/
>       > Windows 2000/NT Fax Solutions:
>       > http://www.ntfaxfaq.com
>       >
>       -----------------------------------------------------
-
>       > You are currently subscribed to this
>       MSEXchange.org
>       > Discussion List as:
>       ssgill@xxxxxxxxxxxxxxxxxxxx To
>       > unsubscribe visit
>       >
>       http://www.webelists.com/cgi/lyris.pl?
enter=exchangelist
>       > Report abuse to listadmin@xxxxxxxxxxxxxx
>
>       Sarbjit Singh Gill
>       ssgill@xxxxxxxxxxxxxxxxxxxx
>
>       -----------------------------------------------------
-
>       List Archives:
>       http://www.webelists.com/cgi/lyris.pl?
enter=exchangelist
>       Exchange Newsletters:
>       http://www.msexchange.org/pages/newsletter.asp
>       Exchange FAQ:
>       http://www.msexchange.org/pages/larticle.asp?type=FAQ
>       -----------------------------------------------------
-
>       Other Internet Software Marketing Sites:
>       World of Windows Networking:
>       http://www.windowsnetworking.com
>       Leading Network Software Directory:
>       http://www.serverfiles.com
>       No.1 ISA Server Resource Site:
>       http://www.isaserver.org
>       Windows Security Resource Site:
>       http://www.windowsecurity.com/
>       Network Security Library: http://www.secinf.net/
>       Windows 2000/NT Fax Solutions:
>       http://www.ntfaxfaq.com
>       -----------------------------------------------------
-
>       You are currently subscribed to this
>       MSEXchange.org Discussion List as:
>       hazemmustafa@xxxxxxxxxxx
>       To unsubscribe visit
>       http://www.webelists.com/cgi/lyris.pl?
enter=exchangelist
>       Report abuse to listadmin@xxxxxxxxxxxxxx
>
>     ------------------------------------------------
>
>     ALL-NEW Yahoo! Messenger - all new features - even
>     more fun! 
>     ------------------------------------------------------
>     List Archives:
>     http://www.webelists.com/cgi/lyris.pl?
enter=exchangelist
>     Exchange Newsletters:
>     http://www.msexchange.org/pages/newsletter.asp
>     Exchange FAQ:
>     http://www.msexchange.org/pages/larticle.asp?type=FAQ
>     ------------------------------------------------------
>     Other Internet Software Marketing Sites: World of
>     Windows Networking:
>     http://www.windowsnetworking.com Leading Network
>     Software Directory: http://www.serverfiles.com
>     No.1 ISA Server Resource Site:
>     http://www.isaserver.org Windows Security Resource
>     Site: http://www.windowsecurity.com/ Network
>     Security Library: http://www.secinf.net/ Windows
>     2000/NT Fax Solutions: http://www.ntfaxfaq.com
>     ------------------------------------------------------
>     You are currently subscribed to this
>     MSEXchange.org Discussion List as:
>     simon.bound@xxxxxxxxxxxxxxxxxxxx To unsubscribe
>     visit
>     http://www.webelists.com/cgi/lyris.pl?
enter=exchangelist
>     Report abuse to listadmin@xxxxxxxxxxxxxx
>
>   ------------------------------------------------------
>   List Archives:
>   http://www.webelists.com/cgi/lyris.pl?enter=exchangelist
>   Exchange Newsletters:
>   http://www.msexchange.org/pages/newsletter.asp
>   Exchange FAQ:
>   http://www.msexchange.org/pages/larticle.asp?type=FAQ
>   ------------------------------------------------------
>   Other Internet Software Marketing Sites:
>   World of Windows Networking:
>   http://www.windowsnetworking.com
>   Leading Network Software Directory:
>   http://www.serverfiles.com
>   No.1 ISA Server Resource Site:
>   http://www.isaserver.org
>   Windows Security Resource Site:
>   http://www.windowsecurity.com/
>   Network Security Library: http://www.secinf.net/
>   Windows 2000/NT Fax Solutions:
>   http://www.ntfaxfaq.com
>   ------------------------------------------------------
>   You are currently subscribed to this MSEXchange.org
>   Discussion List as: ssgill@xxxxxxxxxxxxxxxxxxxx
>   To unsubscribe visit
>   http://www.webelists.com/cgi/lyris.pl?enter=exchangelist
>   Report abuse to listadmin@xxxxxxxxxxxxxx

Sarbjit Singh Gill
ssgill@xxxxxxxxxxxxxxxxxxxx


Other related posts: