[ExchangeList] Re: How to check who has deleted email.

  • From: James Chong <jchong@xxxxxxxxxxxxxx>
  • To: "'exchangelist@xxxxxxxxxxxxx'" <exchangelist@xxxxxxxxxxxxx>
  • Date: Wed, 17 Dec 2008 09:18:59 -0500

If you didn’t move it from the dumpster; the PR_Last_modifiername may have revealed via mfcmapi. However; there is no item level auditing in general.


James Chong
Sr. Systems Engineer
Simplexity, LLC.

11130 Sunrise Valley Drive, Suite 300

Reston, VA 20191
O (703) 657-4612
C (703) 863-1483


From: exchangelist-bounce@xxxxxxxxxxxxx [mailto:exchangelist-bounce@xxxxxxxxxxxxx] On Behalf Of Amit Kapoor
Sent: Tuesday, December 16, 2008 10:32 PM
To: 'exchangelist@xxxxxxxxxxxxx'
Subject: [ExchangeList] How to check who has deleted email.
Importance: High




We have Exchange 2007. We have a mailbox on which few users have access. They have send on behalf and other access on this mailbox. Somehow one of the user has deleted email from that mailbox. We have recovered that email from Recover deleted items. But I want to know who has deleted this mail. These users access this mailbox by adding this mailbox with their own mailbox in outlook. Is there any way by which we can find the user id who has deleted that email.



Amit Kapoor


This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

Other related posts: