Email Forensics (motorcycle unrelated)

[midwilshire]

I know there are a lot of computer genius types on here, so here goes....

Does anyone know of an easy and inexpensive way to view the metadata of Outlook email messages? A client sent me an email that bounced back and forth between him and a third party. The timing of each bounce is important, and we believe this third party changed the dates and times in the body of the email to make it look like she didn't get it on time because of some technical error. So, I want to see the metadata in hopes that it shows the actual date and time of each "reply."

Any suggestions would be appreciated.

[LodiHal]

Check these guys out, good info. You can also get a trial version, but you need an activation code from them.

http://www.windeveloper.com/OLView/olview_guide.htm

Happy hunting! :D

[zippy_gg]

You also want to take a look at the full header of the messages. There will be time stamps along with IP addresses.

[andy]

I know there are a lot of computer genius types on here, so here goes....

Does anyone know of an easy and inexpensive way to view the metadata of Outlook email messages? A client sent me an email that bounced back and forth between him and a third party. The timing of each bounce is important, and we believe this third party changed the dates and times in the body of the email to make it look like she didn't get it on time because of some technical error. So, I want to see the metadata in hopes that it shows the actual date and time of each "reply."

Any suggestions would be appreciated.

Here is your problem:

If you used Outlook on both ends (which I suspect) then the headers of each reply will be limited to what you see. There is no extra information in there any more.

If you want to see all the information you seem to be interested in you WILL have to use the email server logs. That is something only the email server operator is able to modify. the problem you now have is to pursuade two server operators (your end and the other end) or if there where three parties involved then three server operators to co-operate with you and hand over the logs for this user for a certain amount of time. Doable but time intensive, and at least somewhat problematic in terms of privacy laws without the OK of every party involved.

Feel free to talk to me offline, or call and we can discuss this.

[gulfxray]

Here is your problem:

If you used Outlook on both ends (which I suspect) then the headers of each reply will be limited to what you see. There is no extra information in there any more.

Andy, just curious why opening the email message in Outlook, selecting View, then Options wouldn't show all the header information?

Not questioning you, just trying to expand my very limited knowledge in this area...

Thanks

[andy]

Andy, just curious why opening the email message in Outlook, selecting View, then Options wouldn't show all the header information?

Not questioning you, just trying to expand my very limited knowledge in this area...

Thanks

;-) Good Q: And in all reality it shows you are thinking. Reason being is that the header of the email that Outlook can show you is ONLY the header of the LAST incarnation of this specific email, meaning the last email that was received.

Since I read (unless I read that wrong) the problem here is with a whole email thread of back and forth, the last one does not really help because it does NOT show when the previous ones were received. *IF* OTOH all the previous emails are available and accessible then one can recreate the whole chain of events. If not all the previous ones are available then the server logs are the best bet (in fact they always are, since even headers can be faked)

[midwilshire]

Thanks Andy! That is exactly the problem I'm running into. With Outlook and even moreso with the program LodiHal references, I'm able to view the metadata of the most recent email, but nothing in its lineage.

I was hoping there would be an easy way to catch this person with her hand in the cookie jar. The case on which I'm working doesn't warrant the expense of subpoenaing the email server logs, but it is nice to know that is the correct approach when the need does arise.


:thumb: