Forensic Question

  • Thread starter Thread starter Guffey, Warren
  • Start date Start date
G

Guffey, Warren

I have been given the task of proving a possibilty and am under some serious
pressure from my employer.

Here is the scenario: we will use the identities of PersonA and PersonB. At
one time PersonA was given access rights to PersonB's mailbox because
PersonB worked for them and PersonA had a reason to monitor. Time passed on
and it was forgotten to remove PersonA's rights from PersonB's mailbox after
PersonB moved into another position. It is now believed that PersonA may
have continued to monitor PersonB's mailbox without PersonB's knowledge. Is
it possible to go back and determine if PersonA was truly accessing
PersonB's mailbox from their computer? I have logged on under PersonA's
account and do not see PersonB's mailbox in the folder list but PersonA very
likely had the ability to remove it. Any help would be greatly appreciated,
I have a lot riding on this.
 
Guffey said:
I have been given the task of proving a possibilty and am under some
serious pressure from my employer.

Here is the scenario: we will use the identities of PersonA and PersonB.
At one time PersonA was given access rights to PersonB's mailbox because
PersonB worked for them and PersonA had a reason to monitor. Time passed
on and it was forgotten to remove PersonA's rights from PersonB's mailbox
after PersonB moved into another position. It is now believed that PersonA
may have continued to monitor PersonB's mailbox without PersonB's
knowledge. Is it possible to go back and determine if PersonA was truly
accessing PersonB's mailbox from their computer? I have logged on under
PersonA's account and do not see PersonB's mailbox in the folder list but
PersonA very likely had the ability to remove it. Any help would be
greatly appreciated, I have a lot riding on this.
Click to expand...


Did you see the responses to your original post?

If not, unless Auditing was turned on before the fact, you won't likely be
able to prove anything, but, you'll also want to read
http://www.msexchange.org/tutorials...ess-Exchange-System-Manager-Event-Viewer.html.
 
Back
Top