Hi I work for a legal Firm and we are in a tricky situation. One of our staff was involved with discussions with an external body about a year ago. Now, there is some disagreement about what the outcome was. The external user has forwarded a mail chain between our user (John) and the external user. John only has vague recollections of this can be sure whether he said what is written in the mail chain or not. Unfortunately, he has deleted the item from his mailbox. I know when a mail is forwarded, the content can be changed. But i. Is there anyway to find out if the forwarded mail has been altered? ii. If we asked for the forwarded mail, but as as MSG file as an attachment, could it have been ameneded that way? We are running Exchange 2007 SP2 with Outlook 2007 clients

1. I take it there's no backup that you have taken which would have the original email. If you have the restore. 2. It would be difficult to determine if the msg was altered and by whom, date/time etc...more importantly the content.Sukh

If you do not have the original email, then your answer to #1 is no, #2 is a "I dont think so".

Thanks... As regards question 2, an email saved as an MSG and then forwarded could not be altered we are saying? We do use Journaling, but the user wasn't in the correct group for journaling at the time.

It would be difficult but can be done, but this cannot be guaranteed, for a legal case this, would probably wouldn't stand, hence why jounaling would.Sukh

Hi, From your description, you can try to check the journaling. And do you have any update? ThanksPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.