How to check the date and time an email was deleted?
Hi. We have a few interns at work and I think there's a troll. Just before Christmas, he deleted important emails and the whole team was hurt. We only got paid after Christmas. I found the emails in the folder: Trash (Thunderbird), but I don't know how to check when exactly they were deleted. If I had a day and an hour, we would have caught him on surveillance.
All Replies (6)
If the messages were the most recent deletions, i.e. additions to the Trash folder, you could check the date of the Trash mbox file in the profile folder to see the date and time of the latest modification. Otherwise you'd have to enlist the aid of the mail provider to possibly track the activity.
Matt powiedział
There is no audit trail of who did what when.
Tell me where I can find the audit trail.
sfhowes powiedział
If the messages were the most recent deletions, i.e. additions to the Trash folder, you could check the date of the Trash mbox file in the profile folder to see the date and time of the latest modification. Otherwise you'd have to enlist the aid of the mail provider to possibly track the activity.
You meant the directory: C:\Users\xyz\AppData\Roaming\Thunderbird\Profiles\xyz.default-release\ImapMail\serverxyz.nazwa.pl\INBOX.sbd
It contains the following files: Trash.msf, Trash ? The date of their last modification is "overwritten" by subsequent files that went to the trash, and in the content of these files there are no logs or trace of when changes were made. I think so! Maybe there's something hidden in the code? If you know what it is, I will be grateful for the hint.
Wojciech Magdziak vel Wierzbicki (WojTECH) said
Matt powiedział
There is no audit trail of who did what when.Tell me where I can find the audit trail.
You mail provider might have logs of what what changed and when. But it is not something that Thunderbird retains anywhere.
I've looked through most of the options and, apart from the support of the mail server service provider, who is the only one who has logs, I only have one idea (I don't know if he'll share them with me): 1. I only have two messages thrown into the trash after the one I care about the most. 2. I tested on another computer that when deleting an e-mail from inbox, it "virtually" immediately transfers its code to the trash file and overwrites it with a millisecond delay. 3. I will try to recover three overwritten files with a data recovery program and if, after reviewing them, I find the code of the e-mail I am looking for, I will check the original saving time and date of this file. 4. If I succeed, I will correlate it with the camera recordings and catch this nasty troll and terrorist mole :)
I will let you know what I managed to do in this case and which concept failed.
Ti ṣàtúnṣe nípa Wojciech Magdziak vel Wierzbicki (WojTECH)
You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.