PDA

View Full Version : Microsoft Exchange - Printing an email Audit trail


MiniAndrew
13th January 2009, 12:08
I have asked a company to provide me with an Audit trail of an 'alleged' email they produced as a Witness Exhibit at a hearing which swung the case in the company's favour, an email which I am doubting the authenticity of. The said document they produced as a witness exhibit did not carry the audit trails one normally sees on an email and I have asked for a copy of the server audit trails to show 2 things.

1) the audit trails showing without question that the email was actually sent on the said date they allegedly sent it

2) the return of same email as it was incorrectly addressed and returned to their server as undelivered. - (they have admitted that.)


They have refused to supply on the grounds it's irrelevant and costly. So I need to know what's involved in printing it out please.


What do I wish to prove?

That this alleged email was in fact a 'Blue Petered' document, created in 'Word' and never actually sent at all (I made one up myself to prove my point). I know I can't prove it was created in Word, but I can prove from the server Audit trails that this was sent and returned undelivered..if I can obtain it.

Why do I want to prove this? -

Because I lost my application to Strike out their claim as a result of this 'conveniently found' email which was produced as an Exhibit and had a significant impact on the result and argument in court, despite they knowing it was returned undelivered and I had costs awarded against me by a Judge more interested in the smooth talking Barrister than my humble Litigant In Person stance, or an allegation I was making that a qualified solicitor might have 'manufactured' a witness exhibit.

So, What do I need to know? -

Could anyone kindly tell me what the exact process is for a company to run and produce this Audit Trail to prove this alleged emails' authenticity?, the likely costs to them of doing it? the ease in which it can be done?

All the alleged email had on it was the name of the Sender above the line at the top, and below the line: To: xxxxx at xxxxx. and Subject: xxxxxx no date or time, no email 'from' address

This was from a firm of in-house finance company solicitors using Microsoft Exchange.



Thank you.

computer storm
13th January 2009, 12:17
This is a hard one as most exchange servers have a built in message tracking system, it is not hard to run the message tracking on any exchange and only takes a while to run.

It all depends on how long they have set the retention policy to hold the mail tracking for, Most exchange servers only hold up to 30days worth of message logs but you can go back depending on how they do there backups.

But if you need any further information then call me any time and i can explain it better.

MiniAndrew
13th January 2009, 12:22
Thank you, will do, but for the benefit of others, one would imagine that a firm of solicitors who have cases going on some time, mine is a year and they pulled this email out recently, they'd be keeping back-up for some time longer than 30 days wouldn't they?

computer storm
13th January 2009, 12:26
Yes most firms have a month end backup and a year end backup so they can pull the data when they need it. And that is as well as a daily backup.

computer storm
13th January 2009, 13:10
1) the audit trails showing without question that the email was actually sent on the said date they allegedly sent it

2) the return of same email as it was incorrectly addressed and returned to their server as undelivered. - (they have admitted that.)

Sorry just noticed this, so if they have admitted that you did not receive the e-mail then how have you lost as it was addressed incorrectly then that means that you would not of ever got the mail anyway. As the tracking shows that it was set as undelivered.

Or did they resend to the correct address, if so ask for the tracking logs for the resend of the e-mail to the correct address.

MiniAndrew
13th January 2009, 13:27
What actually happened Darren is that I had been writing to this company over 7 months and they never answered any of 11 letters so I stuck in an Application to Strike the Claim out.. When they put their defence together for the Strike Out hearing they sent me the court bundle and in it was this email I knew I'd never received. They particularly itemised this email as a Witness Exhibit and there were only 3 exhibits in total as I had specifically applied for the Strike out because they never ever answered letters - this email showed they did.

I was unhappy with the style of this email because it didn't look anything like emails I ever printed out so I went about copying one out for myself in a Word document and put that to the court to demonstrate how easy it is to 'fabricate'. When I was sitting outside the court chatting to their Barrister before the hearing he said he could see why I had questioned this email as there was a letter missing from the address line of my email address.- I mean, with hundreds of pages of documents he spots this? -!! My mind was so focussed on so many things that when we were in the court and he was being listened to intensively by the femail judge, it just never ocurred to me to say that the email as an exhibit was worthless because he argued that I was questioning a qualified solicitors statement of truth. I just didn't know about the address line until then and began piecing this together after the hearing.

Now the main case has been escalated to a higher court, but I was lumbered with fairly sizeable costs for this dismissed Strike Out and that's why I need to prove one way or another that this solicitor did what he said he did by showing me the audit trail - sounds simple enough doesn't it?

computer storm
13th January 2009, 14:13
But as they have admitted that it came back as undeliverable then you did not get it, so i dont think they can show this as evidence not sure about that so would talk to someone with legal background.