We operate Exchange 2007 and have a public folder for users to post messages. We have set the security of this folder such that only owners of postings can edit/delete items. Unfortuntely on occassion, private emails get mistakenly (or otherwise) dragged to this public folder, and we can only identify that either the sender or a recipient has done this, but we want to discover the actual culprit! My thoughts are that only the owner (i.e. the person who posted it there rather than the sender) can delete the message, so there must be an attribute of the message that details the owner. How can I reveal this attribute? Thanks for any assistance.

You might try something like Outlook Spy, which will many properties (e.g. PR_CREATOR_NAME or PR_LAST_MODIFIER_NAME), but I don't think there's anything as specific as an 'Owner'. But TBH, I think it must, in general, be the recipient that is doing this. Most people have their Inbox open all the time, and only occasionally look for something in their Sent Items. OTOH, if it's a mail-enabled PF, the email may mistakenly be sent there, rather than just dragged there.Mobile OWA For Smartphone www.leederbyshire.com email a@t leederbyshire d.0.t c.0.m

You might be able to use MFCMAPI to see the information needed or you could Lucid8's DigiScope http://www.lucid8.com/product/digiscope.asp with a free 30 day DEMO license to do what you want for free. DigiScope does is interesting utility because is does much more then this task you are looking to accomplish i.e. DigiScope allows you to open any Offline Exchange Database so the you can Browse, Search, View the actual email or properties of the email and Then you can Export Mailboxes, Folders, Individual items and Attachments to PST, MSG and XML or you can Recover items directly from any offline Exchange database into a Production Exchange Server on the fly without interrupting users & it even works cross Exchange Version i.e. you can open an offline 2003 database and recover data into a 2007 or 2010 production server You can also use DigiScope to Search, Browse, View, Export, Delete & Purge data from a Production Exchange Server and if you need to view items from the online server it does so forensically, i.e. nothing in the message is changed so if its shown as being unread it stays that way even though you have read it via DS. Specific to your issue you can use DigiScope to connect the the public folder, then right click on the message and select Properties as shown here This will present you with all the data about the message in question If you look at the "Creator" and "Changed by" fields you can see the person that moved this into the folder All the other information is preserved, i.e. sender, recipients etc NOTE: you cannot search through the properties detail information via DigiScope but you can scroll up and down to see the information. I am having them add a find function in next build but for now as a work around you can A: do a CTRL+A and then CTRL+C to copy the information B: Then paste that information into Excel and you can then do a CTRL + F to find the fields mentioned above or specific user informationTroy Werelius www.Lucid8.com Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline EDB's and Live Exchange Servers with Lucid8's DigiScope

You might try something like Outlook Spy, which will many properties (e.g. PR_CREATOR_NAME or PR_LAST_MODIFIER_NAME), but I don't think there's anything as specific as an 'Owner'. But TBH, I think it must, in general, be the recipient that is doing this. Most people have their Inbox open all the time, and only occasionally look for something in their Sent Items. OTOH, if it's a mail-enabled PF, the email may mistakenly be sent there, rather than just dragged there.Mobile OWA For Smartphone www.leederbyshire.com email a@t leederbyshire d.0.t c.0.m

You might be able to use MFCMAPI to see the information needed or you could Lucid8's DigiScope http://www.lucid8.com/product/digiscope.asp with a free 30 day DEMO license to do what you want for free. DigiScope does is interesting utility because is does much more then this task you are looking to accomplish i.e. DigiScope allows you to open any Offline Exchange Database so the you can Browse, Search, View the actual email or properties of the email and Then you can Export Mailboxes, Folders, Individual items and Attachments to PST, MSG and XML or you can Recover items directly from any offline Exchange database into a Production Exchange Server on the fly without interrupting users & it even works cross Exchange Version i.e. you can open an offline 2003 database and recover data into a 2007 or 2010 production server You can also use DigiScope to Search, Browse, View, Export, Delete & Purge data from a Production Exchange Server and if you need to view items from the online server it does so forensically, i.e. nothing in the message is changed so if its shown as being unread it stays that way even though you have read it via DS. Specific to your issue you can use DigiScope to connect the the public folder, then right click on the message and select Properties as shown here This will present you with all the data about the message in question If you look at the "Creator" and "Changed by" fields you can see the person that moved this into the folder All the other information is preserved, i.e. sender, recipients etc NOTE: you cannot search through the properties detail information via DigiScope but you can scroll up and down to see the information. I am having them add a find function in next build but for now as a work around you can A: do a CTRL+A and then CTRL+C to copy the information B: Then paste that information into Excel and you can then do a CTRL + F to find the fields mentioned above or specific user informationTroy Werelius www.Lucid8.com Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline EDB's and Live Exchange Servers with Lucid8's DigiScope