[surplusgifts]

Hello Gurus,

I have a situation. Some co-worker has changed his email clock and sent an old email making false and dangerous allegations.

I have checked - unfortunately, once you change your email/comp clock, the delivery date changes. Also, the file>properties tab shows the changed date with no record of any date changes.

Question: Can the comp clock date changes be tracked somewhere in the harddisk or somewhere in the memory, or corporate email server? If this can be tracked, what if this was perpetrated by a professional IT guy, will such a pro be able to completely erase all clock change trails?

Rather urgent...

Many tx

[midders]

The relevant time information should be stored in the message headers of the email. In Thunderbird, you can access this information buy View->Headers->All. Alternatively view the source of the email to display the plain-text headers at the top. This information will be accurate, unless the individual involved has administrator access to the mail servers involved in the sending of the message, in which case he could have changed the time there as well.

Slainte

midders

[surplusgifts]

hey midders!
tx for this. however, i experimented with my outlook express by changing the clock, and message header time was changed too in sync. no trail sir. so, an administrator can completely control and alter the email server records (regardless of software/hardware)?

[midders]

You can only change the local "sent time"; this doesn't change the relay times recorded by the sending and receiving servers (and any others in the email path). If these times are not recorded directly in the email header, then you can get them from the email server logs, by requesting this information from the relevant system administrators and providing details of the message header.

[surplusgifts]

tks midders. and the administrator - can basically change the data too?

[VistaRookie]

Originally Posted by surplusgifts

tks midders. and the administrator - can basically change the data too?

You said it was a "co-worker" now you changed it to administrator?

To answer your original question...

Question: Can the comp clock date changes be tracked somewhere in the harddisk or somewhere in the memory, or corporate email server? If this can be tracked, what if this was perpetrated by a professional IT guy, will such a pro be able to completely erase all clock change trails?

If the entire email was spoofed and someone was good enough, then the
answer is there is no record. However, I seriously doubt someone is
that good.

[throoper]

This may be a stupid question, but how do you know it's an "Old" E-mail?
Even stupider question, why does the date matter in the first place?
It would seem the information in the message is the issue, and not when it was created or sent.

[TerryNet]

To add to what midders has said ...

You look at the headers of the received email. In particular look at the "Received:" entries--they will have the date and time from the various servers that handled the mail. Read those entries from the bottom up; the top one will be the recipient's email server.

If you are talking about intra-company email this may not be of value.

[surplusgifts]

tks vm to all.
this was important. a few notes to exchange with the gurus:

a co-worker, can also be an IT chap who is administrator

content is important, date is sometime even more crucial, like when did such an email containing a supposedly copied invention first got transmitted as proof that the sender was the original idea creator.

u gurus r alright!

[VistaRookie]

Good luck with your predicament.

[surplusgifts]

Hi VistaR, midders, terryn, and all techguy gurus,

sorry need more help.

lets say there is this devious SOB, who is very senior and decided to fabricate an email on his MS Outlook, backdated (by resetting his comp/laptop clock), packed with lies.

and being so senior, he can also practically order the IT admin to do anything.

i understand all Outlook files are dbased in the server. question i hv is: when this fabricated email is backdated at the comp, will it simply be inserted at the server logs datestamped as per the source comp clock, OR
does the server have its own clock to log the time the fabricated email file was created? and IF the server clock exists, can the administrator modify the log file creation time??

pls advise asap? this is serious. many tx all

[surplusgifts]

sorry: clarify, these are all locally transmitted emails. tx

[surplusgifts]

intracompany.

[VistaRookie]

Truly don't know the answers to all your questions.

Might be time to see a lawyer and find out if any laws
(civil rights?) have been broken. Then law enforcement
forensics can investigate.

It is certainly beyond the scope of this forum.

[surplusgifts]

tx vistar. yeah, think that is where its headed.

seems that there are basically 2 scenarios:
i) if the email hopped around a few servers say from interstate, then u'd hv a problem altering all the email logs, because likely some of the intermediate servers are externally owned.

ii) if the email was sent at the office, then no sweat for the administrator to fix the logs.

wld that be a good ballpark assessment?