Find the sender of a deleted message

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
Robert_price
Posts: 2
Joined: Sun Sep 27, 2020 1:36 pm

Find the sender of a deleted message

Postby Robert_price » Sun Sep 27, 2020 2:15 pm

Hello, here's my issue :
A few days ago, one of the employees at my company received a suspicious message seemingly a blackmail email.
Out of fear, he told me that he immediately deleted it. Is there any way that I could still get a trace of that sender (like his ip adress) even though the email that was sent is now deleted. Because it is not the first time that such thing happen and I suspect a few people I know of being the author of this scam.

Thank you.


7224jobe
Advanced member
Advanced member
Posts: 190
Joined: Sat Sep 13, 2014 1:55 am
ZCS/ZD Version: 8.8.15_GA_3869.RHEL7_64 Patch4

Re: Find the sender of a deleted message

Postby 7224jobe » Mon Sep 28, 2020 7:53 am

Hi, take a look at zimbra logs (/var/log/zimbra.log) searching for the recipient and / or the sender of the email. You can also use zmmsgtrace utility: https://wiki.zimbra.com/wiki/CLI_zmmsgtrace
Robert_price
Posts: 2
Joined: Sun Sep 27, 2020 1:36 pm

Re: Find the sender of a deleted message

Postby Robert_price » Mon Sep 28, 2020 4:24 pm

7224jobe wrote:Hi, take a look at zimbra logs (/var/log/zimbra.log) searching for the recipient and / or the sender of the email. You can also use zmmsgtrace utility: https://wiki.zimbra.com/wiki/CLI_zmmsgtrace


Thank you, but can it track deleted messages too ?
7224jobe
Advanced member
Advanced member
Posts: 190
Joined: Sat Sep 13, 2014 1:55 am
ZCS/ZD Version: 8.8.15_GA_3869.RHEL7_64 Patch4

Re: Find the sender of a deleted message

Postby 7224jobe » Tue Sep 29, 2020 7:34 am

Robert_price wrote:
7224jobe wrote:Hi, take a look at zimbra logs (/var/log/zimbra.log) searching for the recipient and / or the sender of the email. You can also use zmmsgtrace utility: https://wiki.zimbra.com/wiki/CLI_zmmsgtrace


Thank you, but can it track deleted messages too ?


Yes, that command line utility and zimbra logs keep track of every email message that goes through zimbra servers.
liverpoolfcfan
Outstanding Member
Outstanding Member
Posts: 943
Joined: Sat Sep 13, 2014 12:47 am

Re: Find the sender of a deleted message

Postby liverpoolfcfan » Mon Oct 05, 2020 10:25 am

Does the user's Class Of Service have Dumpster enabled? If so, it is likely the email is still in their Dumpster and could be recovered so you can see all headers.

Return to “Administrators”

Who is online

Users browsing this forum: Majestic-12 [Bot] and 15 guests