Find the sender of a deleted message

[Robert_price]

Hello, here's my issue :
A few days ago, one of the employees at my company received a suspicious message seemingly a blackmail email.
Out of fear, he told me that he immediately deleted it. Is there any way that I could still get a trace of that sender (like his ip adress) even though the email that was sent is now deleted. Because it is not the first time that such thing happen and I suspect a few people I know of being the author of this scam.

Thank you.

[7224jobe]

Hi, take a look at zimbra logs (/var/log/zimbra.log) searching for the recipient and / or the sender of the email. You can also use zmmsgtrace utility: https://wiki.zimbra.com/wiki/CLI_zmmsgtrace

[Robert_price]

Hi, take a look at zimbra logs (/var/log/zimbra.log) searching for the recipient and / or the sender of the email. You can also use zmmsgtrace utility: https://wiki.zimbra.com/wiki/CLI_zmmsgtrace

Thank you, but can it track deleted messages too ?

[7224jobe]

Hi, take a look at zimbra logs (/var/log/zimbra.log) searching for the recipient and / or the sender of the email. You can also use zmmsgtrace utility: https://wiki.zimbra.com/wiki/CLI_zmmsgtrace

Thank you, but can it track deleted messages too ?

Yes, that command line utility and zimbra logs keep track of every email message that goes through zimbra servers.

[liverpoolfcfan]

Does the user's Class Of Service have Dumpster enabled? If so, it is likely the email is still in their Dumpster and could be recovered so you can see all headers.