Hello, here's my issue :
A few days ago, one of the employees at my company received a suspicious message seemingly a blackmail email.
Out of fear, he told me that he immediately deleted it. Is there any way that I could still get a trace of that sender (like his ip adress) even though the email that was sent is now deleted. Because it is not the first time that such thing happen and I suspect a few people I know of being the author of this scam.
Thank you.
Find the sender of a deleted message
-
- Outstanding Member
- Posts: 284
- Joined: Sat Sep 13, 2014 1:55 am
- ZCS/ZD Version: 8.8.15_FOSS Patch38
Re: Find the sender of a deleted message
Hi, take a look at zimbra logs (/var/log/zimbra.log) searching for the recipient and / or the sender of the email. You can also use zmmsgtrace utility: https://wiki.zimbra.com/wiki/CLI_zmmsgtrace
-
- Posts: 2
- Joined: Sun Sep 27, 2020 1:36 pm
Re: Find the sender of a deleted message
Thank you, but can it track deleted messages too ?7224jobe wrote:Hi, take a look at zimbra logs (/var/log/zimbra.log) searching for the recipient and / or the sender of the email. You can also use zmmsgtrace utility: https://wiki.zimbra.com/wiki/CLI_zmmsgtrace
-
- Outstanding Member
- Posts: 284
- Joined: Sat Sep 13, 2014 1:55 am
- ZCS/ZD Version: 8.8.15_FOSS Patch38
Re: Find the sender of a deleted message
Yes, that command line utility and zimbra logs keep track of every email message that goes through zimbra servers.Robert_price wrote:Thank you, but can it track deleted messages too ?7224jobe wrote:Hi, take a look at zimbra logs (/var/log/zimbra.log) searching for the recipient and / or the sender of the email. You can also use zmmsgtrace utility: https://wiki.zimbra.com/wiki/CLI_zmmsgtrace
-
- Elite member
- Posts: 1112
- Joined: Sat Sep 13, 2014 12:47 am
Re: Find the sender of a deleted message
Does the user's Class Of Service have Dumpster enabled? If so, it is likely the email is still in their Dumpster and could be recovered so you can see all headers.