I believe that a colleague of mine has somehow faked that he sent a message in Outlook (2003.) We work for a huge global company using Outlook on global enterprise.

Anyway, was on conference call, boss pinned colleague down who claimed that he
had sent an email to our group. After call boss sends to all of us the supposed email that colleague sent. It was inside of another "forward" message and looked odd but did have "sent" and date/time. I checked properties and it said "Received " prior to "Sent" Nobody on the email subject (a group of about 12) received the email. Some of us think he faked it. Boss doesn't understand technology enough (nor do I) and accepts the message just got "lost" somehow - but it was just 2 weeks ago. I've worked for this company for 10 years and NEVER had one message missing like this - let alone an important one.

I KNOW the guy faked it, just don't know how. It appears like it was sent. Of course, no recipient got it AND the guy says he now deleted it and no longer exists. (pure BS)

He did something by forwarding and altering ...

How can I prove it? HELP. Thanks!

Yes, it would be possible to fake that e-mail (it's essentially what spammers do), but to prove it would be a little harder. You might be able to get some information if you had the full headers from the mail, but even that probably won't tell you that much. If you had the mail logs from your company's mail server, you could see if the e-mail was delivered to everyone in your group, but mail logs are sometimes aren't kept for that long (2 weeks) due to the amount of mail that can go through a mail server.

Adrian

Many thanks for the reply. As it happens, spoke to our IT dept's "messaging Team" head today - showed him a copy. He thinks it is bogus as well (looks very authentic, but email has no "Message ID" either - NONE! He has never seen a message look like this. Anyway, they can check logs and will have them do this. Will keep you posted.

Anyone let me know if you have ideas how done. The message looks genuine but when you go to Properties - there is no Message ID. I checked (literally !!) 200 other messages - of course, all have ID.

Want to nail this person as the "bogus" message was used to make rest of the team look bad.