If you have root permission on the machine, you don't even have to have
his permission if you know one keyword that would only be in that message.
You can cd to the user's directory, then do a grep on the word from his mail
file... if it comes up, bingo. If it doesn't....
Bill Ward
-----Original Message-----
From: Robert Burton [mailto:[EMAIL PROTECTED]]
Sent: Thursday, March 23, 2000 1:43 PM
To: Red Hat List
Cc: recipient.list.not.shown; @nswcphdn.navy.mil
Subject: RE: URGENT: Recovering Email
William,
My maillog doesn't indicate whether a message was a forward or reply or
whatever either. If you know the message ID, maybe grep for it in the
maillog? Not sure if that would work though. I don't think I know enough
about the maillog to figure this one out.
Maybe if you know what user it is, perhaps you can get to his/her email
program at lunchtime or afterhours and snoop around, could be still in
the outbox or Sent folder. If it's the company's computer I would think
the company has the right to look at it. Don't quote me there though, I'm
most definitely not a lawyer, so there may be other legal circumstances
to consider. Sorry couldn't be much more help then that.
-Bob Burton
IT Consultant
Literati Information Technology, LLC
>I've checked there and I've narrowed it down to one email. It would have
>been a forward, is there anyway to tell if the message is a forward of
>another message (maybe same message ID or something).
>
>William B. Herman
>
>
>-----Original Message-----
>From: Robert Burton [mailto:[EMAIL PROTECTED]]
>Sent: Thursday, March 23, 2000 12:43 PM
>To: Red Hat List
>Subject: Re: URGENT: Recovering Email
>
>
>>Is there anyway to see the contents of a message that was sent through our
>>SMTP server yesterday. We are investigating an information leak and need
>to
>>check if a certain email is the culprit.
>>
>
>William,
>
>You can check the /var/log/maillog (that's where it is on my system) and
>see from who and to where an email went, but unless your server is
>specifically setup to capture all email I don't think there's a way to
>see the contents fof the email. Someone please correct if me I'm wrong.
>
>
>-Bob Burton
>IT Consultant
>Literati Information Technology, LLC
--
To unsubscribe: mail [EMAIL PROTECTED] with "unsubscribe"
as the Subject.
--
To unsubscribe: mail [EMAIL PROTECTED] with "unsubscribe"
as the Subject.
