Recovering BCC (Blind Carbon Copy) information??? 1

[dannydanny]

Hi,

I was wondering whether if it is possible to recover data in the bcc field? For example I would like to know who else received an email via the bcc field. Is this data automatically stripped from an email after it is sent, so that no one can recover the data?

Thanks in advance.
Danny.

 

[pmonett]

Affirmative.

When sending a mail, the server checks the BCC field and creates a copy for each recipient listed, removing the list of other recipients.
That is the whole point of BCC functionality. You get it, but you cannot see who else got it. If the server sent the info but the client just chose to not display it, the whole thing would be a joke, don't you think ?

Pascal.

 

[rdannand]

I agree with pmonett/Pascal. It is better that way.

However, as an administrator, I've been called upon by our execs in the past to track messages in cases where someone is suspected of abusing their company-defined email priviledges. (Long story, don't go there.)

I can see that what I am about to tell could become an abused ability, spying on folks and such but we'll assume all intentions are good and on the up-and-up.

Anyway, assuming you are an R5 Notes Administrator, your logs should record a listing of all who received the message. Go to your Domino Administrator, choose the "Messaging" tab, then the sub-tab "Mail" and choose "Mail Routing Events" from the menu. Assuming you know the date and time of the message to one person, you should be able to find it in the logs and see if duplicates were sent to others.

 

[hbaecker]

Great tip!!! This could be very helpful.

 

[dannydanny]

Hi all,

Thanks for the info everyone.

For RDANNAND, if I could go into the logs, would I be able to read the subject of emails being sent? I notice that the logs refer to emails by a alphanumeric code.....I would also like to find out who received and sent what at a particular time and day..

How long do these logs go back? 1 week? 2 weeks?

Thanks again,
Danny

 

[pmonett]

Not the expert, but I know that the Log db is purged at an interval defined by the Administrator. So you have to ask what time frame has been set.
As for the subjects, the server does not record them. It is interested only in noting that msg n°xxxx was sent.
As rdannand noted, you need to have precise knowledge of the date and time of the message. As for snooping and Big Brother issues, I think that is a rather remote issue.
Just check you server log to see what I mean. Any important organization has dozens of mail pass through the server each second, meaning hundreds of lines that record mail numbers. Sorting out the fact that so-and-so received the same message at that time than somebody else is going to be a tedious, time-consuming process with a limited guarantee of reliability. And I do not know of any third-party products that do the job for you, although there might be.
Unless the server also tracks the size of the message. If that is true, then you might at least be able to single out only messages of a given size in the time frame. That would probably increase reliability, but only by a margin.
In any case, it is not simple.

Pascal.

 

[rdannand]

pmonett is right, the logs are purged periodically. Ours our set for a week, but we only have 400 users on this server. If, like our parent company, you have thousands of users, the purge settings may be reduced.

He's also correct that no subject line is displayed. I've seen two different setups for the logs, one just displays info naming a recipient, and the other displays sender, recipient, letter size, hop count and some other nuances but no subject line. I was not the administrator who established these settings so I cannot tell you how to change between them.

For a long time I was feeling it was pretty tedious to sort through the lists just like pmonett said, but eventually I realized that just like in a WORD document, I could go to EDIT--FIND NEXT and insert a name, message ID, or whatever else you have to go on. Then using the CNTRL + G, I was able to scan several days worth in a matter of a couple of minutes. You'll still have to enter/exit each log. I tried selecting all the logs in the list and scanning for my criteria, but that didn't work.

 

[woonjas]

enable message tracking on your mail server(s)

open the nab on the server, go to server-configurations view, edit the configuration document for your server and go to the smtp-routing tap, under advanced (if my memory's any good since I don't have access to a nab atm) you should be able to enable message tracking, configure who can use it, whether or not to include message subjects etc.

don't forget to restart the router/smtp task when you're done

from the administration client, select messaging, mail tracking, the rest should be self explanatory.

Woonjas
IRC: #notes on EFNet

 

[PhatBlerk]

Two things

1) You could be sneaky and modify your mailbox.ntf file and cripple the temple by automatically adding a hidden BCC recipient that point to a person / mail-in-db. The modified template could also modify the body of the e-mail to list all recipients before the it does its business and strips all the address out. Just remember, if you modify original templates they will get overwritten if you upgrade.

2) Upgrade to Domino 6 - the built in mail journaling is brilliant so anything smtp/notes mail passing thru any server configured with mail journaling enabled can archive all messages. It even allows you to create new file based on size/days etc so conviniently 650MB archive size to fit niocely on a CDROM.

There is of course legal routes you need to take in order to use this data against an enployee but this could be covered in the terms of employment contract.

Message tracking only gives you who-to and subject - not body text / attachments.

There are other solution but they would involve SMTP - I dont think there are other Domino based solutions.

--
Jaime