Exchange 2013 cu4
there was this Outlook email sent exactly Sep 2014. a new email was sent Sep 2015 to the same recipient with the same contents but different sender (sender in 2014 was the manager; sender in 2015 was the secretary).
the question arises because the contents are the same and the secretary said she didn't send it.
now, i checked the properties of both emails (2014 email was sent via Exchange 2010; 2015 email was sent via Exchange 2013), and the newer email have a shorter header like so:
From: "Elmer Fudd" <Elmer@ACME.com> To: Daffy Duck <Daffy@ACME.com> CC: "Bugs Bunny" <Bugs@ACME.com> Subject: =?windows-1256?B?48/t5uTtySDH4c7h7ebt?= Thread-Topic: =?windows-1256?B?48/t5uTtySDH4c7h7ebt?= Thread-Index: AdDrvw0yekKka2gTT0eF+dsUbwxBtw== Date: Thu, 10 Sep 2015 12:01:33 +0000 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_7767657067666675727178796580696676767676667367777471777_" MIME-Version: 1.0
is it short because Exchange 2013 sent it? the Exchange 2010 one (which was sent Sep 2014) have a longer header like so:
From: Marvin The Martian <Marvin@ACME.com> To: Daffy Duck <Daffy@ACME.com> Subject: =?windows-1256?B?Rlc6IOPP7ebk7ckgx+Ha4+3hIMfhzuHt5u0gIMjN3dHH4cjH2OQg?= Thread-Topic: =?windows-1256?B?48/t5uTtySDH4drj7eEgx+HO4e3m7SAgyM3d0cfhyMfY5CA=?= Thread-Index: AQHOOQ/Gfod+hSviZEqM9qEOax6zqJjgVyzAgAFLnoCAADP/UIAABauAgAAHSaCACY5EgIC7Fe6wgAFWlpCADLVHoP///3sQgAB60aCAAq0sAIAEbOfAgAHdDwCAADhkUIAAI4owgC1y2JCAHVlPMIAit1SQgAAIk+CAAd/doIABpvQggAefxKCAIkTuUIATBH9QgBqbE5CAMk8VoIAFRbeAgCats0CAbWTWgIAAxCqwgIRkU6CAAABU0IAACK8QgAKtFQCAKm6r4IAAe8UggA3TZfCAABUYMA== Importance: high X-Priority: 1 Date: Wed, 24 Sep 2014 10:30:31 +0000 Message-ID: <B99B45589E39EF4AB56464047B8B63E3803B7E40@MB02.ACME.com> References: <1631327C1AFA1541B1825269556D15F05688FAC6@MB01.ACME.com><361636E27A40C1479E5C26181B2ED7635834BF1A@MB02.ACME.com><1631327C1AFA1541B1825269556D15F059510CBB@MB01.ACME.com><7102D35B1F6A2D4098DF86AEDC10A7E8679AA7EE@MB02.ACME.com><1631327C1AFA1541B1825269556D15F064934593@MB01.ACME.com><C51BE330F57E24408627DB1C6FD1AC2F5CD44DA0@MB01.ACME.com><1631327C1AFA1541B1825269556D15F07996763C@MB01.ACME.com><C51BE330F57E24408627DB1C6FD1AC2F74B0663F@MB02.ACME.com><7102D35B1F6A2D4098DF86AEDC10A7E8801F6F73@MB02.ACME.com><C51BE330F57E24408627DB1C6FD1AC2F74B92988@MB02.ACME.com><7102D35B1F6A2D4098DF86AEDC10A7E8801F7750@MB02.ACME.com> In-Reply-To: <7102D35B1F6A2D4098DF86AEDC10A7E8801F7750@MB02.ACME.com> Content-Language: en-US X-MS-Has-Attach: yes X-Message-Flag: Follow up Reply-By: Wed, 24 Sep 2014 13:00:00 +0000 X-MS-TNEF-Correlator: Content-Type: multipart/related; boundary="_004_B99B45589E39EF4AB56464047B8B63E3803B7E40MB02ALJOM_"; type="multipart/alternative" MIME-Version: 1.0
is there a way to find who or where the 2015 email came from?