Where is “You replied to this message on…” data stored in Outlook?

Question

I need to prove for a legal case where the "You replied to this message on" is stored and how to prove to the court that a message was replied to.

We're the defendant in a case and we requested the prosecutions e-mails in regards to this case. They supplied a consolidated PST with 3 different employee's e-mails. When going through the e-mails we found that some had the forwarded or replied message on the e-mail, but the replied message didn't exist meaning they deleted them.

We've taken screen shots and have done our best to make it clear as day to the judge, but a simplified explanation on how that data exists and why it proves they deleted e-mail is what I'm looking for.

Answer 1

Sorry, but Outlook's "You replied to / forwarded this message" notifier does NOT prove that the message was actually sent and thus does not prove beyond a shadow of a doubt (IMHO) that they actually deleted anything. In Outlook you can click Reply or Forward, modify the new message and close it without saving or sending it and Outlook will still tag the original message as replied to or forwarded.

You would need the message that was actually sent with the SMTP headers completely in tact at a MINIMUM to prove that the message was actually replied to. Mail relay logs wouldn't hurt either.

EDIT - I should add that this is as of Outlook 2007. I've not used Outlook 2010 yet. Maybe someone can confirm whether or not this is still the case in 2010.

Answer 2

If you have access to the original emails in Outlook, try getting the data from the message headers.

For instructions on viewing messsage headers in Outlook: http://email.about.com/od/outlooktips/qt/How_to_View_All_Message_Headers_in_Outlook.htm

Theres a specific value in some message headers that contains the "In-Reply-To" information.

Answer 3

You can try to use Microsoft's MFCMAPI tool in order to inspect all available message properties in the mentioned PSTs.