I would like to identify an individual who forwarded a confidential message to a number of Internet correspondents. How can I do that?
Reports on e-mail traffic are based on events imported from Exchange message tracking files, where the only information that shows that a message may have been forwarded is its subject. It is - normally - tagged with 'Fwd:', 'Tr:', 'WG:' or any other similar abbreviation based on your own language.
The solution would be to use the Find Specific Messages report template, that you will find on the Templates > Mailbox Traffic menu.
- Period tab: Select your reporting period.
- Selection tab: Select all mailboxes in your organization.
- Correspondents tab: Select Address type as Recipient type, and then Some types: Internet domain, Like, * (= all Internet correspondents).
- Filter tab: Filter on messages whose subject line begins with Fwd: (or Tr:, or WG: etc. depending on the language).
You can add other criteria, for example [Subject] Is like Fwd* And [Subject] Is like *confidential* if you know that the subject line contains the character string 'confidential'.
- Content tab: Set the detail level to Message traffic summary by recipient and select Sent messages only.
- Presentation tab: Choose a title for your report and set the size unit in KB or MB.
- Output tab: Select the destination and format of your choice.