It's time-stamped on the iMAPIprop, but you will have to use EWS or a MAPI application to read that (such as the MAPI Editor).
ALSO - it's not conclusive and should not be used forensically. For example, a user can have "message preview" open, but have it set to NOT mark a message as read. That's #1. Also, a user can read a message, mark it as unread. That's #2. And later the user can mark the message as read again (by reading it). That's #3. Because of these reasons, it should be considered indicative - not conclusive. There MAY BE something you can do with mailbox auditing. But I haven't looked at it in detail. It may be worth a look on your part. From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Bonnie Pohlschneider Sent: Thursday, November 7, 2013 3:43 PM To: 'Exchange@lists.myITforum.com' Subject: [Exchange] Determine when an email was marked read Is it possible to get a time stamp of when an email is marked read without using read receipts? I looked at turning on Read Tracking but that only shows that it was read... not when it was read. Running Exchange 2010 and Outlook 2010. Thanks in advance! Bonnie Pohlschneider Network Administrator, CRSI Want to contact our support team? Our group can now be reached by emailing us at supp...@crsi-oh.com<mailto:supp...@crsi-oh.com>. ________________________________ Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.
