You can create an audit of user access to the MailStore database including what messages MailStore users have searched for and viewed. This information is recorded into the Windows Event Application log.
An example of one of these logs in the Event viewer would look like the following…
Event Type: Information
Event Source: MailStore Server Auditing
Event Category: None
Event ID: 0
A complete message, its message body or an attachment has been retrieved.
IdentityUserAgent: MailStore Client 220.127.116.1173
This log shows that user ‘fred’ on PC with an IP of 10.0.0.23 has viewed the message with ID ‘30165’ which exists in filegroup id ’45’ at 09:09:03
Unfortunatly this information does not show what that message contains but you can find this out by typing a search in the format (filegroupID:MessageID) in the mailstore Quick search field within the MailStore client. For example..
Next click Search and the contents of that message will be shown