You can cause Microsoft Exchange Server to log an event when a user moves or copies objects from the private or public information store to another store, such as a Personal Folder.

When you implement logging, the following data is logged:

User name
Mailbox name
Size of item downloaded
Document type
Document identifier

Here is a sample entry:

   Event ID: 7102                                 Type: Information                                 Source: MSExchangeIS Private                                 Category: Download                                 Description:                                 User WinNT_Domain\User (mailbox                                 /o=Org /ou=Site /cn=Recipients /cn=Mailbox) downloaded                                  2127271 bytes from attachment                                  c7e20a0c4-9762-11d1-a487-00c04fc29f3e-b8a1
To implement logging, use Regedt32 to navigate to:

HKEY_LOCAL_ MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS

Double-click the MSExchangeIS key.

To log public folder downloads, select ParametersPublic.

To log private mailbox downloads, select ParametersPrivate.

On the Edit menu, Add Value name Log Downloads as a type REG_DWORD.

Set the data value per the following:

    To log downloads from      Data                                  Attachments only           1                                     Messages only              2                                     Attachments and messages   3                                     Folders only               4                                     Attachments and folders    5                                     Messages and folders       6                                     All                        7
NOTE: You may add Log Downloads to both ParametersPublic and ParametersPrivate.