Temp files within &...
 
Notifications
Clear all

Temp files within "content.word" folder - interesting stuff

3 Posts
2 Users
0 Likes
2,008 Views
(@pbeardmore)
Posts: 289
Reputable Member
Topic starter
 

We have an interesting case where an important piece of text has been found within a
"~WRS (####).tmp" file. These files seem to be created by Outlook and not cleared out when Outlook is not closed properly. They seem to contain fragments of text from emails viewed during that session. We don't have access to the original emails so it makes the temp file all the more important. Anyone done any research on these? From searching the web, these files seem to be of concern re those protecting their privacy etc but I cant find much from a data retrieval/forensics perspective.

 
Posted : 12/08/2014 3:35 pm
PaulSanderson
(@paulsanderson)
Posts: 651
Honorable Member
 

IIRC ~WRS files are scratch files and are essentially swapped out memory from within outlook/word etc. As such they are only relevant to the application while it is running and the data within only useful during that instance.

Happy to be corrected though.

 
Posted : 12/08/2014 3:51 pm
(@pbeardmore)
Posts: 289
Reputable Member
Topic starter
 

Yes, thanks, Paul always quick to reply -)
all makes sense, cant stop playing with Outlook to see how it behaves, for example, if you have an email in the preview pane when you open Outlook and then Outlook is not closed properly, a temp file is created containing some of the email previewed but not all. The temp file that is of interest in our case contains fragments from multiple emails and explaining this to the court is going to be a challenge. Especially when the date of the original email is important. It would be my lucky day if anyone had created a tool to parse the data within these scratch files but I'm guessing its just too messy in terms of how the data is stored within these files.

 
Posted : 12/08/2014 5:16 pm
Share: