Thunderbird Attachm...
 
Notifications
Clear all

Thunderbird Attachment Metadata

2 Posts
2 Users
0 Likes
541 Views
(@swish)
Posts: 1
New Member
Topic starter
 

Howdy,

I'm analysing some files on Windows 10. There is a Thunderbird installation and I have a few e-mails in the 'sent' file. One of the e-mails has an attachment. Is there any way to view the timestamp information relevant to the attachment only rather than the e-mail? Autopsy can 'extract' out the file from the e-mail, but it blanks the time-stamp information. I've searched for the file on the computer itself, but it's not present and the free space has been overwritten.

Thanks,

Swish

 
Posted : 15/10/2017 1:25 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Howdy,

I'm analysing some files on Windows 10. There is a Thunderbird installation and I have a few e-mails in the 'sent' file. One of the e-mails has an attachment. Is there any way to view the timestamp information relevant to the attachment only rather than the e-mail? Autopsy can 'extract' out the file from the e-mail, but it blanks the time-stamp information. I've searched for the file on the computer itself, but it's not present and the free space has been overwritten.

Thanks,

Swish

I don't think a date/time field exist at all for attachments in the Thunderbird mail database.

Maybe the actual attachment is a file with some metadata (but of course this may at the most be a not-before-than, just like the date/time of the actual e-mail).

jaclaz

 
Posted : 15/10/2017 2:20 pm
Share: