Howdy,
I'm analysing some files on Windows 10. There is a Thunderbird installation and I have a few e-mails in the 'sent' file. One of the e-mails has an attachment. Is there any way to view the timestamp information relevant to the attachment only rather than the e-mail? Autopsy can 'extract' out the file from the e-mail, but it blanks the time-stamp information. I've searched for the file on the computer itself, but it's not present and the free space has been overwritten.
Thanks,
Swish
Howdy,
I'm analysing some files on Windows 10. There is a Thunderbird installation and I have a few e-mails in the 'sent' file. One of the e-mails has an attachment. Is there any way to view the timestamp information relevant to the attachment only rather than the e-mail? Autopsy can 'extract' out the file from the e-mail, but it blanks the time-stamp information. I've searched for the file on the computer itself, but it's not present and the free space has been overwritten.
Thanks,
Swish
I don't think a date/time field exist at all for attachments in the Thunderbird mail database.
Maybe the actual attachment is a file with some metadata (but of course this may at the most be a not-before-than, just like the date/time of the actual e-mail).
jaclaz