REviewing some emails that were located on a PC that has been connected to Microsoft Exchange. I have found a couple emails with attachments with a date stamp of for example of 1000am, when doing a timeline analysis of the drive there are about 20 other emails with attachments that are for the same time period. The MACTimes (NTFS)suggest AC for 8 of them, just C for the other 12. Yes I know what MAC is)
My thoughts are someone could have connected into OWA and retrieved these messages; once the computer connected back to exchange it updated the times?
The emails still reside in the directory but the concern was since the mactimes were updated several months back that someone may have accessed file attachments? No other trace on PC other than the Intial creation of document. File sizes still match from creation until last accessed time.
Directory showing last accessed time
C\Users\<user name>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content Outlook
Any ideas.
No one else ran across this?
Part of the problem might be understanding your question.
You say that you found e-mails on a local hard drive of a computer that was connected to Exchange. You note that you have 20 other e-mails with attachments for the same time period. You also say that "The MACTimes (NTFS) suggest AC for 8 of them, just C for the other 12". What do you mean by suggest? Then you bring up Exchange updating times. Updating times where?
Let's start with the most basic question, what version of Exchange? I'll assume you are dealing with Windows Vista, right?
Next, are you seeing multiple e-mails with the same created time, same accessed time or both? What file format are these e-mails? Also note that if connected to OWA, you are connected to an Exchange server. Not necessarily through Outlook, however.