How are r2h**.tmp files created?

I am looking at a case and some evidence is located on a machine running WIN2K Pro. The evidence is contained in a temp file at c\Documents and settings\<UserName>\Local Settings\Temp. The name of the file is r2h**.tmp but has an RTF file header. There are a number of files, where the ** represents a hex number, in this folder.

Other tmp files with a name format of ~DF<hex number>.tmp are also in this folder. These are created when an htm\html file is opened by the user.

Testing I have done so far cannot replicate the creation of the RTF tmp files. Does anyone know how these files are created?

Thanks

JesterLadd