Not a big outlook user, we use Notes firm wide but have some legacy MS Oulttok users so I need some assistance please.
Here is the situation….
Fella sends an email (Outlook) to boss (Lotus Notes) with an Excel spreadsheet attached. Boss opens spreadsheet and notices some data in a cell that really should not be there. Boss opens and incident report and I get called.
I get a copy of the fellas .pst file and a copy of the boss's notes mail file. I look in the boss's mail file, locate the email and open the attachment and there it is, the data of concern. All good here.
Next, I open the fellas Outlook .pst file, locate the email, open the attachment and Huh!!, no data in the cell !!
So, I compare the attachments from each email. The MD5 is different as now expected, so I look at the META data natively (right click >> properties >> summary) and discover there is one difference between the Date Created, Date Last Saved, and Last Printed. The Date Last Saved from the fella is 12 Days after the email was sent to the Boss!!
EnCase also shows the attachment as "Enrty Modified" as the same later date.
So, my question is this to all you Outlook users, because I have tried this in notes an it does not work. Can you go into your "Sent" items in your .pst file and modify an attachment from a sent email and then have that same attachment save with these changes?
When Outlook opens attachments from a PST file it will normally extract it a temp folder in the users profile and open in the associated program as read-only.
So, my question is this to all you Outlook users, because I have tried this in notes an it does not work. Can you go into your "Sent" items in your .pst file and modify an attachment from a sent email and then have that same attachment save with these changes?
Yes you can do that and it will save an updated version of the file inside of the e-mail. However, as someone posted, when you open a file from an attachment in Outlook, the file is actually placed under the Temp folder for the user's profile and is openned from there. It is possible you can find an earlier version of the file there.
Another option is to look at the backup tapes prior to the date that the file in the Outlook user's mailbox was changed. If you backup your e-mail system, you may find the original version of the file in the person's mailbox.