Question RE Outlook...
 
Notifications
Clear all

Question RE Outlook Email Attachments

14 Posts
8 Users
0 Likes
1,984 Views
(@cults14)
Posts: 367
Reputable Member
 

Not sure of my ground here but if the Modified Date/Tme on the message was noticably different from the Received Date/Time, would that indicate a change of some kind?

May not be much to go on

Cheers

 
Posted : 22/08/2017 3:22 pm
gungora
(@gungora)
Posts: 33
Eminent Member
 

Not sure of my ground here but if the Modified Date/Tme on the message was noticably different from the Received Date/Time, would that indicate a change of some kind?

May not be much to go on

Cheers

When emails are produced in MSG format as per flytnx's question, internal creation and modification timestamps are typically updated to reflect the time when the messages were extracted from the mailbox. I can think of a couple of scenarios where your suggestion may be applicable

* You have a production where all MSGs have creation and modification timestamps very close to each other—reflecting the time when the production was exported—and a small subset of messages have later modification timestamps. This may indicate that some of these messages were modified after the fact, or perhaps the production was patched in some way by running a subsequent export.

* The files were originally maintained in MSG format long before production. For instance, if someone was saving important messages by dumping them to the file system as MSG files from Outlook. If those messages have internal modification dates when they should not, this can be a red flag.

 
Posted : 22/08/2017 6:08 pm
gungora
(@gungora)
Posts: 33
Eminent Member
 

Thanks for this!

I was able to recover the attachments after all. I made this into a blog post so you can better see what I was looking at.

https://www.metaspike.com/recovering-removed-email-attachments/

 
Posted : 01/09/2017 9:00 pm
(@bilbofids)
Posts: 5
Active Member
 

@gungora thanks for that great article.

I was wondering if it is possible to detect the reverse of this, that is if an attachment had been added to an email rather than removed, or if an attachment already present had been modified?

 
Posted : 27/01/2021 3:22 pm
Page 2 / 2
Share: