Attachment Attributes

[Jeff Benson]

I'm using Outlook 2007 with a .pst from an unknown version (probably 2003).

When I detach attachments (mostly .ppts but also .doc) from various emails,
I usually get the original metadata for the detached file (Date Modified,
Date Created) to be the original data.

But for many of the files I try to detach the metadata (Date Modified and
Date Created) are replaced with the date and time that I save the
detachments.

For example I just detached 2 files from 2 different email messages that
show up in the directory as:
Date Modified Date Created Date
Accessed
file1.ppt 1/25/2006 2:43 PM 9/1/2005 1:00 PM 1/17/2007 12:23 AM
file2.ppt 1/17/2006 12:24 AM 1/17/2006 12:24 AM 1/17/2006 12:24 AM

Even though file2.ppt is attached to a message from 3/28/2005 and was
created around then.

I can't figure out why this is happening only on some files. But I really
have to understand this, because I'm trying to forensically detach these
files and I have to preserve the original metadata.

Anyone have any idea what is going on? Or how to get the correct metadata
for file2.ppt?

 

[Pat Willener]

If I had that problem, I would compress these files into a ZIP file,
then attach this ZIP file to the message. This will keep the files' meta
data.

 

[Frank]

This isn't about files going forward. This is an .pst already created. I'm
trying to detach the files that were attached directly to the email messages.
Don't all attachments carry metadata with them?






- Show quoted text -

What date do you want to see? The e-mail time stamp?
In case you would like to see the date-timestamp of the file as it was
attached, that will be difficult, indeed zipping will be the only
garanteed solution.
In case you want to save the attachments having the e-mail date-
timestamp, MailToFile will help you: it archives the attachment
separately and gives the send date-time stamp to that files. The e-
mail (msg file) gets that date timestamp as well.
Frank