Hello Reader,
In the past two posts we've discussed how analysis of attachment access has changed and what artifacts are left behind in the USN Journal when an attachment is closed while Outlook is still running on Windows 7. Today let's talk about another scenario, what happens when an attachment is still open when Outlook closes/the system reboots/etc.. Any condition that makes Outlook not an active process to clean up the attachment opened.
We talked in the last post about how Outlook will delete files after they have been closed, but not what happens when Outlook is no longer running when they are closed. In this case the second temporary extracted file will be deleted while the primary will remain. In this post we will show what this looks like.
First let's look at the MFT, here is what TzWorks Gena tool see's within the MFT as recoverable files using ntfswalk:
There are the two attachments that remain that I sent myself, previewed and then opened. You can see here that the two files are still active and will remain so now until such time as the Content.Outlook folder is emptied, typically from a disk clean up process looking for temporary files to reover. Of the two secondary copies made (the files that end with (2) ), only the pdf version is still recoverable as a deleted record within the MFT.
Within the USN Journal though we have a different story as seen below:
Click on the image to see it full size and view the records.
From accessing two attachments twice, first as a preview within the message and then opening it within the external program associated, we have 35 USN entries!
The first creations have to do with my preview of the data, after the preview is completed the data is deleted! We can see that this file was deleted and then re-extracted between the preview and open with external application by comparing the first creation in the USN Journal with the creation date within the MFT of the file still remaining.
Here is the first creation in the USN relating to the preview:
Here is the second creation is the USN relating to the access with an external associated program:
Here is the MFT Filename attribute dates for the file that remains from the second access:
As you can see the MFT entry relates to the second creation, meaning that Outlook 2007 even cleans up after every preview. Luckily for us the preview still calls out to an external program, the previewer or that file type, so we will still get a USN entry for those accesses as well.
Next week I will show what happens when I open up the attachment again forcing the counter to increase for the filename and what other recoverable artifacts there might be with this artifact.
I'm uploading this test image now for your own verification and I'll update this blog when the link is ready.
Update: Here is the test image for download!
In the past two posts we've discussed how analysis of attachment access has changed and what artifacts are left behind in the USN Journal when an attachment is closed while Outlook is still running on Windows 7. Today let's talk about another scenario, what happens when an attachment is still open when Outlook closes/the system reboots/etc.. Any condition that makes Outlook not an active process to clean up the attachment opened.
We talked in the last post about how Outlook will delete files after they have been closed, but not what happens when Outlook is no longer running when they are closed. In this case the second temporary extracted file will be deleted while the primary will remain. In this post we will show what this looks like.
First let's look at the MFT, here is what TzWorks Gena tool see's within the MFT as recoverable files using ntfswalk:
There are the two attachments that remain that I sent myself, previewed and then opened. You can see here that the two files are still active and will remain so now until such time as the Content.Outlook folder is emptied, typically from a disk clean up process looking for temporary files to reover. Of the two secondary copies made (the files that end with (2) ), only the pdf version is still recoverable as a deleted record within the MFT.
Within the USN Journal though we have a different story as seen below:
Click on the image to see it full size and view the records.
From accessing two attachments twice, first as a preview within the message and then opening it within the external program associated, we have 35 USN entries!
The first creations have to do with my preview of the data, after the preview is completed the data is deleted! We can see that this file was deleted and then re-extracted between the preview and open with external application by comparing the first creation in the USN Journal with the creation date within the MFT of the file still remaining.
Here is the first creation in the USN relating to the preview:
Here is the second creation is the USN relating to the access with an external associated program:
Here is the MFT Filename attribute dates for the file that remains from the second access:
As you can see the MFT entry relates to the second creation, meaning that Outlook 2007 even cleans up after every preview. Luckily for us the preview still calls out to an external program, the previewer or that file type, so we will still get a USN entry for those accesses as well.
Next week I will show what happens when I open up the attachment again forcing the counter to increase for the filename and what other recoverable artifacts there might be with this artifact.
I'm uploading this test image now for your own verification and I'll update this blog when the link is ready.
Update: Here is the test image for download!
