Solved

Recover Outlook Email Excel attachment, Vista, Enterprise, Lockdown Environment

Posted on 2013-01-03
10
465 Views
Last Modified: 2013-01-09
User opened an Outlook email containing an Excel attachment.  User worked on several hours hitting the [Save] button at various times. User exited Outlook email without saving.  How do I go about recovering users Excel file.  Using Outlook 2007 in a Windows Vista Enterprise (lockdown) environment.

Opened CMD.EXE and typed in %temp% to determine temporary folder path.  It is C:\Users\UsersNetworkId\AppData\Local\Temp   I opened this folder.   Unsure if this is the right place and how to proceed.
0
Comment
Question by:bluesky929
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
10 Comments
 
LVL 8

Expert Comment

by:epohl
ID: 38742262
Might be worth checking any folders here. Of course changing "username" to the correct user. Some of those folders may be hidden as well. So either change hidden folders to display or paste into explorer.

C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook
0
 
LVL 14

Expert Comment

by:luconsta
ID: 38743697
The folder may not be visible even if the option "Show hidden files and folders" is enabled.
For an exaxct navigation to the Outlook's Temporary folder I prefer to look into registry for the OutlookSecureTempFolder registry key (see here more details on how to find it: Attachments remain in the Outlook Secure Temporary File folder when you exit Outlook 2010, Outlook 2007, or Outlook 2003) then copy and paste it into Windows Explorer.

The path should be mostly as epohl said plus some random characters at the end:

C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\TQSB5T37\
0
 

Author Comment

by:bluesky929
ID: 38743838
Hi all.  I do have the "Show hidden files and folders' enabled.  Even with the option enabled, I having trouble locating the temporary file folder.  With the corporate "lockdown" operating system, I do not have access to the registry.  I can follow the path down to "C:\Users\username\AppData\Local\Microsoft\Windows", but not futher.  See Screen Print.
Temp-File-Location.docx
0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 
LVL 14

Expert Comment

by:luconsta
ID: 38744055
In this case try on a command prompt the REG command (maybe this will work):

reg query "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security"


It should print also the OutlookSecureTempFolder key that could be "copy & paste" into Windows Explorer.
0
 

Author Comment

by:bluesky929
ID: 38752841
Hi lunconsta,
Good suggestion.  Performed the query, using cmd.exe, but it appears with the operating system lockdown, it won't allow querying either.  Attached screen print.
register-query.txt
0
 
LVL 14

Expert Comment

by:luconsta
ID: 38753780
To see the "Temporary Internet Files" folder you should also uncheck the "Hide protected operating system files" - even so you still not be able to "see" the "Content.Outlook" folder but you could navigate to it as ephol said by pasting the complete path into Windows Explorer.

To find also the last folder name from the OutlookSecureTempFolder you could do the following:

1. Open a command prompt
2. type the following command and press enter at the end of it(change the path with the right user name and also change the drive letter if you change the default profile path):
CD "C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook"
3. type also this command
DIR

Now you should see in the command window that special folder name and you can complete the full path to paste into the Windows Explorer and browse its contents.
0
 

Author Comment

by:bluesky929
ID: 38756069
Hi lunconsta,

Following your instructions, I was able to obtain the location of the "Temporary Internet File" folder and then to navigate to it by pasting into Windows Explorer.
 
Monitoring the file activity within the folder, it appears that when an attached document is opened through an email, that changes saved through the [SAVE] button on the document (child document) are temporary, unless permanently saved through the [SAVE] button on the parent document, which is the email.  If the user exits the email without saving, it appears there is nothing to 'recover' in the "Temporary Internet File" folder.

Please confirm, and I will close the question.
0
 
LVL 14

Accepted Solution

by:
luconsta earned 500 total points
ID: 38758028
Hi,

I am sorry I did not mention it earlier - that steps will get you to the folder where you might find the file from attachment but sometimes not depending on more conditions - some temp folders are emptied automatically by system, or programatically by scripts (in some enterprise environments) or depending on user actions.

One other thing I've missed - usually attachments opened should be read-only - at least this is happening with SP3 - I don't remember exactly but I think initially, without any service pack the attachment wasn't read-only and then it might happen that one could be edited (and saved) in that temp folder.

So your observations may be correct and you could not recover all the edited documents opened from attachments.
0
 

Author Closing Comment

by:bluesky929
ID: 38759018
Hi,  luconsta.

Your explanations have been very educational to me.  I can understand the number of conditions that can be involved, and you took the time to mentioned some of them.  

I appreciate your thorough explanations, and have learned much.  Your use of italics and  bold fonts at key points, are very helpful in understanding your responses.   Thank you for the time to make this learning available.
0
 
LVL 14

Expert Comment

by:luconsta
ID: 38761996
Thank you for awarded points and the fine words that shines my day. :)
0

Featured Post

To Patch or not to Patch? That is the question!

Don't get caught out like thousands of others around the world in the recent Ransomware Fiasco!
Discuss..
- Why it's not a good idea to wait before Patching
- Sensible approaches to Patching discussed
- Add your feedback, comments and suggestions

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

If you don't know how to downgrade, my instructions below should be helpful.
When you have clients or friends from around the world, it becomes a challenge to arrange a meeting or effectively manage your time. This is where Outlook's capability to show 2 time zones in one calendar comes in handy.
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question