Recover Outlook Email Excel attachment, Vista, Enterprise, Lockdown Environment

Posted on 2013-01-03
Last Modified: 2013-01-09
User opened an Outlook email containing an Excel attachment.  User worked on several hours hitting the [Save] button at various times. User exited Outlook email without saving.  How do I go about recovering users Excel file.  Using Outlook 2007 in a Windows Vista Enterprise (lockdown) environment.

Opened CMD.EXE and typed in %temp% to determine temporary folder path.  It is C:\Users\UsersNetworkId\AppData\Local\Temp   I opened this folder.   Unsure if this is the right place and how to proceed.
Question by:bluesky929
  • 5
  • 4

Expert Comment

ID: 38742262
Might be worth checking any folders here. Of course changing "username" to the correct user. Some of those folders may be hidden as well. So either change hidden folders to display or paste into explorer.

C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook
LVL 14

Expert Comment

ID: 38743697
The folder may not be visible even if the option "Show hidden files and folders" is enabled.
For an exaxct navigation to the Outlook's Temporary folder I prefer to look into registry for the OutlookSecureTempFolder registry key (see here more details on how to find it: Attachments remain in the Outlook Secure Temporary File folder when you exit Outlook 2010, Outlook 2007, or Outlook 2003) then copy and paste it into Windows Explorer.

The path should be mostly as epohl said plus some random characters at the end:

C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\TQSB5T37\

Author Comment

ID: 38743838
Hi all.  I do have the "Show hidden files and folders' enabled.  Even with the option enabled, I having trouble locating the temporary file folder.  With the corporate "lockdown" operating system, I do not have access to the registry.  I can follow the path down to "C:\Users\username\AppData\Local\Microsoft\Windows", but not futher.  See Screen Print.
LVL 14

Expert Comment

ID: 38744055
In this case try on a command prompt the REG command (maybe this will work):

reg query "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security"

It should print also the OutlookSecureTempFolder key that could be "copy & paste" into Windows Explorer.

Author Comment

ID: 38752841
Hi lunconsta,
Good suggestion.  Performed the query, using cmd.exe, but it appears with the operating system lockdown, it won't allow querying either.  Attached screen print.
Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

LVL 14

Expert Comment

ID: 38753780
To see the "Temporary Internet Files" folder you should also uncheck the "Hide protected operating system files" - even so you still not be able to "see" the "Content.Outlook" folder but you could navigate to it as ephol said by pasting the complete path into Windows Explorer.

To find also the last folder name from the OutlookSecureTempFolder you could do the following:

1. Open a command prompt
2. type the following command and press enter at the end of it(change the path with the right user name and also change the drive letter if you change the default profile path):
CD "C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook"
3. type also this command

Now you should see in the command window that special folder name and you can complete the full path to paste into the Windows Explorer and browse its contents.

Author Comment

ID: 38756069
Hi lunconsta,

Following your instructions, I was able to obtain the location of the "Temporary Internet File" folder and then to navigate to it by pasting into Windows Explorer.
Monitoring the file activity within the folder, it appears that when an attached document is opened through an email, that changes saved through the [SAVE] button on the document (child document) are temporary, unless permanently saved through the [SAVE] button on the parent document, which is the email.  If the user exits the email without saving, it appears there is nothing to 'recover' in the "Temporary Internet File" folder.

Please confirm, and I will close the question.
LVL 14

Accepted Solution

luconsta earned 500 total points
ID: 38758028

I am sorry I did not mention it earlier - that steps will get you to the folder where you might find the file from attachment but sometimes not depending on more conditions - some temp folders are emptied automatically by system, or programatically by scripts (in some enterprise environments) or depending on user actions.

One other thing I've missed - usually attachments opened should be read-only - at least this is happening with SP3 - I don't remember exactly but I think initially, without any service pack the attachment wasn't read-only and then it might happen that one could be edited (and saved) in that temp folder.

So your observations may be correct and you could not recover all the edited documents opened from attachments.

Author Closing Comment

ID: 38759018
Hi,  luconsta.

Your explanations have been very educational to me.  I can understand the number of conditions that can be involved, and you took the time to mentioned some of them.  

I appreciate your thorough explanations, and have learned much.  Your use of italics and  bold fonts at key points, are very helpful in understanding your responses.   Thank you for the time to make this learning available.
LVL 14

Expert Comment

ID: 38761996
Thank you for awarded points and the fine words that shines my day. :)

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Set OWA language and time zone in Exchange for individuals, all users or per database.
Following basic email etiquette rules will help you write a professional email and achieve a good, lasting impression with your contacts.
Get people started with the process of using Access VBA to control Outlook using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Microsoft Outlook. Using automation, an Access applic…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now