Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


Recover Outlook Email Excel attachment, Vista, Enterprise, Lockdown Environment

Posted on 2013-01-03
Medium Priority
Last Modified: 2013-01-09
User opened an Outlook email containing an Excel attachment.  User worked on several hours hitting the [Save] button at various times. User exited Outlook email without saving.  How do I go about recovering users Excel file.  Using Outlook 2007 in a Windows Vista Enterprise (lockdown) environment.

Opened CMD.EXE and typed in %temp% to determine temporary folder path.  It is C:\Users\UsersNetworkId\AppData\Local\Temp   I opened this folder.   Unsure if this is the right place and how to proceed.
Question by:bluesky929
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4

Expert Comment

ID: 38742262
Might be worth checking any folders here. Of course changing "username" to the correct user. Some of those folders may be hidden as well. So either change hidden folders to display or paste into explorer.

C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook
LVL 14

Expert Comment

ID: 38743697
The folder may not be visible even if the option "Show hidden files and folders" is enabled.
For an exaxct navigation to the Outlook's Temporary folder I prefer to look into registry for the OutlookSecureTempFolder registry key (see here more details on how to find it: Attachments remain in the Outlook Secure Temporary File folder when you exit Outlook 2010, Outlook 2007, or Outlook 2003) then copy and paste it into Windows Explorer.

The path should be mostly as epohl said plus some random characters at the end:

C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\TQSB5T37\

Author Comment

ID: 38743838
Hi all.  I do have the "Show hidden files and folders' enabled.  Even with the option enabled, I having trouble locating the temporary file folder.  With the corporate "lockdown" operating system, I do not have access to the registry.  I can follow the path down to "C:\Users\username\AppData\Local\Microsoft\Windows", but not futher.  See Screen Print.
Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.

LVL 14

Expert Comment

ID: 38744055
In this case try on a command prompt the REG command (maybe this will work):

reg query "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security"

It should print also the OutlookSecureTempFolder key that could be "copy & paste" into Windows Explorer.

Author Comment

ID: 38752841
Hi lunconsta,
Good suggestion.  Performed the query, using cmd.exe, but it appears with the operating system lockdown, it won't allow querying either.  Attached screen print.
LVL 14

Expert Comment

ID: 38753780
To see the "Temporary Internet Files" folder you should also uncheck the "Hide protected operating system files" - even so you still not be able to "see" the "Content.Outlook" folder but you could navigate to it as ephol said by pasting the complete path into Windows Explorer.

To find also the last folder name from the OutlookSecureTempFolder you could do the following:

1. Open a command prompt
2. type the following command and press enter at the end of it(change the path with the right user name and also change the drive letter if you change the default profile path):
CD "C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook"
3. type also this command

Now you should see in the command window that special folder name and you can complete the full path to paste into the Windows Explorer and browse its contents.

Author Comment

ID: 38756069
Hi lunconsta,

Following your instructions, I was able to obtain the location of the "Temporary Internet File" folder and then to navigate to it by pasting into Windows Explorer.
Monitoring the file activity within the folder, it appears that when an attached document is opened through an email, that changes saved through the [SAVE] button on the document (child document) are temporary, unless permanently saved through the [SAVE] button on the parent document, which is the email.  If the user exits the email without saving, it appears there is nothing to 'recover' in the "Temporary Internet File" folder.

Please confirm, and I will close the question.
LVL 14

Accepted Solution

luconsta earned 2000 total points
ID: 38758028

I am sorry I did not mention it earlier - that steps will get you to the folder where you might find the file from attachment but sometimes not depending on more conditions - some temp folders are emptied automatically by system, or programatically by scripts (in some enterprise environments) or depending on user actions.

One other thing I've missed - usually attachments opened should be read-only - at least this is happening with SP3 - I don't remember exactly but I think initially, without any service pack the attachment wasn't read-only and then it might happen that one could be edited (and saved) in that temp folder.

So your observations may be correct and you could not recover all the edited documents opened from attachments.

Author Closing Comment

ID: 38759018
Hi,  luconsta.

Your explanations have been very educational to me.  I can understand the number of conditions that can be involved, and you took the time to mentioned some of them.  

I appreciate your thorough explanations, and have learned much.  Your use of italics and  bold fonts at key points, are very helpful in understanding your responses.   Thank you for the time to make this learning available.
LVL 14

Expert Comment

ID: 38761996
Thank you for awarded points and the fine words that shines my day. :)

Featured Post

Veeam Task Manager for Hyper-V

Task Manager for Hyper-V provides critical information that allows you to monitor Hyper-V performance by displaying real-time views of CPU and memory at the individual VM-level, so you can quickly identify which VMs are using host resources.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you have clients or friends from around the world, it becomes a challenge to arrange a meeting or effectively manage your time. This is where Outlook's capability to show 2 time zones in one calendar comes in handy.
This article describes how to import an Outlook PST file to Office 365 using a third party product to avoid Microsoft's Azure command line tool, saving you time.
This Experts Exchange video Micro Tutorial shows how to tell Microsoft Office that a word is NOT spelled correctly. Microsoft Office has a built-in, main dictionary that is shared by Office apps, including Excel, Outlook, PowerPoint, and Word. When …
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question