Preserve metadata in Outlook emails

What metadata fields do they want to preserve?

I would think for legal case, probably all?

> I would think for legal case, probably all?

Maybe, but probably not. The following Properties of the Outlook MailItem object are, arguably, its metadata:

Actions
AlternateRecipientAllowed
Application
Attachments
AutoForwarded
AutoResolvedWinner
BCC
BillingInformation
Body
BodyFormat
Categories
CC
Class
Companies
Conflicts
ConversationID
ConversationIndex
ConversationTopic
CreationTime
DeferredDeliveryTime
DeleteAfterSubmit
DownloadState
EntryID
ExpiryTime
FlagRequest
FormDescription
GetInspector
HTMLBody
Importance
InternetCodepage
IsConflict
IsMarkedAsTask
ItemProperties
LastModificationTime
MarkForDownload
MessageClass
Mileage
NoAging
OriginatorDeliveryReportRequested
OutlookInternalVersion
OutlookVersion
Parent
Permission
PermissionService
PermissionTemplateGuid
PropertyAccessor
ReadReceiptRequested
ReceivedByEntryID
ReceivedByName
ReceivedOnBehalfOfEntryID
ReceivedOnBehalfOfName
ReceivedTime
RecipientReassignmentProhibited
Recipients
ReminderOverrideDefault
ReminderPlaySound
ReminderSet
ReminderSoundFile
ReminderTime
RemoteStatus
ReplyRecipientNames
ReplyRecipients
RetentionExpirationDate
RetentionPolicyName
RTFBody
Saved
SaveSentMessageFolder
Sender
SenderEmailAddress
SenderEmailType
SenderName
SendUsingAccount
Sensitivity
Sent
SentOn
SentOnBehalfOfName
Session
Size
Subject
Submitted
TaskCompletedDate
TaskDueDate
TaskStartDate
TaskSubject
To
ToDoTaskOrdinal
UnRead
UserProperties
VotingOptions
VotingResponse

[Source: Outlook VBA reference - copied here under "Fair Use"]

My guess is that they're looking for a subset of that. Regards, Joe

Okay, how do i preserve/share that with them? give them the emiails in .msg format?

> how do i preserve/share that with them?

Write a program that calls the Outlook Component Object Model (COM) interface to retrieve the Properties that they want (likely a subset of all the Properties).

> give them the emails in .msg format?

Not if they asked for TIFF.

I have 200 + emails, how can i convert to TIFF i guess then?

> I have 200 + emails, how can i convert to TIFF i guess then?

Before you spend more time and/or money on this, I suggest asking the auditors exactly what they want...they can be very fussy folks...and rightfully so! For example:

Do they want the body of the emails as TIFF files?

Do they want the attachments? If so, in their native file format or converted to TIFF?

Which of the metadata fields do they want?

Do they want those metadata fields in TIFF? If not, what format?

In any case, off the top of my head, I can see using a program that calls Outlook COM to convert all the email bodies and/or metadata fields to plain text files (see the SaveAsType documentation) and then feeding those text files to a program that converts them to multi-page TIFF files. The attachments are a whole other can of worms. Regards, Joe

>>> "Hi, working on a legal case, and they want to preserve the metadata from Outlook emails, but they also want the files in TIFF format" <<<

Who is "they"?
If this is a legal case wouldn't it be better for forensic data experts to do the retrieval of the required files and preserve the chain of custody without potentially altering or losing essential information, or are you qualified to do all of this yourself?

Who is "they"?

Hi Bill,
Great question! Somehow I got it in my head that it was "auditors", but in looking back over the thread after your question, I see that Cobra never said that...I did. My bad. Regards, Joe

Unsure why you'd ever convert these to an image, as images are just as volatile/hackable as text.

The normal way this is done is to archive the entire message... forever...

If you use a backing store like Dovecot + mdbox + zstd compression, you can massively compress huge files + keep them forever, taking up very little disk space for each file, also using mdbox will minimize inode usage for files.

Then you'll make the files volatile, where once files land in your archive mailbox, they can only be read, never deleted or updated, which is done by flipping off the file write bit, or by assigning a group permission to the mailbox allowing read, then disallowing delete/update.

If you must convert your files to images, then you'll do this...

1) Extract the header, as text.

2) Convert the text into any image format.

3) Simple way to do this is using ImageMagick (one of many similar tools for this)... something similar to this...

convert headers.txt headers.tiff

Select allOpen in new window