Top Ad unit 728 × 90

Latest News


Daily Blog #407: Exploring Extended MAPI Part 14

Hello reader,
        In yesterdays post I showed how saving an attachment applied the modification date that was stored within the attachment extended mapi properties. I was wondering how from a filesystem perspective you could tell the actual date the file was saved to the disk and as it turns out the filename attribute metadata has the dates the attachment was actually saved to the disk as seen below:

This is a png file, in the upcoming posts I'll be trying other file types to see if Outlook shows any different behaviors.
Daily Blog #407: Exploring Extended MAPI Part 14 Reviewed by David Cowen on June 28, 2018 Rating: 5

No comments:

All Rights Reserved by Hacking Exposed Computer Forensics Blog © 2014 - 2020
Powered By Blogger, Designed by Sweetheme

Contact Form


Email *

Message *

Powered by Blogger.