Use MFCMAPI to wrangle email data

MFCMAPI is a free API (an application programming interface) for Outlook, which can be downloaded here. MAPI (Messaging Application Programming Interface) allows Windows applications to interface with Outlook or other email clients such as Eudora and send emails. MFCMAPI can be used to investigate issues with Outlook and Exchange by accessing MAPI stores. After MFCMAPI is installed, it should automatically detect your Outlook folders, address books, calendars, and notes.

MFCMAPI has many useful functions but it should be used with caution, as it can corrupt the contents of your Outlook profile if mistakes are made.

One of the useful features of MFCMAPI is that it can detect if an attachment has been blocked. See in the Advanced menu . . . Is attachment blocked, and enter the name of the attachment you want to check.

Going to Quick Start . . . Open Folder . . .will display the metadata for emails in a selected folder, including the Conversation ID. You can right click and export messages with a common subject, or save all attachments in the folder.

MFCMAPI is a great tool for helping to wrangle email data.

Count Email Dates

A lady or gentleman with the handle IT4577 has posted VBA code on spiceworks which can be used to find how many emails in an Outlook folder contain received dates that are specified in an Excel worksheet. The VBA code is copied below, but because of formatting issues with my Wix editor it may be necessary to copy the code from the spiceworks site.

The code should be entered into a module in Visual Basic for Excel, not Outlook. You need to have both Excel and Outlook open.

You'll have to change this part of the code.

On this line:

Set objFolder = objnSpace.Folders("Outlook Data File").Folders("Inbox").Folders("enron")

. . . specify the path to the folder in Outlook that contains the emails you need to review. In order to get the correct path right click on the folder in Outlook and select 'Properties'. On the General tab note the location of the folder being reviewed, in this example the one named, 'Enron'. The path is ' \\Outlook Data File\Inbox', but you need to list each folder in the path separately like this: Folders("Outlook Data File").Folders("Inbox").Folders("enron")

In an Excel file that has a worksheet named 'Sheet1' (as referenced in the VBA code) starting in cell A1 list dates in column A that you want to search for in the emails saved in the specified folder.

Run the macro, and the count of the number of emails with a matching received date will be generated in column B. It is not necessary for the received date field to be displayed in Outlook for this macro to work.

Sub HowManyDatedEmails() ' Set Variables Dim objOutlook As Object, objnSpace As Object, objFolder As Object Dim EmailCount As Integer, DateCount As Integer, iCount As Integer Dim myDate As Date Dim arrEmailDates() ' Get Outlook Object Set objOutlook = CreateObject("Outlook.Application") Set objnSpace = objOutlook.GetNamespace("MAPI") ' Get Folder Object On Error Resume Next Set objFolder = objnSpace.Folders("Outlook Data File").Folders("Inbox").Folders("enron") If Err.Number <> 0 Then Err.Clear MsgBox "No such folder." Set objFolder = Nothing Set objnSpace = Nothing Set objOutlook = Nothing Exit Sub End If ' Put ReceivedTimes in array EmailCount = objFolder.Items.Count For iCount = 1 To EmailCount With objFolder.Items(iCount) ReDim Preserve arrEmailDates(iCount - 1) arrEmailDates(iCount - 1) = DateSerial(Year(.ReceivedTime), Month(.ReceivedTime), Day(.ReceivedTime)) End With Next iCount ' Clear Outlook objects Set objFolder = Nothing Set objnSpace = Nothing Set objOutlook = Nothing

' Count the emails dates equal to active cell Sheets("Sheet1").Range("A1").Select Do Until IsEmpty(ActiveCell) DateCount = 0 myDate = ActiveCell.Value For i = 0 To UBound(arrEmailDates) - 1 If arrEmailDates(i) = myDate Then DateCount = DateCount + 1 Next i Selection.Offset(0, 1).Activate ActiveCell.Value = DateCount Selection.Offset(1, -1).Activate Loop End Sub

Retrieving Email Attachments from the OLK Folder

In the Tip of the Night for September 29, 2017, in the outline of the section of Craig Ball's Electronic Discovery Workbook on email, I noted that there are, "OLK system subfolders holding viewed attachments." So how do you find these OLK folders?

1. Go to Start and Type in regedit. Open Registry Editor.

2. Browse to KEY_CURRENT_USER\Software\Microsoft\Office . . . and then select the number for the version of MS Office that you are using.

3. In the Outlook directory, in the Security subfolder, you should find the location of the OutlookSecureTempFoler.

In this example it is: C:\Users\SeanKOShea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\291V0540

If you can't locate this directory in Windows Explorer, go to start and type in, "shell:cache". This will open the 'Temporary Internet Files' folder and you should be able to find the 'Content.Outlook' folder.

4. When Outlook opens attachments it will place them in this folder. If you have opened an attachment, made some edits, and then your operating systems crashes, you should be able to find the attachments in this folder.

If Outlook crashes while an attachment is open the file will remain in this folder indefinitely. When Outlook is closed normally attachments which have been opened and put in this folder are deleted.

This is a good tip for computer forensics professionals who are looking for files that a user may have intended to get rid of but inadvertently left on his or her computer.