Retrieving Email Attachments from the OLK Folder

In the Tip of the Night for September 29, 2017, in the outline of the section of Craig Ball's Electronic Discovery Workbook on email, I noted that there are, "OLK system subfolders holding viewed attachments." So how do you find these OLK folders?

1. Go to Start and Type in regedit. Open Registry Editor.

2. Browse to KEY_CURRENT_USER\Software\Microsoft\Office . . . and then select the number for the version of MS Office that you are using.

3. In the Outlook directory, in the Security subfolder, you should find the location of the OutlookSecureTempFoler.

In this example it is: C:\Users\SeanKOShea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\291V0540

If you can't locate this directory in Windows Explorer, go to start and type in, "shell:cache". This will open the 'Temporary Internet Files' folder and you should be able to find the 'Content.Outlook' folder.

4. When Outlook opens attachments it will place them in this folder. If you have opened an attachment, made some edits, and then your operating systems crashes, you should be able to find the attachments in this folder.

If Outlook crashes while an attachment is open the file will remain in this folder indefinitely. When Outlook is closed normally attachments which have been opened and put in this folder are deleted.

This is a good tip for computer forensics professionals who are looking for files that a user may have intended to get rid of but inadvertently left on his or her computer.