This script is designed to extract attachments from Microsoft *.MSG files as defined by the MS-OXMSG specification.

• MS-OXMSG

Regardless of the processing-mode selected, the script will only process entries that have a *.MSG file-extension. Artifacts are not currently supported.

Whilst the script can be used to process *.MSG files that have been mounted as compound files, this is not advisable as EnCase can only process the volume-representation of each file and linking back to the source-entry may not be possible.

It is for this reason that the option to process selected entries in the current view cannot be used to process *.MSG files that have been mounted.

For each *.MSG file that is processed and has attachments, the script will create a sub-folder in the designated output folder. The name of the sub-folder will contain an incremental index and the name of the *.MSG file.

Having created the sub-folder, the script will extract copies of the *.MSG file and its attachments into that folder.

Each attachment is stored internally as an attachment object, which will have a name of the form __attach_version1.0_#00000001 where the value after the hash character (in this case 00000001) is a hex representation of the attachment’s zero-based index.

When a *.MSG file is mounted, EnCase shows each attachment object as a folder with child entries containing one or more of the attachment’s properties, which are defined by the MS-OXPROPS specification.

As far as the script is concerned, the following property-entries are the most important:

• __substg1.0_37010102 - Contains the attachment’s file-data as a byte-stream (PidTagAttachDataBinary).
• __substg1.0_3707001F - Contains the attachment’s full filename and extension as a string (PidTagAttachLongFilename). which may be in plaintext or Unicode depending on whether the PidTagStoreSupportMask flag is set in the MSG file (the script reads this flag).

EnCase will name each attachment using its index and the name/extension specified by the PidTagAttachLongFilename property.

In addition to extracting each message and its attachments, the script will bookmark each *.MSG file such that the comment will contain the the index used to extract it; also, the number of attachments that were extracted.

The script will also created a tab-delimited spreadsheet file containing a list of the attachments that were located. This list will contain the following timestamps in UTC (where present):

• PidTagClientSubmitTime - Indicates the time the email was submitted.
• PidTagCreationTime - Indicates the time the file referenced by the attachment object was created, or the time the attachment object itself was created.
• PidTagLastModificationTime - Indicates the last time the file referenced by the attachment object was modified, or the last time the attachment object itself was modified.

These timestamps are provided as-is. The examiner may need to undertake additional testing to verify their significance.

Depending on the formatting used, the Document tab can be used to view *.MSG files in EnCase.

Progress can be monitored by the console.