Windows Explored

One of my co-workers forwarded me an email from a user that should have contained an attachment, specifically a PDF. However, the attachment and the even the paperclip icon in Outlook was missing. Surely, then, the message didn’t contain the attachment, right?. Actually, it did. I could see by the size of the message there should be something else to the message:

Besides a few lines of formatted text and a couple hyperlinks, there was nothing else to indicate that the message body was causing the message to appear this large, and looking under the hood, I didn’t see any odd html tags like I had seen in an earlier post. If you’re in doubt, you can also look at the Internet Headers of the message to see if contains attachment. Attachments are indicated by the presence of “winmail.dat” in the Content-Type field:
 
Additionally, the X-MS-Has-Attach property will be equal to yes.

To check the attachment name and type without any add-on tools, try viewing the message as as raw html by right-clicking an empty portion of the message body and selecting View Source (this is not the actual attachment itself but an image link to the attachment in the message):

Why the message ended up not displaying the attachment, I don’t know; I didn’t get an opportunity to view the original message that the user received, only a forwarded copy, which is not contain all the original properties of the problem email. It may have not been encoded or decoded properly. It could be an issue with the sender’s mail client, their mail server, or the issue may lay with the receiving mail server or client. Perhaps some message property became malformed. Any number of things can cause this. I did notice the sending domain was aol.com, so we could be dealing with an email client other than Outlook.

So, can the message attachment be recovered. Well,  a quick trick to work around this issue is simply to forward the problem message to yourself. In the case here, this ended up revealing the attachment:

In other cases where this fails, a good utility I also used to initially recover the attachment is MFCMapi by going to the problem email message, right-clicking it and Save all attachments:


Alternatively, if you think Outlook is the issue and if it’s an option, look at the message in OWA and see if you can view the attachment there. In my case, the message that was forwarded to myself again in Outlook failed to reveal the attachment in OWA. I actually needed to re-forward the message from OWA to see it in OWA.

MFCMapi also comes in handy for examining the various properties of an email message. OutlookSpy is another good tool. With the original message, you may be able to use either of these tools to examine any of the various message properties to possibly isolate the cause.