Skip to content
EML-011 Email Evidence

How do I preserve and examine an attachment?

title: How do I preserve and examine an attachment? subtitle: Preserve the attachment in its original relationship to the email before anybody opens, edits or resaves it. slug: how-do-i-preserve-and-examine-an-attachment series: email-evidence section: content-and-attachments card_type: question_card pathway_order: 23 section_order: 1 status: draft public_safe: true video_ready: true word_count: 686 estimated_read_time_seconds: 284 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - attachment - preservation - malware - file analysis sources: - title: 'RFC 2045: Multipurpose Internet Mail Extensions (MIME) Part One' url: https://www.rfc-editor.org/info/rfc2045/ - title: 'RFC 2046: Multipurpose Internet Mail Extensions (MIME) Part Two' url: https://www.rfc-editor.org/info/rfc2046/ - title: 'RFC 2183: Communicating Presentation Information in Internet Messages' url: https://www.rfc-editor.org/info/rfc2183/ - title: 'Gmail Help: Open and download attachments' url: https://support.google.com/mail/answer/30719?hl=en-GB - title: 'Microsoft Learn: Submit messages, URLs and attachments for analysis' url: https://learn.microsoft.com/en-us/defender-office-365/submissions-admin - title: 'Microsoft Learn: Email entity page in Defender for Office 365' url: https://learn.microsoft.com/en-us/defender-office-365/mdo-email-entity-page

How do I preserve and examine an attachment?

Preserve the attachment in its original relationship to the email before anybody opens, edits or resaves it.

Script

You’ve been given an email with an attachment that may matter to the investigation.

The attachment might be the evidence itself. It might contain a document, image, invoice, archive, malicious file or another email. It may also be the route through which the recipient’s device was affected.

The first job isn’t to open it.

The first job is to preserve it.

Keep the complete original email in its mailbox where possible. Acquire a native copy of the message that retains the attachment in its original relationship to the email.

That relationship matters.

The email may contain the original filename, the content type declared by the sender, the transfer encoding, a Content-ID, a disposition such as inline or attachment, and other structure explaining how the mail client was meant to handle it.

If somebody simply downloads the file, renames it and sends it to you through another message, you may receive the content but lose part of that context.

Record what the recipient saw.

What filename was displayed?

Was it shown as a normal attachment, an embedded image, a cloud link or a preview?

Did the recipient open, download, edit, print, upload or forward it?

Which device and application did they use?

Did the system display any warning?

Did the file appear to have a familiar type, such as PDF or Word, while the underlying file was something else?

Don’t rely on the filename extension alone.

A name ending in .pdf doesn’t prove the content is a PDF. The declared MIME type may also be wrong or deliberately misleading.

File type should be established from the file content and structure using appropriate tools, not only from the label supplied by the sender.

If the attachment may be malicious, don’t open it on an ordinary workstation simply to see what happens.

Use the organisation’s security, digital-forensics or malware-analysis process. That may involve a controlled examination machine, sandbox, security platform or specialist support.

The right level of technical handling depends on the question.

If the attachment is an ordinary image relevant to a harassment complaint, you may need to preserve and review the visual content.

If it is an executable, macro-enabled document, script, archive or unknown binary, the risks and examination requirements are very different.

Where the organisation already uses an email-security platform, preserve its findings.

The service may have recorded a cryptographic hash, malware verdict, detonation result, original filename, file type, delivery action and other messages containing the same attachment.

Those provider records can be valuable, but they don’t replace the original file.

Security products may alter, remove, quarantine or replace attachments. Record whether the recipient received the original, a sanitised copy, a warning page or a cloud-hosted substitute.

Create a working copy for examination.

Keep the preserved original unchanged. Calculate and record hashes where this forms part of the local evidence process. Note which tool produced the hash and which algorithm was used.

Then document every transformation.

If you extract a file from an EML, decompress an archive, convert a document, remove a password or generate a preview, keep the resulting file separate from the original and record how it was produced.

Also preserve passwords or instructions supplied in the email.

A password-protected archive may be unusable without the message body or a separate communication that contains the password.

The common mistake is to double-click the attachment, decide it looks harmless and then save the opened version.

Opening can trigger active content, contact a remote service, update file metadata or create a modified copy. Saving may change the file.

Another mistake is to preserve only the extracted attachment and throw away the email. That may remove the evidence linking the file to the sender, recipient, message and delivery event.

A careful conclusion might say:

“The original message contained an attachment presented with this filename and content type. A preserved copy produced this hash. Examination of a working copy found the following.”

That separates what arrived from what the analysis later discovered.

Preserve the message first.

Preserve the attachment as it arrived.

Then examine a working copy at the level of control the file and the investigation require.

Key takeaway

An attachment is both a file and part of a message. Preserve the complete email first, then examine a working copy in an appropriate environment.

Source notes

Keep moving

Where this question leads

These links explain why the next page may matter, rather than presenting an undifferentiated list.