Could opening an attachment create a new record?¶

Yes. Access can download, cache, scan and index a file, add it to recent items and create provider view or read events.

Preserve the attachment without executing it¶

Record message, sender, account, filename, apparent type, size, time, warning, preview and provider document ID. Note whether it is remote, pending, encrypted or downloaded.

Attachments can contain active content, malware, tracking or links. Do not open on personal or general-purpose equipment merely to identify content.

Examine through a controlled process¶

Use specialist acquisition and an approved environment where access is justified. Record device, application, network, time, prompts, new files and message-state changes.

Keep the original message relationship separate from extracted working copies.