Shot In the Dark, Rocovering Lost Outlook Attachment

[Zerohm]

I know this is a real shot in the dark, but I was wondering if anyone knew of any advanced way to recover lost changes to an Outlook attachment. Here's the situation.

In Outlook 2007 my boss opened an attachment and worked on a .doc for hours. She saved throughout, but never did a "save as" in a safe location. Here's the kicker though, when she closed the email she was working from, Outlook prompted "would you like to save changes" and she clicked No (I believe).

I already looked in the \Documents and Settings\username\Local Settings\Temporary Internet Files\Content.Outlook\XXXXXXXX folder. The file we are looking for is there, but last altered today and the changes we are looking for are not there. I think it was overwritten when she reopened the attachment looking for the changes.

I'm guessing the only way to possibly recover the version with changes would be with some forensics tools, correct?

 

[gsaldivar]

The temporary OLK folder you already tried is the best bet. If you still have no luck, there is another way but it is a huge pain in the ass, may take many hours and should only be attempted as a last resort:

Immediately shut down the user's computer and pull the drive. Connect the drive to a different computer (preferably a fast one with plenty of RAM) and run Recuva Free with the following options: Show all files, Search everywhere, and Enable deep scan mode.

I would recommend recovering all Word files onto a different volume, then search through them for any signs of your lost document.

Good luck!