Outlook Attachment Folder (Outlook
The hidden folder where Outlook saves attachments the user opens or previews.
Use it to find copies of email attachments a user opened, such as a phishing document, even after the email is gone.
- NTUSER.DAT
- Office, Email and Cloud Apps
What It Is
When a user opens or previews an email attachment in Outlook, Outlook writes a copy to a hidden folder and keeps that folder's path here. Following the path leads to copies of attachments a user opened, such as a phishing document, even after the email itself is gone. The value is only the path, so the evidence is the files in the folder. It lives in the user's own NTUSER.DAT.
What It Proves
Where to find copies of attachments this user opened from Outlook. A file left in that folder shows its attachment was opened, even if the email has since been deleted.
What It Does Not Prove
The value is only a folder path, so the evidence is the files in it. Outlook tries to delete them, but a crash or a file still open leaves copies behind.
Where It Lives
Outlook Attachment Folder (OutlookSecureTempFolder) lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| alice's Outlook saves opened attachments in this hidden folder, which ends in a random name. List it in the image, because each file is an attachment she opened. |
| Invoice_ |
| A second copy at 12 Oct 2026 09:24 UTC shows she opened the attachment again. The numbered copies give a minimum count of openings. |
How to Read It
OutlookSecureTempFolder holds the path, usually INetCache\Content.Outlook\ followed by eight random characters. List that folder in the image, because each file is a copy of an attachment opened from Outlook. Use the file times to date each opening, and hash the files to check them.
- When Windows Writes It
- Outlook writes the path when it first needs the folder, and files appear in it as attachments are opened.
- Which Windows Versions
- Outlook 2007 to Microsoft 365 keep it. Older Windows uses a Temporary Internet Files path rather than INetCache.
- Tools That Parse It
- Registry Explorer, RECmd
Hunt It
The folder path sits in this key, but the attachments themselves are files, so list the folder in the image, or collect them with a file artefact. The Trusted Documents key dates when a macro document was enabled.
Reads the DeviceFileEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, which shows attachments Outlook wrote there, even after it deletes the copy. Defender does not monitor every file type, so a miss proves nothing, and it does not read the key.
// Attachments Outlook saved to its secure temp folder, with hashesDeviceFileEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Outlook Attachment Folder (OutlookSecureTempFolder) shows.
- Office Trusted Documents (TrustRecords)Shows whether the user enabled editing or macros in an attachment opened from here.
- Office File MRU and Place MRULists attachments opened in Office from this folder, each with its own time.
- Outlook Data Files (PST and OST)Names the mail files that hold the emails the attachments came from.
Sources
The facts on this page come from these public pages, which say more on each point.