wbk<hex numbers>.tmp in Temporary Internet Files


Matthew

New Member
Apr 19, 2005
3
0
#1
I have located a number of files which begin with the letters wbk and then followed by a hex number and with the extension of .tmp.

eg: wbkA7B6.tmp

these files are located in the "Temporary Internet Files\Content.ie\" directory. They contain either Images (JPEGG/JIFF) or are HTML pages in the form of emails.

Are these files created by a WebMail client (if so which one) or are they created by something like Outlook when viewing HTML emails?

Any help would be great...thankyou.
 
Sep 2, 2004
70
6
#2
Are these files created by a WebMail client (if so which one) or are they created by something like Outlook when viewing HTML emails?

I think that in a way, you've partially answered your own question with:
these files are located in the "Temporary Internet Files\Content.ie\"
What do you know about these files, for example? Is this your own system or someone elses? Can you sort these files by MAC times and determine other content that may have come in around the same time? If you can, you may get some idea of where they came from.

H. Carvey
"Windows Forensics and Incident Recovery"
 

pascal

New Member
May 21, 2006
6
0
#4
Maybe.....

<r><E>:D</E><br/>
foundstone.com/pdf/wp_index_dat.pdf<br/>
<br/>
and...<br/>
<br/>
a uniquely named zero-byte temporary file on disk??<br/>
<br/>
That's URL...<br/>
<br/>
<URL url="http://nant.sourceforge.net/release/latest/help/functions/path.get-temp-file-name.html"><LINK_TEXT text="http://nant.sourceforge.net/release/lat ... -name.html">http://nant.sourceforge.net/release/latest/help/functions/path.get-temp-file-name.html</LINK_TEXT></URL></r>
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu