winmail.dat email attachment processing error

More than once I've come across email attachments in document productions for which the file name was 'winmail.dat' and the attachment had not been processed. This problem stems from a well-known problem that Microsoft Support has addressed here. Some email clients cannot process emails sent from MS Outlook that are in the rich text format. The message is sent in plain text and the .dat file contains the rich text formatting, embedded images and file attachments. This method is known as TNEF, Transport Neutral Encapsulation Format.

This error causes a minor security breach as the sender's login user name, and .pst folder paths can be found if the file is opened in a text editor.

See this example from the Enron Email data set.

It's hard to say if the EDRM's own processing stripped out some of the original information, but we can see a file path and what may be a login ID.