How do I recover an edited email attachment on a locked down PC?

Question

Every once in a while we have a student coming to us who's spent several hours working on a Word document that they have emailed to themself as an attachment. Unfortunately, rather than saving the attachment before working on it, they have used the 'Open' option, which saves it to a hidden temporary internet files folder:
C:\Users\%UserName%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XXXXXXXX
(where XXXXXXXX is a randomly named hidden folder).

So, once they close the document, they have no obvious way of recovering their work.

Also, our student PCs are locked down by group policy so that they cannot see the C: drive, have access to the command line or change options so they can see hidden files.

How can they get to their edited document in the hidden folder.

Answer 1

(I'm answering my own question as the solution I found may be of use to other users if their machines are configured in a similar way.)

1. First of all, make sure you don't re-open the attachment as if you are in the same Windows session this will silently overwrite the version you've been working on with no chance of recovery. (If you have previously logged out and back in to Windows, opening the attachment a second time should save it to a different folder without overwriting the first version.)

2. Create and run the batch file below:
   (Save in Notepad as "go.bat" - including the quotes)

...

@echo off
c:
cd "\Users\%username%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5"
attrib -h -s /S /D *.*
%SystemRoot%\explorer.exe "C:\Users\%username%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5"
pause

This will remove the hidden and system attributes from the 'Content.IE5' folders and then open the 'Content.IE5'. From there, you should be able to browse for your opened attachments, complete with amendments.