Description
TLDR: The Shuffle Outlook OWA (version 1.0.0) app is only returning FileAttachments currently. Emails attached emails, IE in the forward email as attachment style are not being returned. Upon testing with a .txt attached, was returned in Shuffles file attachment list.
Background
Still need to confirm the various ways a file can be "attached" as that may impact how it's stored in the email. IE, I'm thinking about attached images, verus inline images that were attached and render directly in the email. Is the email client displaying the email doing all the trickery here or is it more email client that did the attaching.
The scenario initially tested causing the problem was an email message was attached to a new email while using the OWA web browser client. This is done via a drag and drop. There is no menu option to attach an item from your inbox, at least in the version of the UI that I was using.
Possible source of problem found
The exchangelib message object returned from calling account.inbox.all() can have ItemAttachment as well as FileAttachment. I'm guessing the "drag and drop type method of forwarding an email in an email" embeds the email as an ItemAttachment. Possibly in a similar way to dragging and dropping an image can render it immediately, as opposed to "attach". It looks like the eml_parser library, which then uses the email package from the python standard library isn't properly extracting the ItemAttachments. Not sure yet, if the eml_parser interface will even support extracting both types.
I will confirm the similar behaviour on both a full Outlook desktop client on Windows and also a linux email client forwarding an email as attachment.
Rationale
This is an important use case to capture and fix, as forwarding emails as attachment verus just clicking forward on a email is the correct way to forward on phising and mailcious emails to blue teams for processsing, so important header information is not lost.