Hi Eash -
If your question is 'I'm looking at an Incident, and there's an attachment. Can I tell how it got there?' the answer is only 'sort of'.
If it was attached by reply email, you'll see in the Activity Stream where the attachment was added, and there would email there at nearly the same time. If it was attached via the platform view or the portal, you can only tell that it was one of those and not email, as from the platform's perspective, it doesn't care which it was.
If you're looking to do some sort of tracking of how attachments are getting added, there's no way to do that that I'm aware of. If this is important information for your organization, you could probably do some sort of customization on the sys_attachments table that captures the client type when an attachment is added, but customizations on the attachments table are not generally a good idea.
