How can I decode the attachments in a raw_message.mht file?

Environment:

All versions.

Resolution:

To decode the attachments in a raw_message.mht file you must first download the file and open it in a text editor.  The file will open by default in Internet Explorer which does not show attachments.

1. Open the incident details tab (or whichever tab on your incident workspace contains the attachments control).

2. Click download and save the raw_message.mht file to a suitable location.

3. Open the raw_message.mht with a capable text editor such as NotePad++.

4. Inspect the text for the attachment sections. Refer to the below example. The highlighted section in the example shows the attachment data.

5. Copy a complete attachment section and decode it with a base64 decoder.  There are several web sites that offer free base64 decoders and can be found by a search.

6. If the attachment section is not text you must rename the resulting file with the correct file extension (pdf, jpg, doc etc) to have it open properly. Each attachment section contains the original filename.

Example Email:

From:  Some Sender <customer@gmail.com>
To: Some Receiver <support@mbox.custhelp.com>
Subject: Formatted text mail
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=abcdefghijklmnop

--abcdefghijklmnop
Content-Type: text/plain; charset="utf-8"

...plain text version of message goes here...

--abcdefghijklmnop
Content-Type: text/html; charset="utf-8"

...html version of same message goes here...

--abcdefghijklmnop

Content-Type: image/jpeg;
name="fishtacos.jpg"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="fishtacos.jpg"

B9j/4AAQSkZJRgABAgAAZABkAAD/7AARRHVja3kAAQAEAAAAPAAA/+4ADkFkb2JlAGTAAAAA
Af/bAIQABgQEBAUEBgUFBgkGBQYJCwgGBggLDAoKCwoKDBAMDAwMDAwQDA4PEA8ODBMTFBQT
AeLAAPFgAHiwADxYAB4sAA8WAAeLAAPFgAWn9mAB3wd0AH//2Q==
--abcdefghijklmnop