How can I decode the attachments in a raw_message.mht file?
To decode the attachments in a raw_message.mht file you must first download the file and open it in a text editor. The file will open by default in Internet Explorer which does not show attachments.
1. Open the incident details tab (or whichever tab on your incident workspace contains the attachments control).
2. Click download and save the raw_message.mht file to a suitable location.
3. Open the raw_message.mht with a capable text editor such as NotePad++.
4. Inspect the text for the attachment sections. Refer to the below example. The highlighted section in the example shows the attachment data.
5. Copy a complete attachment section and decode it with a base64 decoder. There are several web sites that offer free base64 decoders and can be found by a search.
6. If the attachment section is not text you must rename the resulting file with the correct file extension (pdf, jpg, doc etc) to have it open properly. Each attachment section contains the original filename.
From: Some Sender <email@example.com>
To: Some Receiver <firstname.lastname@example.org>
Subject: Formatted text mail
Content-Type: multipart/alternative; boundary=abcdefghijklmnop
Content-Type: text/plain; charset="utf-8"
...plain text version of message goes here...
Content-Type: text/html; charset="utf-8"
...html version of same message goes here...