<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>kr1zz &#187; howto</title>
	<atom:link href="http://www.cristianonattero.com/blog/tag/howto/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.cristianonattero.com/blog</link>
	<description>Cristiano Nattero</description>
	<lastBuildDate>Tue, 07 Feb 2012 11:44:57 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>unreadable attachment? Here&#8217;s how to recover it!</title>
		<link>http://www.cristianonattero.com/blog/2008/07/23/unreadable-attachment-heres-how-to-recover-it/</link>
		<comments>http://www.cristianonattero.com/blog/2008/07/23/unreadable-attachment-heres-how-to-recover-it/#comments</comments>
		<pubDate>Wed, 23 Jul 2008 14:00:17 +0000</pubDate>
		<dc:creator>kr1zz</dc:creator>
				<category><![CDATA[geek]]></category>
		<category><![CDATA[attachment]]></category>
		<category><![CDATA[base64]]></category>
		<category><![CDATA[email]]></category>
		<category><![CDATA[Free Software]]></category>
		<category><![CDATA[howto]]></category>
		<category><![CDATA[LinkedIn]]></category>

		<guid isPermaLink="false">http://cristianonattero.com/blog/?p=256</guid>
		<description><![CDATA[A friend forwarded me an email pretending it contained some exceptional photos. There was actually only a text file in attachment, whose content looked like this:

Return-Path:
Received: from [...]
Date: [...]
Message-Id:[...]
Subject: a very original subject
MIME-Version: 1.0
X-Sensitivity: 3
Content-Type: multipart/mixed; boundary="_=__=_XaM3_.1215754998.2A.506953.42.25201.52.42.007.413123292"
From: [...]
To: [...]
X-XaM3-API-Version: 4.3 (R1) (B3pl25)
X-SenderIP: 79.24.125.30
--_=__=_XaM3_.1215754998.2A.506953.42.25201.52.42.007.413123292
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
--_=__=_XaM3_.1215754998.2A.506953.42.25201.52.42.007.413123292
Content-Type: application/vnd.ms-powerpoint;
name="=?iso-8859-1?Q?foto=5Fincredibili.pps?="
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="=?iso-8859-1?Q?foto=5Fincredibili.pps?="
0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAAIAAAA5gMAAAAA
AAAAEAAA6AMAAAEAAA
[...]
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////wAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
--_=__=_XaM3_.1215754998.2A.506953.42.25201.52.42.007.413123292--
What does it mean? It&#8217;s an email [...]]]></description>
			<content:encoded><![CDATA[<p>A friend forwarded me an email pretending it contained some exceptional photos. There was actually only a text file in attachment, whose content looked like this:</p>
<p><span id="more-256"></span></p>
<p><code>Return-Path:<br />
Received: from [...]<br />
Date: [...]<br />
Message-Id:[...]<br />
Subject: a very original subject<br />
MIME-Version: 1.0<br />
X-Sensitivity: 3<br />
Content-Type: multipart/mixed; boundary="_=__=_XaM3_.1215754998.2A.506953.42.25201.52.42.007.413123292"<br />
From: [...]<br />
To: [...]<br />
X-XaM3-API-Version: 4.3 (R1) (B3pl25)<br />
X-SenderIP: 79.24.125.30</code></p>
<p><code>--_=__=_XaM3_.1215754998.2A.506953.42.25201.52.42.007.413123292<br />
Content-Type: text/plain; charset=iso-8859-1<br />
Content-Transfer-Encoding: quoted-printable</code></p>
<p><code>--_=__=_XaM3_.1215754998.2A.506953.42.25201.52.42.007.413123292<br />
Content-Type: application/vnd.ms-powerpoint;<br />
name="=?iso-8859-1?Q?foto=5Fincredibili.pps?="<br />
Content-Transfer-Encoding: base64<br />
Content-Disposition: attachment;<br />
filename="=?iso-8859-1?Q?foto=5Fincredibili.pps?="</code></p>
<p><code>0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAAIAAAA5gMAAAAA<br />
AAAAEAAA6AMAAAEAAA<br />
[...]<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////wAAAAAAAAAA<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==</code></p>
<p><code>--_=__=_XaM3_.1215754998.2A.506953.42.25201.52.42.007.413123292--</code></p>
<p>What does it mean? It&#8217;s an email message, containing headers, body and a binary attachment, all coded as text. In particular, the following section tells us more:</p>
<p><code>Content-Type: application/vnd.ms-powerpoint;<br />
name="=?iso-8859-1?Q?foto=5Fincredibili.pps?="<br />
Content-Transfer-Encoding: base64<br />
Content-Disposition: attachment;<br />
filename="=?iso-8859-1?Q?foto=5Fincredibili.pps?="</code></p>
<p>The original attachment was a powerpoint slide presentation whose name was <code>foto incredibili.pps</code>. The file was encoded with <a title="read more on wikipedia" href="http://en.wikipedia.org/wiki/Base64">base64</a> and attached to the email.</p>
<p>To recover it, first of all I had to separate the relevant part from the rest, which meant editing the file (I used gedit but any text editor should do) and deleting headers and body and everything apart from</p>
<p><code>0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAAIAAAA5gMAAAAA<br />
AAAAEAAA6AMAAAEAAA</code><br />
[...]<br />
<code>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////wAAAAAAAAAA<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==</code></p>
<p>I saved the file as <code>convert.me</code> and the job was almost over. Last thing I had to do was to decode it, which on a Linux box means:</p>
<p><code>$ base64 -d convert.me &gt; foto\ incredibili.pps</code></p>
<p>I suppose there are tools to manipulate MIME-base64 encoded file also on other operating systems but wikipedia suggests some <a title="just in case..." href="http://en.wikipedia.org/wiki/Base64#Online_tools">online tools</a> which can be useful.</p>
<p>Finally, <a title="I swear I thought it was about something completely different :-P" href="http://www.slideshare.net/kr1zz/foto-incredibili">here</a> you can see the result :p</p>
]]></content:encoded>
			<wfw:commentRss>http://www.cristianonattero.com/blog/2008/07/23/unreadable-attachment-heres-how-to-recover-it/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

