1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
|
#------------------------------------------------------------------------------
# $File: mail.news,v 1.30 2022/10/31 13:22:26 christos Exp $
# mail.news: file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
#0 string From mail text
0 string/t Relay-Version: old news text
!:mime message/rfc822
0 string/t #!\ rnews batched news text
!:mime message/rfc822
0 string/t N#!\ rnews mailed, batched news text
!:mime message/rfc822
0 string/t Forward\ to mail forwarding text
!:mime message/rfc822
0 string/t Pipe\ to mail piping text
!:mime message/rfc822
0 string/tc delivered-to: SMTP mail text
!:mime message/rfc822
0 string/tc return-path: SMTP mail text
!:mime message/rfc822
0 string/t Path: news text
!:mime message/news
0 string/t Xref: news text
!:mime message/news
0 string/t From: news or mail text
!:mime message/rfc822
0 string/t Date: news or mail text
!:mime message/rfc822
0 string/t Article saved news text
!:mime message/news
# Reference: http://quimby.gnus.org/notes/BABYL
# Update: Joerg Jenderek
# Note: used by Rmail in Emacs version 22 and before
# is not text because of characters like Control-L Control-_
0 string/b BABYL\ OPTIONS: Emacs RMAIL
#0 string/t BABYL Emacs RMAIL text
# https://reposcope.com/mimetype/message/x-gnu-rmail
!:mime message/x-gnu-rmail
# ~/RMAIL
!:ext /
0 string/t Received: RFC 822 mail text
!:mime message/rfc822
0 string/t MIME-Version: MIME entity text
#0 string/t Content- MIME entity text
# TNEF files...
# URL: http://fileformats.archiveteam.org/wiki/Transport_Neutral_Encapsulation_Format
# https://en.wikipedia.org/wiki/Transport_Neutral_Encapsulation_Format
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tnef.trid.xml
# https://interoperability.blob.core.windows.net/files/MS-OXTNEF/%5bMS-OXTNEF%5d-210817.pdf
# Update: Joerg Jenderek
# Note: moved and merged from ./msdos (version 1.154) there just called "TNEF"
# partly verified by `tnef --list -v -f voice.tnef` and `ytnef -v triples.tnef`
# TNEF magic From "Joomy" <joomy@se-ed.net>
# TNEF_SIGNATURE
0 lelong 0x223E9F78 Transport Neutral Encapsulation Format (TNEF)
!:mime application/vnd.ms-tnef
# winmail.dat or win.dat by Microsoft Outlook
!:ext tnef/dat
# https://docs.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxtnef/7fdb64ee-7f63-4d95-9af1-c672e7475c3a
# LegacyKey
#>4 uleshort x \b, key %#4.4x
# attrLevelMessage; Level where attribute applies like: 1~attrLevelMessage 2~attrLevelAttachment
>6 ubyte !1 \b, 1st level %#2.2x
# other ID (like 02900000h) or TnefVersion ID (idTnefVersion=06900800h)
>7 ubelong !0x06900800 \b, 1st id %#8.8x
>7 ubelong =0x06900800
# TnefVersion length like: 4
>>11 ulelong !4 \b, TnefVersion length %x
# TNEFVersionData; TnefVersion data like: 00010000h
>>15 ulelong !0x00010000h \b, version %#8.8x
# Checksum like: 1
>>19 uleshort !1 \b, checksum %#4.4x
# attrLevelMessage; level of attOemCodepage like: 1
>>21 ubyte !1 \b, level %#2.2x
# idOEMCodePage; OEMCodePage ID like: 07900600h
>>22 ubelong =0x07900600 \b, OEM codepage
# OEMCodePage length like: 8
>>>26 ulelong =8
# OEMCodePageData; PrimaryCodePage like: 1251 1252
>>>>30 ulelong x %u
# OEMCodePageData; SecondaryCodePage; unused and SHOULD contain zero
>>>>34 ulelong !0 and %u
# OEMCodePageData Checksum like: E7h E8h
>>>>38 uleshort x (checksum %#x)
# attrLevelMessage of attMessageClass like: 1
>>40 ubyte !1 \b, level %u
# idMessageClass; ID of attMessageClass like: 08800700h
>>41 ubelong =0x08800700 \b, MessageAttribute
# attMessageClass length like: 16 24 25
#>>>45 ulelong x (length %u)
# attMessageClass data like: "IPM.Microsoft Mail.Note" "IPM.Note.Portada Newseum"
# "IPM.Appointment" "IPM.Note.Microsoft.Voicemail.UM.CA"
>>>45 pstring/l x "%s"
# From: Kevin Sullivan <ksulliva@psc.edu>
0 string *mbx* MBX mail folder
# From: Simon Matter <simon.matter@invoca.ch>
0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB
0 string \241\002\213\015twoskip\ file\0\0\0\0 Cyrus twoskip DB
# JAM(mbp) Fidonet message area databases
# JHR file
0 string JAM\0 JAM message area header file
>12 leshort >0 (%d messages)
# Squish Fidonet message area databases
# SQD file (requires at least one message in the area)
# XXX: Weak magic
#256 leshort 0xAFAE4453 Squish message area data file
#>4 leshort >0 (%d messages)
#0 string \<!--\ MHonArc text/html; x-type=mhonarc
# Cyrus: file(1) magic for compiled Cyrus sieve scripts
# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
# From: Philipp Hahn <hahn@univention.de>
# Compiled Cyrus sieve script
0 string CyrSBytecode Cyrus sieve bytecode data,
>12 belong =1 version 1, big-endian
>12 lelong =1 version 1, little-endian
>12 belong x version %d, network-endian
# Dovecot mail server, version 2.2 and later.
# Dovecot mailing list: dovecot@dovecot.org
# File format spec: https://wiki.dovecot.org/Design/Dcrypt/#File_format
# From: Stephen Gildea
0 string CRYPTED\003\007 Dovecot encrypted message
>9 byte x \b, dcrypt version %d
|
