1b6cee71dSXin LI#------------------------------------------------------------------------------ 2*898496eeSXin LI# $File: mail.news,v 1.30 2022/10/31 13:22:26 christos Exp $ 3b6cee71dSXin LI# mail.news: file(1) magic for mail and news 4b6cee71dSXin LI# 5b6cee71dSXin LI# Unfortunately, saved netnews also has From line added in some news software. 6b6cee71dSXin LI#0 string From mail text 7b6cee71dSXin LI0 string/t Relay-Version: old news text 8b6cee71dSXin LI!:mime message/rfc822 9b6cee71dSXin LI0 string/t #!\ rnews batched news text 10b6cee71dSXin LI!:mime message/rfc822 11b6cee71dSXin LI0 string/t N#!\ rnews mailed, batched news text 12b6cee71dSXin LI!:mime message/rfc822 13b6cee71dSXin LI0 string/t Forward\ to mail forwarding text 14b6cee71dSXin LI!:mime message/rfc822 15b6cee71dSXin LI0 string/t Pipe\ to mail piping text 16b6cee71dSXin LI!:mime message/rfc822 17b6cee71dSXin LI0 string/tc delivered-to: SMTP mail text 18b6cee71dSXin LI!:mime message/rfc822 19b6cee71dSXin LI0 string/tc return-path: SMTP mail text 20b6cee71dSXin LI!:mime message/rfc822 21b6cee71dSXin LI0 string/t Path: news text 22b6cee71dSXin LI!:mime message/news 23b6cee71dSXin LI0 string/t Xref: news text 24b6cee71dSXin LI!:mime message/news 25b6cee71dSXin LI0 string/t From: news or mail text 26b6cee71dSXin LI!:mime message/rfc822 2743a5ec4eSXin LI0 string/t Date: news or mail text 2843a5ec4eSXin LI!:mime message/rfc822 29b6cee71dSXin LI0 string/t Article saved news text 30b6cee71dSXin LI!:mime message/news 31d38c30c0SXin LI# Reference: http://quimby.gnus.org/notes/BABYL 32d38c30c0SXin LI# Update: Joerg Jenderek 33d38c30c0SXin LI# Note: used by Rmail in Emacs version 22 and before 34d38c30c0SXin LI# is not text because of characters like Control-L Control-_ 35d38c30c0SXin LI0 string/b BABYL\ OPTIONS: Emacs RMAIL 36d38c30c0SXin LI#0 string/t BABYL Emacs RMAIL text 37d38c30c0SXin LI# https://reposcope.com/mimetype/message/x-gnu-rmail 38d38c30c0SXin LI!:mime message/x-gnu-rmail 39d38c30c0SXin LI# ~/RMAIL 40d38c30c0SXin LI!:ext / 41b6cee71dSXin LI0 string/t Received: RFC 822 mail text 42b6cee71dSXin LI!:mime message/rfc822 43b6cee71dSXin LI0 string/t MIME-Version: MIME entity text 44b6cee71dSXin LI#0 string/t Content- MIME entity text 45b6cee71dSXin LI 46b6cee71dSXin LI# TNEF files... 47a2dfb722SXin LI# URL: http://fileformats.archiveteam.org/wiki/Transport_Neutral_Encapsulation_Format 48a2dfb722SXin LI# https://en.wikipedia.org/wiki/Transport_Neutral_Encapsulation_Format 49a2dfb722SXin LI# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tnef.trid.xml 50a2dfb722SXin LI# https://interoperability.blob.core.windows.net/files/MS-OXTNEF/%5bMS-OXTNEF%5d-210817.pdf 51a2dfb722SXin LI# Update: Joerg Jenderek 52a2dfb722SXin LI# Note: moved and merged from ./msdos (version 1.154) there just called "TNEF" 53a2dfb722SXin LI# partly verified by `tnef --list -v -f voice.tnef` and `ytnef -v triples.tnef` 54a2dfb722SXin LI# TNEF magic From "Joomy" <joomy@se-ed.net> 55a2dfb722SXin LI# TNEF_SIGNATURE 56a2dfb722SXin LI0 lelong 0x223E9F78 Transport Neutral Encapsulation Format (TNEF) 57b6cee71dSXin LI!:mime application/vnd.ms-tnef 58a2dfb722SXin LI# winmail.dat or win.dat by Microsoft Outlook 59a2dfb722SXin LI!:ext tnef/dat 60a2dfb722SXin LI# https://docs.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxtnef/7fdb64ee-7f63-4d95-9af1-c672e7475c3a 61a2dfb722SXin LI# LegacyKey 62a2dfb722SXin LI#>4 uleshort x \b, key %#4.4x 63a2dfb722SXin LI# attrLevelMessage; Level where attribute applies like: 1~attrLevelMessage 2~attrLevelAttachment 64a2dfb722SXin LI>6 ubyte !1 \b, 1st level %#2.2x 65a2dfb722SXin LI# other ID (like 02900000h) or TnefVersion ID (idTnefVersion=06900800h) 66a2dfb722SXin LI>7 ubelong !0x06900800 \b, 1st id %#8.8x 67a2dfb722SXin LI>7 ubelong =0x06900800 68*898496eeSXin LI# TnefVersion length like: 4 69a2dfb722SXin LI>>11 ulelong !4 \b, TnefVersion length %x 70a2dfb722SXin LI# TNEFVersionData; TnefVersion data like: 00010000h 71a2dfb722SXin LI>>15 ulelong !0x00010000h \b, version %#8.8x 72a2dfb722SXin LI# Checksum like: 1 73a2dfb722SXin LI>>19 uleshort !1 \b, checksum %#4.4x 74a2dfb722SXin LI# attrLevelMessage; level of attOemCodepage like: 1 75a2dfb722SXin LI>>21 ubyte !1 \b, level %#2.2x 76a2dfb722SXin LI# idOEMCodePage; OEMCodePage ID like: 07900600h 77a2dfb722SXin LI>>22 ubelong =0x07900600 \b, OEM codepage 78a2dfb722SXin LI# OEMCodePage length like: 8 79a2dfb722SXin LI>>>26 ulelong =8 80a2dfb722SXin LI# OEMCodePageData; PrimaryCodePage like: 1251 1252 81a2dfb722SXin LI>>>>30 ulelong x %u 82a2dfb722SXin LI# OEMCodePageData; SecondaryCodePage; unused and SHOULD contain zero 83a2dfb722SXin LI>>>>34 ulelong !0 and %u 84a2dfb722SXin LI# OEMCodePageData Checksum like: E7h E8h 85a2dfb722SXin LI>>>>38 uleshort x (checksum %#x) 86a2dfb722SXin LI# attrLevelMessage of attMessageClass like: 1 87a2dfb722SXin LI>>40 ubyte !1 \b, level %u 88a2dfb722SXin LI# idMessageClass; ID of attMessageClass like: 08800700h 89a2dfb722SXin LI>>41 ubelong =0x08800700 \b, MessageAttribute 90a2dfb722SXin LI# attMessageClass length like: 16 24 25 91a2dfb722SXin LI#>>>45 ulelong x (length %u) 92a2dfb722SXin LI# attMessageClass data like: "IPM.Microsoft Mail.Note" "IPM.Note.Portada Newseum" 93a2dfb722SXin LI# "IPM.Appointment" "IPM.Note.Microsoft.Voicemail.UM.CA" 94a2dfb722SXin LI>>>45 pstring/l x "%s" 95b6cee71dSXin LI 96b6cee71dSXin LI# From: Kevin Sullivan <ksulliva@psc.edu> 97b6cee71dSXin LI0 string *mbx* MBX mail folder 98b6cee71dSXin LI 99b6cee71dSXin LI# From: Simon Matter <simon.matter@invoca.ch> 100b6cee71dSXin LI0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 1019fc5c47fSXin LI0 string \241\002\213\015twoskip\ file\0\0\0\0 Cyrus twoskip DB 102b6cee71dSXin LI 103b6cee71dSXin LI# JAM(mbp) Fidonet message area databases 104b6cee71dSXin LI# JHR file 105b6cee71dSXin LI0 string JAM\0 JAM message area header file 106b6cee71dSXin LI>12 leshort >0 (%d messages) 107b6cee71dSXin LI 108b6cee71dSXin LI# Squish Fidonet message area databases 109b6cee71dSXin LI# SQD file (requires at least one message in the area) 110b6cee71dSXin LI# XXX: Weak magic 111b6cee71dSXin LI#256 leshort 0xAFAE4453 Squish message area data file 112b6cee71dSXin LI#>4 leshort >0 (%d messages) 113b6cee71dSXin LI 114b6cee71dSXin LI#0 string \<!--\ MHonArc text/html; x-type=mhonarc 115b6cee71dSXin LI 116b6cee71dSXin LI# Cyrus: file(1) magic for compiled Cyrus sieve scripts 11748c779cdSXin LI# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php 118b6cee71dSXin LI# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master 119b6cee71dSXin LI# From: Philipp Hahn <hahn@univention.de> 120b6cee71dSXin LI 121b6cee71dSXin LI# Compiled Cyrus sieve script 122b6cee71dSXin LI0 string CyrSBytecode Cyrus sieve bytecode data, 123b6cee71dSXin LI>12 belong =1 version 1, big-endian 124b6cee71dSXin LI>12 lelong =1 version 1, little-endian 125b6cee71dSXin LI>12 belong x version %d, network-endian 12643a5ec4eSXin LI 12743a5ec4eSXin LI# Dovecot mail server, version 2.2 and later. 12843a5ec4eSXin LI# Dovecot mailing list: dovecot@dovecot.org 12943a5ec4eSXin LI# File format spec: https://wiki.dovecot.org/Design/Dcrypt/#File_format 13043a5ec4eSXin LI# From: Stephen Gildea 13143a5ec4eSXin LI0 string CRYPTED\003\007 Dovecot encrypted message 13243a5ec4eSXin LI>9 byte x \b, dcrypt version %d 133