How does MailWatch detect attachments?
After receipt, the message is broken down recursively into its component parts. These components may be encoded (i.e. UUENCODE, BinHEX, MIME), compressed (i.e. PKZIP, ARC, CAB, AR),. If the component represents an archive, such as a PKZIP file, MailWatch will extract and process each file until it is recognized as a raw data type. Examples of raw data include text files, bitmaps, binary files and executables. Recursive disassembly ensures that all the data is identified, even if the information is compressed, encoded, nested, or incorporates a variety of these techniques. Because MailWatch does not identify a message component based upon the file extension, users are prevented from simply renaming files to avoid detection.
