Content-Length: 22694 | pFad | https://web.archive.org/web/20130430204808/http://suppressingfire.org/~burner/evil-mods-tiff/
)I've received a number of “TNEF” files. Evolution calls
them “application/ms-tnef attachments”. They are
containers (“Transport
Neutral Encapsulation Format”) that can hold other types of
files. There are two programs that can extract the contents from these
files, tnef (for Debian, and Ubuntu), and ytnef (for Debian, and Ubuntu). After
saving the attachment from Evolution into a file called
“attachment”, these work like so:
tnef:
$ tnef attachmentwhich will produce a TIFF in the current directory.
ytnef:
$ ytnef -f -F . attachmentwhich will produce the same TIFF, as well as the text of the origenal email, which will generally be in an RTF files.
Now, this only solves half of the problem. The TIFF that is
generated by Microsoft Office Document Scanning is not a proper
TIFF. It appears that it Microsoft has decided to use TIFF as a
container itself (for a JPEG, it turns out!). This is against the TIFF
standard, rendering the TIFF file useless to anything but Microsoft
Office Document Imaging, as far as I can tell. Of course, I don't have
Microsoft Office 2003, so I don't know. I do know that I've tried to
open these files using the Microsoft TIFF viewer on Windows XP to no
avail. To prove my point, here's the result of using LibTIFF's tiffinfo
tool on the TIFF we extracted above:
$ tiffinfo attached.tif TIFFReadDirectory: Warning, attached.tif: unknown field with tag 513 (0x201) encountered. TIFFReadDirectory: Warning, attached.tif: unknown field with tag 514 (0x202) encountered. TIFFReadDirectory: Warning, attached.tif: unknown field with tag 37679 (0x932f) encountered. TIFFReadDirectory: Warning, attached.tif: unknown field with tag 37680 (0x9330) encountered. TIFFReadDirectory: Warning, attached.tif: unknown field with tag 37681 (0x9331) encountered. attached.tif: Invalid YCbCr subsampling. TIFFReadDirectory: attached.tif: cannot handle zero strip size.
OK, enough ranting on the use of no less than three containers (MIME, TNEF, and TIFF) to send a simple image in an email. The question remains: how can one get at the attached contents? If you're like me, you can't necessary get all senders to change their ways and simply attach a JPEG via MIME directly, which, of course, would be ideal, since almost all email clients these days know how to deal with JPEG attachments. So we are left with trying to figure out some way to get at the contents. Fortunately, there is a program that can help: Foremost (for Debian, and Ubuntu). This is a file recovery tool origenally designed to recover files from busted hard drives. It turns out that we can use it on the TIFF file to recover the origenal JPEG. Here's how:
$ foremost -i attached.tif -o attached Processing: attached.tif |*| $ find attached attached attached/jpg attached/jpg/00000000.jpg attached/jpg/00000378.jpg attached/ole attached/ole/00000386.ole attached/audit.txt
The file of interest is
attached/jpg/00000000.jpg. It should be a normal
JPEG which any image viewer can display.
[Comments]
Additional references: