“Decoding” Certain Email Attachments

There may be instances every so often where you receive an email attachment but it’s nothing but a raw file. And what’s in that file is important information you need to get to.

For example, SpamAssassin (a server-based mail server spam tool) will at times false-flag a message as spam. What happens is that the message is marked, and the original is attached as a raw file, like this:

The above is Mozilla Thunderbird, but this can happen with any email client.

The "Part 1.2" attachment at the bottom is the unfiltered message.

How do we "decode" it? This can be done easily by saving it locally, then renaming with an .eml extension and double-clicking to view.

First, save the attachment locally. In Thunderbird this is done by right-clicking and Save As.., like this:

Were you using Windows Live Mail or Outlook you can similarly save any attachment locally as you normally would. I recommend placing it on the desktop for quick access.

The file saved at this point is raw and probably has no extension to it. Simply right-click and rename:

Rename the file by adding a .eml at the tail:

You may get a notice like this on attempt to rename:

Click Yes if you see this.

And now the file is a clickable email document:

Your icon may look different. If you use Outlook or Windows Live Mail for example, you will see an envelope icon. Being I use Thunderbird I see a Thunderbird icon.

At this point, double-click to open:

..and that’s all there is to it. You will see the email in its originally unfiltered/unmodified form.

How often can this happen?

These are the instances where you would see raw file attachments:

Bounced delivery

You email somebody but the server spits back an "unknown recipient" at you. This by-server reply contains an attachment of the original message in raw format. The only way to get to the original message is by saving local and rename with .eml as outlined above.

Attached forwarded messages

There are two types of forwarded emails. Those that have the forward inline and those that have it attached. The vast majority of people use inline forwarding (including all web-based mail), but there are some out there who still use the attached method. If whatever they forwarded didn’t "translate" correctly and was attached as a raw file, you will need to save it local and rename as outlined above.

If there’s somebody who forwards you emails routinely but you always have a problem opening the forwarded message in your mail client, it’s most likely because the forward is attached and not inline.