Extract invisible attachment

I periodically get email from ios users with invisible attachments.

TLDR: view raw, save base-64 to text, uudecode using certutil --decode (a native tool in Win7+)

Last night I finally figured out what is going on: the attachment is marked as "inline" in the header, but the client (gmail in this case, but can happen with others too) doesn't render the attachment correctly. However since the media is inline it's not visible/extractable like regular attachments are.

Symptoms#

• Email says there is in attachment (e.g. has a paperclip), but there is no place to click and save or download the attachment
• broken image icon in message body

The fix#

• view original/raw message
• Find Content-Disposition: attachment; filename="some_filename.pdf" and save everything between Content-Id: <AAA888...> and --Apple-Mail-AAA888...-- lines (don't include those lines) to a text file, e.g. some_filename.uue
• open command shell and run certutil -decode some_filename.uue some_filename.pdf

Sources#

• Fowarded emails with attachments not showing up with paperclip icon, https://productforums.google.com/forum/#!topic/gmail/Mdujqj1zUic
• Message with pdf attachment doesn't show as having an attachment, https://productforums.google.com/forum/#!topic/gmail/LbUIrEqzRXE
• Super User: How can I extract an attachment from the email body (encoded as base64)
• Dick on http://johnsad.ventures/software/base64encoderdecoder/ for the certutil tip

---

date: 2015-05-11
tags: [fixes]
category: Fixes