Multipart archive files receive the Unscannable verdict

Products

• Messaging Gateway

Issue/Introduction

Symantec Messaging Gateway may not detect all parts of a ZIP file split between multiple different messages. The first and last parts will be correctly identified as a zip archive but messages containing the intermediate file parts are not identified as containing an archive file. Instead these messages are assigned the unscannable verdict. 

Cause

This issue is specific to zip files constructed and split with PKZip. While the first and last file parts are detectable as zip archive parts, the intermediate file parts do not contain suffficient identifying information to correctly file type them. Since the file type for these archive parts cannot be reliably determined, they are considered unscannable and the message is assigned the unscannable verdict.

Resolution

This is currently expected behavior for Messaging Gateway although handling of multipart archives may be altered at a future date.