Many files can contain data from other files via OLE attachments. There is a utility called tstextract.exe which can extract OLE attachments which have triggered an incident.
- From a command prompt, change directory to the Vontu product tree:
- For v10.5 and previous:
- Windows: C:\Vontu\Protect\lib\native
- Linux: /opt/Vontu/Protect/lib/native
- For v11 and above:
- Windows 32-bit: C:\Vontu\Protect\plugins\contentextraction\Verity\Win32
- Windows 64-bit: C:\Vontu\Protect\plugins\contentextraction\Verity\x64
- Linux 32-bit: /opt/Vontu/Protect/plugins/contentextraction/Verity/i686
- Linux 64-bit: /opt/Vontu/Protect/plugins/contentextraction/Verity/x86_64
- Find the program called “tstxtract.”
- Type: tstxtract <name of input file> <name of output directory>.
The input file will be the original message. The output directory contains one or more hidden files. These files should be examined after running filter.exe to examine the extracted content.
See TECH220141: How to use filter.exe to determine if a message was parsed correctly
See also TECH222006: What is a _kv0 temp file?