0

I have had an email sent with an attachment which was a zip file. For some reason the email client has not attached it as a seperate file, and simply rendered it as text in the email. There is no other copy of the zip file. I am trying to recover it but do not know if it is possible. The email shows the file like this in text;

>Content-Type: application/x-zip-compressed; name="me.zip";
>
>Content-Disposition: attachment; filename="me.zip"
>
>Content-Transfer-Encoding: base64
>
>
>
>UEsDBBQAAQAIANeV9y5y6d5oG..... etc.

It just continues with random letters for ages. Does anyone know if it is at all possible to recover such a file?

Thanks for any pointers.

creatiive
  • 1,073
  • 21
  • 49
  • I would just ask the person to send the zip again ... correctly. –  Jun 21 '12 at 23:13
  • make an empty .txt file, paste the UEsD... text into it. Rename the file to .zip and see if it works? I have no idea but I'd give it a go.. –  Jun 21 '12 at 23:13

2 Answers2

2

It is a base64 encoded file, you can simply decode the base64-encoded characters and output the result to a file (which will be binary data since it's encrypted, so will look even more weird).

The clue is in the Content-Transfer-Encoding header.

Rudi Visser
  • 21,350
  • 5
  • 71
  • 97
  • Well the zip file is encrypted - so you're saying I can just decode this and then output to a file and rename to .zip? – creatiive Jul 18 '12 at 08:19
  • @creative In theory, yes that is what you would do. – Rudi Visser Jul 18 '12 at 08:24
  • I copied the text in to the website http://www.base64decode.org/. I then copied the translation and saved it as a text file, then renamed it to .zip. You can see the base64 decoding seems to have worked because looking at the text, the file names in the zip are there to see! But when I try and open the zip it says "unexpected end of archieve". Feel so close now because I can see the file names... but maybe im missing some end chars in the file? – creatiive Nov 28 '12 at 12:51
  • The output charset i used on the site was UTF-8, and I saved the text file as the same... is that right? – creatiive Nov 28 '12 at 12:55
  • @creative Is it part of a multipart data transfer? Or is all of the data in one lump? – Rudi Visser Nov 28 '12 at 12:56
0

I used the code located here to fix this. The online base64 decoders were not working but it worked via this code snippet. Just a copy and paste with no modifications needed;

http://msdn.microsoft.com/en-us/library/system.convert.frombase64string%28v=vs.110%29.aspx

public void DecodeWithString() {
   System.IO.StreamReader inFile;    
   string base64String;

   try {
      char[] base64CharArray;
      inFile = new System.IO.StreamReader(inputFileName,
                              System.Text.Encoding.ASCII);
      base64CharArray = new char[inFile.BaseStream.Length];
      inFile.Read(base64CharArray, 0, (int)inFile.BaseStream.Length);
      base64String = new string(base64CharArray);
   }
   catch (System.Exception exp) {
      // Error creating stream or reading from it.
      System.Console.WriteLine("{0}", exp.Message);
      return;
   }

   // Convert the Base64 UUEncoded input into binary output. 
   byte[] binaryData;
   try {
      binaryData = 
         System.Convert.FromBase64String(base64String);
   }
   catch (System.ArgumentNullException) {
      System.Console.WriteLine("Base 64 string is null.");
      return;
   }
   catch (System.FormatException) {
      System.Console.WriteLine("Base 64 string length is not " +
         "4 or is not an even multiple of 4." );
      return;
   }

   // Write out the decoded data.
   System.IO.FileStream outFile;
   try {
      outFile = new System.IO.FileStream(outputFileName,
                                 System.IO.FileMode.Create,
                                 System.IO.FileAccess.Write);
      outFile.Write(binaryData, 0, binaryData.Length);
      outFile.Close();
   }
   catch (System.Exception exp) {
      // Error creating stream or writing to it.
      System.Console.WriteLine("{0}", exp.Message);
   }
}
creatiive
  • 1,073
  • 21
  • 49