An incident has been detected, but you cannot see the violating text within the file triggering the incident. Is there a way to detect if there is information hidden?
Many files can contain data from other files via OLE attachments. There is a utility called tstextract.exe which can extract OLE attachments which have triggered an incident.
From a command prompt, change directory to the Vontu product tree:
For v10.5 and previous:
For v11 and above:
Windows 32-bit: C:\Vontu\Protect\plugins\contentextraction\Verity\Win32
Windows 64-bit: C:\Vontu\Protect\plugins\contentextraction\Verity\x64
Linux 32-bit: /opt/Vontu/Protect/plugins/contentextraction/Verity/i686
Linux 64-bit: /opt/Vontu/Protect/plugins/contentextraction/Verity/x86_64
Find the program called “tstxtract.”
Type: tstxtract <name of input file> <name of output directory>. The input file will be the original message. The output directory contains one or more hidden files. These files should be examined after running filter.exe to examine the extracted content.
See TECH220141: How to use filter.exe to determine if a message was parsed correctly
See also TECH222006: What is a _kv0 temp file?
Imported Document ID: TECH218893
Subscribing will provide email updates when this Article is updated. Login is required.