Determining file type using filter.exe in DLP
search cancel

Determining file type using filter.exe in DLP

book

Article ID: 160374

calendar_today

Updated On:

Products

Data Loss Prevention Enforce Data Loss Prevention

Issue/Introduction

How to check the file type of your file to make sure it matches the extension in Symantec Data Loss Prevention (DLP).

Environment

Data Loss Prevention 15.x.

Resolution

Our content extractor does file type checking. 
Using the -d option on filter.exe will show the file type as a number.

Note for Windows: Substitute C: for the drive letter where the DLP software is installed.

Note for Linux: If running the filter executable as the protect user, you may need to log in as root and grant permissions for the protect user to execute the binary. To do this, type: chmod u+x / (see below)

Windows: C:\Program Files\Symantec\DataLossPrevention\KeyView\12.5\Protect\plugins\contentextraction\Verity\x64\filter -d out.txt

Linux: /opt/Symantec/DataLossPrevention/KeyView/12.5/Protect/plugins/contentextraction/Verity/x86_64/filter -d out.txt

The output file (out.txt) is not created but is a required field.

 

Here are some sample outputs:

C:\Program Files\Symantec\DataLossPrevention\KeyView\12.5\Protect\plugins\contentextraction\Verity\x64\filter.exe -d "myeml.eml" out.txt
The file myeml.eml
Class ID:                       8
Format ID:                      232
Major Version:                  0
Attributes:                     0

KWAD: error code returned is KVERR_Success

C:\Program Files\Symantec\DataLossPrevention\KeyView\12.5\Protect\plugins\contentextraction\Verity\x64\filter.exe -d sample.txt out.txt
The file sample.txt
Class ID:                       1
Format ID:                      2
Major Version:                  0
Attributes:                     0

KWAD: error code returned is KVERR_Success

C:\Program Files\Symantec\DataLossPrevention\KeyView\12.5\Protect\plugins\contentextraction\Verity\x64\filter.exe -d test.xls out.txt
The file test.xls
Class ID:                       2
Format ID:                      322
Major Version:                  0
Attributes:                     1

KWAD: error code returned is KVERR_Success