This article applies to:

• Trustwave MailMarshal (SEG) 6.4

Question:

• Microsoft IRM Protected Documents not recognized as encrypted

Resolution:

Workaround:

With MailMarshal SMTP 6.4, the following signatures can be used to identify IRM protected documents.   

-Microsoft Word 1997-2003

T: IRMDOC
D: Microsoft IRM Documents
X: 2202=44 00 52 00 4d 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74

-Microsoft Office 2007 IRM Docs

T: IRM2K7
D: Microsoft Office 2007 IRM Docs
X: 2236=44 00 52 00 4d 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64

NOTE: Files that are identified as a custom file type will not be unpacked for analysis by the MailMarshal Engine.

When you upgrade, you must remove these custom filetypes in order to use the updated functionality.

Notes:

See the following Trustwave Knowledgebase article for more information:

• Q10199 : How do I add custom file type definitions to MailMarshal?