Add a custom Archive Unpacker to unpack a new file type

This article applies to:

• Trustwave MailMarshal (SEG) 6.X and above
• Trustwave ECM/MailMarshal Exchange 7.X

Question:

• How can I unpack and scan content in unknown archive types?

Procedure:

SEG/MailMarshal allows you to add custom file type recognition, and to specify new archive unpackers. By combining these features, it is possible to unpack and scan the content of a custom archive type with full functionality.

Notes: 

• This procedure requires advanced skills. Most organizations do not require this configuration and you should only use it if you have a specific need to customize operation.
• Only Archive unpackers can be specified. You cannot specify custom handling for compound documents such as Word or PDF documents.

The procedure consists of three steps:

1. Add a Custom Filetype
2. Add a Custom Archive Type
3. Configure the Custom Unpacker

This article uses as an example the Switch file unpacker from Egress (http://www.egress.com/). Switch files are not recognized by MailMarshal default configuration, and MailMarshal does not include functionality to unpack them.  

Note: All the registry entries referred to below are added under the MailMarshal Engine key, which for MailMarshal SMTP 8.X is typically: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine

For MailMarshal (SEG) 10.X the entries are made in the Management Console Advanced settings with the prefix Engine. (Engine dot).

For other versions, use the following Trustwave Knowledgebase article to locate the Registry key if necessary:

• Q10832: What are the Trustwave SEG install paths and registry key locations?
• Q14003: What are the MailMarshal Exchange install paths and registry key locations?

Step 1: Add Custom Filetype

Add the custom filetype as described in this Trustwave Knowledgebase article: Q10199: How do I add custom file type definitions to MailMarshal?

For this example, make the following entry:

T:SWCH
D:Egress Switch Archive
X:0=53 44 01 00 01 02

Note: This is an example only - Egress Switch file type is already included in the default types recognized by MailMarshal.

2 – Add Custom Archive Types

Create a new registry string value called ArchiveTypes (MailMarshal (SEG) 10: advanced setting Engine.ArchiveTypes). For this example, enter the value as SWCH   

3 – Configure the Custom Unpacker

Add the new unpacker executable to the MailMarshal install folder on all the MailMarshal email processing nodes. In this example, the executable is swtool.exe

Add a new string value with the name of the custom archive type (for this example, SWCH or in MailMarshal (SEG) 10: Engine.SWCH). Set the value data according to this format: