Trustwave File Type Release Notes

Last Revision: September 11, 2023

The File Type module is used by Trustwave MailMarshal (SEG), Trustwave ECM, and WebMarshal. Updates are made available for recent versions through the Automatic Updates service. Each product release includes the current update of FileType.

Note: File extensions are provided in this document for reference only. File Type recognizes files based on their structure and not by the file name or extension.

New Features

For more information about additional minor features and bug fixes, see the release history.

Features new in 2023.03.01

File Type release versions now are numbered by the calendar year and quarter
RAR archives with only some files password encrypted are correctly detected and usable files are passed to the unpacker..
Additional type recognized
- Personal Information Exchange certificate archives (.PFX)
- PKCS #12 certificate archives (.P12)

Features new in 8.2.9

Additional type recognized
- Virtual Hard Disk Image (.VHD)
- Windows Installer Setup Transform (.MST)

Features new in 8.2.7

Additional type recognized
- Navisworks drawing (.NWD)

Features new in 8.2.5

Additional types recognized
- GNU Privacy Guard encrypted (.GPG)
- PERL Encoded (.ENC)
- Solidworks CAD (.SPDPRT, .SLDASM, .SLDDRW, .SLDDRT)

Features new in 8.2.4

Additional type recognized
- High Efficiency Image File Format (.HEIC/HEIF)

Features new in 8.2.3

Additional type recognized
- Universal Disk Format (.UDF)

Features new in 8.2.1

File Type DLL 8.2.1 must be used with Unpacker DLL 8.2.0 or above
- This requirement is to ensure that XML files unpacked from Office documents are correctly handled.
Additional types recognized
- Encrypted PowerPoint 2003 files (.PPT and .PPS, logged as PPTcrypt and PPScrypt)

Shapefile files (.SHP) and Shapefile Index files (.SHX)
VBScript (.VBS)
Quickbooks Company files (.QBW)

Features new in 8.2.0

A new group is included for Azure IRM protected documents
Additional types recognized
- Azure RMS Restricted Permission Message (RPMSG)
- Azure RMS Restricted Permission File (PFILE)
- Decrypted Azure RMS Restricted Permission File (RPMSGPlain)
- MSIX packaging files (.MSIX)
- OCSP response files (additional .DER files)
- Password protected Excel document with IRM
- Password protected PowerPoint Presentation with IRM
- Password protected PowerPoint Show with IRM
- Password protected Word document with IRM
- Powerpoint show with IRM (.PPS or .PPSX)
- XML files (previously recognized as text)
- Zip64 (extension to .ZIP for larger files)

For earlier updates, see previous versions of Release Notes.

Release History

The following items have been changed or updated in the specific build versions of FileType listed.

2023.03.01 (September 11, 2023)

FT-281	RAR archives with only some files password encrypted are correctly detected and usable files are passed to the unpacker.
FT-290	File Type release versions now are numbered by the calendar year and quarter.
FT-292	P12 and PFX certificate files are recognized.
FT-295	Specific Windows executable files were not recognized. Fixed.
FT-296	Specific message body text was incorrectly treated as an attached email message. Fixed.

8.2.9 (March 28, 2023)

FT-283	The text name of "Office 2007" (Excel, Powerpoint, Word) documents is updated to "2007+" to better reflect that this type covers all current versions of these documents.
FT-284	.VHD virtual hard disk image files are recognized.
FT-285	Some versions of .NWD files were not recognized. Fixed.
FT-286	.MST files (Windows Installer Setup Transform) are recognized separately from .MSI files.
FT-288	The FileType DLL ensures the presence of the required Visual Studio 2022 runtime in all required locations.

8.2.8 (September 28, 2022)

FT-277	Unencrypted RAR5 files could be detected as encrypted. Fixed: parsing of RAR5 structure is improved.
FT-278	Certain text files could be falsely detected as type EXE. Fixed.

8.2.7 (June 27, 2022)

FT-37	COM files embedded in Bitmap files are detected.
FT-272	Performance is enhanced when detecting types that map to multiple file name extensions.
FT-273	Navisworks drawing files (.NWD) are recognized.
FT-274	Certain text files could be falsely detected as type ASF. Fixed.

8.2.6 (October 4, 2021)

FT-270

Some recent Egress Switch files were not correctly recognized. Fixed.

8.2.5 (July 7, 2021)

FT-137	PERL Encoded files (.ENC) are recognized.
FT-230	Solidworks CAD files (.SPDPRT, .SLDASM, .SLDDRW, .SLDDRT) are recognized.
FT-265	GNU Privacy Guard encrypted (.GPG) files are recognized.

8.2.4 (March 22, 2021)

FT-179

High Efficiency File Format (.HEIC/HEIF) files are recognized.

8.2.3 (October 6, 2020)

FT-144	Universal Disk Format (.UDF) files are recognized.
FT-161	Custom file type definitions were incorrectly duplicated and stored in configuration, causing issues in rare cases. Fixed.
FT-263	Flash objects contained in PDF documents are recognized.

8.2.2 (October 22, 2019)

FT-234	The XML file type could not be selected in user interfaces. Fixed: XML is added to the group "Other".
FT-236	RAR files between 20 and 100 bytes in size were not correctly detected. Fixed.

8.2.1 (January 24, 2019)

FT-134	Shapefile (SHP) and Shapefile Index (SHX) files are recognized.
FT-153	QuickBooks Company files (QBW) are recognized.
FT-160	VBScript files were recognized as JavaScript. Fixed: VBScript (VBS) is added as a separate type.
FT-181	MSI and CAB files are included in the Executable group as well as the Archive group.
FT-182	7zip files are not checked for encryption at the partial download stage.
FT-231	Encrypted PowerPoint 2003 files are recognized.

8.2.0 (December 6, 2018)

This release is provided in the installation package of SEG 8.2.0 and 8.2.1.

FT-127	XML files are recognized by type.
FT-186	PEM encoded certificates have been moved from the "Encrypted" group to the "Other" group because the certificates are not encrypted content.
FT-192	OCSP response files are recognized.
FT-194	MSIX response files are recognized.
FT-210	Larger CRL files are recognized.
FT-220	Detection of Excel and PowerPoint documents with IRM has been updated for Azure RMS.
FT-222	Password protected Office documents with IRM are recognized.
FT-225	Zip64 files are recognized.

For earlier updates, see previous versions of Release Notes.

Legal Notice

All rights reserved. This document is protected by copyright and any distribution, reproduction, copying, or decompilation is strictly prohibited without the prior written consent of Trustwave. No part of this document may be reproduced in any form or by any means without the prior written authorization of Trustwave. While every precaution has been taken in the preparation of this document, Trustwave assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.

While the authors have used their best efforts in preparing this document, they make no representation or warranties with respect to the accuracy or completeness of the contents of this document and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the author nor Trustwave shall be liable for any loss of profit or any commercial damages, including but not limited to direct, indirect, special, incidental, consequential, or other damages.

Trademarks

Trustwave and the Trustwave logo are trademarks of Trustwave. Such trademarks shall not be used, copied, or disseminated in any manner without the prior written permission of Trustwave.

About Trustwave®

Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave Fusion® cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com.