INFO: What file types are recognized by Trustwave SEG and ECM?

Expand / Collapse
 

INFO: What file types are recognized by Trustwave SEG and ECM?


This article applies to:

  • Trustwave SEG/MailMarshal SMTP 6.X and above
  • Trustwave ECM/MailMarshal Exchange 5.2 and above

Question:

  • What file types are recognized by Trustwave SEG?
  • What file types are recognized by Trustwave ECM 5.2 and above?  

Information:

The following formats are recognized by current SEG and ECM versions (SEG/MailMarshal SMTP 6.X, 7.X, 8.X, and ECM/MailMarshal Exchange 5.2 and above).

Notes:

  • Some types are recognized only in the latest versions of SEG or ECM, as noted. 
  • With SEG 7.3.5 and above, additional types are recognized with specific updates to the File Type DLL. For information about the File Type update for each SEG version, see article Q20446.
    • File Type updates are distributed through the SEG Automatic Updates to installations with current maintenance.
  • Items specifically noted as recognized in SEG 7.2 or above are not recognized in MailMarshal Exchange/ECM. All other types listed are recognized by MailMarshal Exchange/ECM 5.2 and above.
Executable
  • 7Zip self extracting archive (recognized in 6.4 and above)
  • ACE self extracting archive
  • ARJ encrypted self extracting archive
  • ARJ self extracting archive
  • InstallShield CAB Archive
  • Java class file
  • Macintosh M68k executable
  • Macintosh PPC executable
  • Microsoft CAB/Expand Archive
  • MSDOS Com executable
  • MS-DOS Executable
  • MSI Windows Installer Package
  • MSIX Windows Installer Package (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • NetWare Loadable Module
  • OS/2 16bit executable
  • OS/2 32bit DLL
  • OS/2 32bit Executable
  • Python bytecode file (FileType 7.14.3 and above, 8.0.1 and above)
  • RAR encrypted self extracting archive
  • RAR self extracting archive
  • SEA encrypted self extracting archive
  • SEA self extracting archive
  • UNIX CIF Executable
  • UNIX COFF Executable
  • UNIX ELF Executable
  • Win16 DLL
  • Win16 executable
  • Win16 VXD or OS/2 DLL
  • Win32 DLL
  • Win32 executable
  • ZIP encrypted self extracting archive
  • ZIP self extracting archive
Image
  • Adobe Photoshop Image
  • Bitmap image
  • Corel Photo-Draw Image
  • Encapsulated PostScript
  • Enhanced MetaFile Image
  • Gif image
  • Icon
  • Jpeg image
  • JBIG2 image (SEG 7.2.3 and above)
  • Jpeg2000 image (recognized in 6.5 and above)
  • Microsoft ClipArt Gallery
  • Microsoft PhotoDraw Image
  • Paint Shop Pro image
  • Portable Network Graphics (PNG)
  • Tiff image
  • WebP Image File (FileType 7.14.3 and above, 8.0.1 and above)
  • Windows MetaFile Image
  • Windows HD Photo (SEG 7.2.2 and above)
  • Zsoft PCX Image
Video
  • 3GPP Video (SEG 7.2.2 and above)
  • Adobe Flash Audio (SEG 7.2.2 and above)
  • Adobe Flash Video (SEG 7.2.2 and above)
  • Animator Pro FLC file
  • Animator Pro FLI file
  • AVI video
  • DVM video
  • Microsoft Active Streaming link
  • Mov video
  • Mpeg video
  • OGG video (recognized in 6.5 and above)
  • RealPlayer streaming video
  • Shockwave Flash
  • Shockwave Flash video
  • WebM Video File  (FileType 7.14.3 and above, 8.0.1 and above)
  • Windows Active Streaming Format
Sound
  • AAC audio (recognized in 6.5 and above)
  • AU sound file
  • Encore Music Notation .ENC (SEG 7.3.5 and above with FileType 7.13.3 and above)
  • Microsoft Active Streaming link
  • MIDI sound file
  • MP3 sound file
  • OGG audio (recognized in 6.5 and above)
  • Real Audio Link
  • Real Audio sound file
  • Real Jukebox Metadata Package
  • RealPlayer audio/video
  • WAV sound file
  • Windows Active Streaming Format
Document
  • Access database
  • Access system database
  • Acrobat PDF document
  • Acrobat PDF document with invalid header (SEG 7.2.2 and above; see Q16666)
  • Adobe Indesign Document (SEG 7.2.2 and above)
  • Document data
  • DVI TeX document
  • Dynamic XFA form in PDF (SEG 7.3.5 and above)
  • Encrypted Acrobat PDF document
  • Encrypted Excel document (SEG 7.3.5 and above)
  • Encrypted PowerPoint Document (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • Encrypted PowerPoint Show (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • Encrypted Word document
  • Excel document
  • Excel document with IRM (SEG 7.3.5 and above)
  • Excel 2007 document (recognized in 6.3 and above)
  • Excel 2007 document with IRM (SEG 7.3.5 and above)
  • Excel 2007 Binary Document (recognized in 6.4 and above)
    • Includes later versions; see note below.
  • Folio Infobase
  • Lotus 123 FM3 sheet form
  • Lotus 123 WK1 sheet
  • Lotus 123 WK3 sheet
  • Lotus 123 WK4 sheet
  • Lotus 123 WKS sheet
  • Lotus AmiPro document
  • Lotus WordPro document
  • Mac Word document
  • Microsoft Access Database .ACCDB (SEG 7.3.5 and above)
  • Microsoft OneNote (SEG 7.2.2 and above)
  • OLE compound document
  • Open Office chart file (recognized in 6.5 and above)
  • Open Office chart template (recognized in 6.5 and above)
  • Open Office database file (recognized in 6.5 and above)
  • Open Office document file (recognized in 6.5 and above)
  • Open Office document template (recognized in 6.5 and above)
  • Open Office formula file (recognized in 6.5 and above) 
  • Open Office formula template (recognized in 6.5 and above)
  • Open Office global text file (recognized in 6.5 and above)
  • Open Office global text template (recognized in 6.5 and above)
  • Open Office graphics file (recognized in 6.5 and above) 
  • Open Office graphics template (recognized in 6.5 and above)
  • Open Office image file (recognized in 6.5 and above) 
  • Open Office image template (recognized in 6.5 and above)
  • Open Office presentation file (recognized in 6.5 and above)
  • Open Office presentation template (recognized in 6.5 and above)
  • Open Office spreadsheet file (recognized in 6.5 and above)
  • Open Office spreadsheet template (recognized in 6.5 and above)
  • OpenXML Document (SEG 7.2.3 and above)
  • PageMaker document
  • Password protected Excel with IRM (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • Password protected Powerpoint with IRM (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • Password protected Powerpoint Show with IRM (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • Password protected Word with IRM (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • PostScript document
  • PowerPoint document
  • Powerpoint document with IRM (SEG 7.3.5 and above)
  • PowerPoint Show
  • PowerPoint 2007 document (recognized in 6.3 and above)
    • Includes later versions; see note below.
  • Powerpoint 2007 document with IRM (SEG 7.3.5 and above)
  • PowerPoint 2007 show (recognized in 6.5 and above)
  • Project document
  • Protected Acrobat PDF document (recognized in 6.5 and above)
  • Publisher document
  • Quark Express document
  • Rich Text document
  • XPS Document (SEG 7.2.3 and above)
  • Word 2 Document
  • Word 6 Document
  • Word 2007 Document (recognized in 6.3 and above)
    • Includes later versions; see note below.
  • Word 2007 document with IRM (SEG 7.3.5 and above)
  • Word document
  • Word 2007 document with IRM in Word 2003 mode (recognized in 6.5 and above)
  • Word Perfect document
  • Works for Windows document
  • Write document
Archive
  • 7Zip Archive (recognized in 6.4 and above)
  • 7Zip encrypted archive (FileType 7.14.3 and above, 8.0.1 and above)
  • 7Zip self extracting archive (recognized in 6.4 and above)
  • ACE archive
  • ACE self extracting archive
  • Apple iWork Archive .IWA (SEG 7.3.5 and above with FileType 7.14.0 and above)
  • ARC archive
  • ARJ archive
  • ARJ encrypted archive
  • ARJ encrypted self extracting archive
  • ARJ self extracting archive
  • Base64 (MIME) Encoding
  • BtoA Encoding
  • bZIP2 archive
  • CPIO archive
  • Debian Binary Package file (SEG 7.3.5 and above with FileType 7.13.1 and above)
  • GZIP archive
  • HQX (BinHex) archive
  • InstallShield CAB Archive
  • LYME self extracting archive  (SEG 7.2.2 and above)
  • LZH archive
  • MacBinary I, II, or III archive
  • Microsoft CAB/Expand Archive
  • Microsoft SZDD archive (recognized in 6.4.5 and above)
  • MSI Windows Installer package
  • MSIX Windows Installer Package (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1.)
  • RAR archive
  • RAR encrypted archive
  • RAR encrypted self extracting archive
  • RAR self extracting archive
  • RAR spanned archive
  • Redhat Package Manager file (SEG 7.3.5 and above with FileType 7.13.1 and above)
  • SEA encrypted self extracting archive
  • SEA self extracting archive
  • SIT archive
  • SIT encrypted archive
  • TAR archive
  • UUencoded Encoding
  • XZ archive  (FileType 7.14.3 and above, 8.0.1 and above)
  • Z (compress) archive
  • ZIP archive
  • ZIP encrypted archive
  • ZIP encrypted self extracting archive
  • ZIP self extracting archive
  • ZOO archive
Encrypted
  • 7Zip encrypted archive (FileType 7.14.3 and above, 8.0.1 and above)
  • ARJ encrypted archive
  • ARJ encrypted self extracting archive
  • AXCrypt Encrypted Data (SEG 7.2.2 and above)
  • Egress Switch Encrypted Mail (SEG 7.3.5 and above with FileType 7.13.1 and above)
  • Encrypted Acrobat PDF document
  • Encrypted Excel document (SEG 7.3.5 and above)
  • Encrypted PowerPoint Document (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • Encrypted PowerPoint Show (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • Encrypted Word Document
  • Excel document with IRM (SEG 7.3.5 and above)
  • Excel 2007 document with IRM (SEG 7.3.5 and above)
  • MDX Extended Media Descriptor File (FileType 7.14.3 and above, 8.0.1 and above)
  • Password protected Excel with IRM (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • Password protected Powerpoint with IRM (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • Password protected Powerpoint Show with IRM (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • Password protected Word with IRM (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • PGP Encrypted Data
  • PGP Signed Data
  • Powerpoint document with IRM (SEG 7.3.5 and above)
  • Powerpoint 2007 document with IRM (SEG 7.3.5 and above)
  • RAR encrypted archive
  • RAR encrypted self extracting archive
  • SEA encrypted self extracting archive
  • SIT encrypted archive
  • SMime Encrypted Data
  • SMime Signed Data
  • Word 2007 document with IRM (SEG 7.3.5 and above)
  • Word 2007 document with IRM in Word 2003 mode (recognized in 6.5 and above)
  • ZIP encrypted archive
  • ZIP encrypted self extracting archive
  • ZixCorp encrypted mail (SEG 7.3.5 and above)
Drawing
  • Adobe Illustrator drawing
  • AutoCAD Drawing
  • AutoCAD Format
  • Corel Binary Meta file
  • Corel Draw Drawing
  • Drawing Interchange File DXF
  • FloorPlan Plus 3D
  • Freehand drawing
  • Microsoft Visio Drawing
  • Microsoft Visio 2013 Drawing .VSDX (SEG 8.0.1 and above; SEG 7.3.5 through 7.5.7 with FileType 7.14.0.317 and later - see note)
  • StereoLithography Drawing (SEG 7.3.5 and above with FileType 7.13.1 and above)
  • AutoCAD Plotting Support .CTB (SEG 7.3.5 and above with FileType 7.13.3 and above)
Font
  • Embedded OpenType Font (SEG 7.3.0 and above)
  • OpenType Font
  • True Type Font
  • Type 1 Adobe Font Metric
  • Type 1 Printer Font Binary
  • Type 1 Printer Font Metric
  • Web Open Font Format (SEG 7.3.0 and above)
  • Windows Bitmap font
  • XPS Embedded font (ODTTF) (SEG 7.2.3 and above)
Other
  • AppleDouble header
  • AppleSingle formatted file
  • Binary Unknown
  • Bittorent .torrent metainfo file (recognized in 6.5 and above)
  • Clarion TopSpeed .TPS (SEG 7.3.5 and above with FileType 7.13.3 and above)
  • Compiled HTML Help file
  • dBase Memo Field File (FileType 7.14.3 and above, 8.0.1 and above)
  • dBase Multiple Index File (FileType 7.14.3 and above, 8.0.1 and above)
  • dBase/xbase .DBF (SEG 7.3.5 and above with FileType 7.13.3 and above)
  • DOS device driver (SEG 7.2.3 and above)
  • Electronic Business Card .VCF (SEG 7.3.5 and above with FileType 7.14.0 and above)
  • Independent Color Matching .ICM (SEG 7.3.5 and above with FileType 7.13.3 and above)
  • Infoslips document (SEG 7.2.2 and above)
  • Java Object Serialized Data (SEG 7.2.2 and above)
  • Mac OSX Finder Info (SEG 7.2.3 and above)
  • MAPI Encoded data
  • MAPI Off-line Store
  • MAPI Personal Address Book
  • MAPI Personal Store
  • MATLAB Data File (FileType 7.14.3 and above, 8.0.1 and above)
  • Microsoft Debugging Symbols (SEG 7.2.2 and above)
  • Microsoft Program Library (SEG 7.2.3 and above)
  • MS Build Cache File (SEG 7.2.2 and above)
  • MTXWIN95 Registry Command File
  • Office 2007 Macro (recognized in 6.3 and above)
    • Includes later versions; see note below.
  • Oracle Report Definition File (SEG 7.2.2 and above)
  • Outlook Appointment
  • Outlook Contact
  • Outlook message
  • Outlook Note
  • Outlook Task
  • Packet Capture (SEG 7.2.2 and above)
  • Packet Captuer NG (SEG 7.2.3 and above)
  • PEM encoded certificate .PEM (Moved to "other" in January 2019. Recognized in SEG 8.0.1 and above; SEG 7.3.5 through 7.5.7 with FileType 7.14.0.317 and later - see note)
  • PGP Signed Data
  • QuickBooks Backup .QBB (SEG 7.3.5 and above with FileType 7.14.0 and above)
  • QuickBooks Company file .QBW (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • RTF Object
  • Shapefile (.SHP) (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • Shapefile Index (.SHX) (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • SMime Signed Data
  • SQLite Database (SEG 7.2.2 and above)
  • Striata Encrypted Mail Communication (SEG 7.2.3 and above)
  • Text
  • Visual Source Safe Source Code Control (SEG 7.2.3 and above)
  • XML file (from FileType 8.0.5 8.1.2, 8.2.2)
  • Windows Help file
  • Windows Internet shortcut
  • Windows NT event log
  • Windows Vista event log .EVTX (SEG 7.3.5 and above with FileType 7.13.3 and above)
  • Windows Registry Data
  • Windows shortcut
  • Windows Script File .WSF (SEG 7.3.5 and above with FileType 7.14.0 and above)
  • Calendar Meeting Invitation (iCalendar) (recognized in SEG 7.2 and above)
  • Calendar Meeting Summary (recognized in SEG 7.2 and above)
  • Calendar Meeting Description (recognized in SEG 7.2 and above)
Mail Components
  • Mail Body
  • Mail Headers
  • Mail message
  • TNEF Exchange Mail Message
  • TNEF Exchange Mail Message extracted HTML Mail Body
  • TNEF Exchange Mail Message extracted RTF Mail Body

Web Browsing

(New category and new items in 6.5)

  • Cascading style sheet
  • Certificate Revocation List (CRL)
  • GIF Image 
  • Google Safe Browsing Update
  • HTML Document
  • Icon
  • Java class file
  • JavaScript file
  • JPEG image
  • OCSP Response File
  • PNG image
  • Shockwave Flash
  • Shockwave Flash video
  • VBScript file (from FileType 7.14.6, 8.0.4, 8.1.1, 8.2.1)
  • Web Page form data
  • WebM Video File (FileType 7.14.3 and above, 8.0.1 and above)
  • WebP Image File (FileType 7.14.3 and above, 8.0.1 and above)

Azure IRM protected documents

New category and new items in SEG 8.2.

Also recognized in:

 

  • 8.0.X with FileType 8.0.4 and above
  • 8.1.X with FileType 8.1.1 and above

 

 

  • OLE compound document with IRM
  • Word 2007 doc with IRM in Word 2003 mode 
  • Word 2007 document with IRM
  • Excel document with IRM
  • Excel 2007 document with IRM
  • Powerpoint document with IRM
  • Powerpoint 2007 document with IRM
  • File protected with IRM 
  • Restricted-permission message 
  • Decrypted restricted-permission message 
  • Powerpoint show with IRM 
  • Password protected Excel with IRM
  • Password protected Word with IRM
  • Password protected Powerpoint with IRM
  • Password protected Powerpoint show with IRM

Notes:

  • Word, Excel, and Powerpoint "2007" file type is the default format used by all later versions (including Office 2010, 2013, and 2016). All documents saved in this format are recognized, regardless of the Office software version.
  • File Type 7.14.0.317 (July 20, 2017) was released after 7.14.1. 7.14.1 does not include the new items released in 7.14.0.317.
  • See the following Trustwave Knowledgebase articles for information about other versions:
    • Q10853 What file types are recognized by MailMarshal 5.0.X? (Includes MailMarshal Exchange 5.1 and below) 
    • Q10857 What file types are recognized by MailMarshal 5.5.X?

This article was previously published as:
NETIQKB40962

To contact Trustwave about this article or to request support:


Rate this Article:
     
Tags:

Related Articles



Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.

Details
Article ID: 10858
Last Modified: 10/21/2019
Type: INFO
Rated 2 stars based on 4 votes.
Article has been viewed 16,577 times.
Options