file/magic/Magdir/mail.news

#------------------------------------------------------------------------------
# $File: mail.news,v 1.32 2024/11/10 16:59:38 christos Exp $
# mail.news:  file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
#0	string		From 		mail text
0	string/t		Relay-Version: 	old news text
!:mime	message/rfc822
0	string/t		#!\ rnews	batched news text
!:mime	message/rfc822
0	string/t		N#!\ rnews	mailed, batched news text
!:mime	message/rfc822
0	string/t		Forward\ to 	mail forwarding text
!:mime	message/rfc822
0	string/t		Pipe\ to 	mail piping text
!:mime	message/rfc822
0	string/tc		delivered-to:	SMTP mail text
!:mime	message/rfc822
0	string/tc		return-path:	SMTP mail text
!:mime	message/rfc822
0	string/t		Path:		news text
!:mime	message/news
0	string/t		Xref:		news text
!:mime	message/news
0	string/t		From:		news or mail text
!:mime	message/rfc822
0	string/t		Date:		news or mail text
!:mime	message/rfc822
0	string/t		Subject:	news or mail text
!:mime	message/rfc822
0	string/t		Cc:		news or mail text
!:mime	message/rfc822
0	string/t		To:		news or mail text
!:mime	message/rfc822
0	string/t		Article 	saved news text
!:mime	message/news
# Reference:	http://quimby.gnus.org/notes/BABYL
# Update:	Joerg Jenderek
# Note:		used by Rmail in Emacs version 22 and before
#		is not text because of characters like Control-L Control-_
0	string/b		BABYL\ OPTIONS:	Emacs RMAIL
#0	string/t		BABYL		Emacs RMAIL text
# https://reposcope.com/mimetype/message/x-gnu-rmail
!:mime	message/x-gnu-rmail
# ~/RMAIL
!:ext	/
0	string/t		Received:	RFC 822 mail text
!:mime	message/rfc822
0	string/t		MIME-Version:	MIME entity text
#0	string/t		Content-	MIME entity text

# From:		Joerg Jenderek
# URL:		https://tools.ietf.org/rfc/rfc4155.txt
# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/mbox.trid.xml
# Note:		called "Standard Unix Mailbox" by TrID and
#		"mailbox file" by shared MIME-info database
#https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/master/data/freedesktop.org.xml.in?ref_type=heads
0	string			From\040	Mailbox text
#!:mime	text/plain
!:mime	application/mbox
# like: INBOX 1.mbox
!:ext	/mbox
# For control reasons show first line like: "From - Tue May 30 21:55:54 2023" "From noreply@unitymedia.info  Thu Oct 13 17:23:38 2016"
>0	string		x	\b, 1st line "%s"

# TNEF files...
# URL:		http://fileformats.archiveteam.org/wiki/Transport_Neutral_Encapsulation_Format
#		https://en.wikipedia.org/wiki/Transport_Neutral_Encapsulation_Format
# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/t/tnef.trid.xml
#		https://interoperability.blob.core.windows.net/files/MS-OXTNEF/%5bMS-OXTNEF%5d-210817.pdf
# Update:	Joerg Jenderek
# Note:		moved and merged from ./msdos (version 1.154) there just called "TNEF"
#		partly verified by `tnef --list -v -f voice.tnef` and `ytnef -v  triples.tnef`
# TNEF magic From "Joomy" <joomy@se-ed.net>
# TNEF_SIGNATURE 
0	lelong		0x223E9F78	Transport Neutral Encapsulation Format (TNEF)
!:mime	application/vnd.ms-tnef
# winmail.dat or win.dat by Microsoft Outlook
!:ext	tnef/dat
# https://docs.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxtnef/7fdb64ee-7f63-4d95-9af1-c672e7475c3a
# LegacyKey
#>4	uleshort	x		\b, key %#4.4x
# attrLevelMessage; Level where attribute applies like: 1~attrLevelMessage 2~attrLevelAttachment
>6	ubyte		!1		\b, 1st level %#2.2x
# other ID (like 02900000h) or TnefVersion ID (idTnefVersion=06900800h)
>7	ubelong		!0x06900800	\b, 1st id %#8.8x
>7	ubelong		=0x06900800
# TnefVersion length like: 4
>>11	ulelong		!4		\b, TnefVersion length %x
# TNEFVersionData; TnefVersion data like: 00010000h
>>15	ulelong		!0x00010000h	\b, version %#8.8x
# Checksum like: 1
>>19	uleshort	!1		\b, checksum %#4.4x
# attrLevelMessage; level of attOemCodepage like: 1
>>21	ubyte		!1		\b, level %#2.2x
# idOEMCodePage; OEMCodePage ID like: 07900600h
>>22	ubelong		=0x07900600	\b, OEM codepage
# OEMCodePage length like: 8
>>>26	ulelong		=8		
# OEMCodePageData; PrimaryCodePage like: 1251 1252
>>>>30	ulelong		x		%u
# OEMCodePageData; SecondaryCodePage; unused and SHOULD contain zero
>>>>34	ulelong		!0		and %u
# OEMCodePageData Checksum like: E7h E8h
>>>>38	uleshort	x		(checksum %#x)
# attrLevelMessage of attMessageClass like: 1
>>40	ubyte		!1		\b, level %u
# idMessageClass; ID of attMessageClass like: 08800700h
>>41	ubelong		=0x08800700	\b, MessageAttribute
# attMessageClass length like: 16 24 25
#>>>45	ulelong		x		(length %u)
# attMessageClass data like: "IPM.Microsoft Mail.Note" "IPM.Note.Portada Newseum"
# "IPM.Appointment" "IPM.Note.Microsoft.Voicemail.UM.CA"
>>>45	pstring/l	x		"%s"

# From: Kevin Sullivan <ksulliva@psc.edu>
0	string		*mbx*		MBX mail folder

# From: Simon Matter <simon.matter@invoca.ch>
0	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB
0	string		\241\002\213\015twoskip\ file\0\0\0\0	Cyrus twoskip DB

# JAM(mbp) Fidonet message area databases
# JHR file
0	string	JAM\0			JAM message area header file
>12	leshort >0			(%d messages)

# Squish Fidonet message area databases
# SQD file (requires at least one message in the area)
# XXX: Weak magic
#256	leshort	0xAFAE4453		Squish message area data file
#>4	leshort	>0			(%d messages)

#0	string		\<!--\ MHonArc		text/html; x-type=mhonarc

# Cyrus: file(1) magic for compiled Cyrus sieve scripts
# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
# From: Philipp Hahn <hahn@univention.de>

# Compiled Cyrus sieve script
0       string CyrSBytecode     Cyrus sieve bytecode data,
>12     belong =1       version 1, big-endian
>12     lelong =1       version 1, little-endian
>12     belong x        version %d, network-endian

# Dovecot mail server, version 2.2 and later.
# Dovecot mailing list: dovecot@dovecot.org
# File format spec: https://wiki.dovecot.org/Design/Dcrypt/#File_format
# From: Stephen Gildea
0	string	CRYPTED\003\007		Dovecot encrypted message
>9	byte	x			\b, dcrypt version %d