Downloading Original Document from Threat Extraction

[G_W_Albrecht]

I must admit that i really love Threat Extraction . But how to get the original files if needed, but the download link does not work anymore ? There is a solution in sk114629 How to send original email after Threat Extraction scrubbed the email, but here is my version:

The original fles are saved in /var/log/jail/tmp/scrub and can be downloaded from there (e.g. using WinSCP).

To send the original by E-mail again using scrub commands:

You can find the find the needed File ID here:

[Peter_Baumann]

Hi Günther,
Thank you for this explanation, it is very useful.

It seems to work when you get the link to the User, when you click on the filename you will get the file.

But when I try to send the original mail to me when entering my e-mail address on the usercheck webpage:

Send the original mail to me: first.last@domain.com 

It will result in an empty e-mail:

220 i12.domain.com ESMTP Postfix
EHLO i17p.domain.com
250-i12.domain.com
250-PIPELINING
250-SIZE 60000000
250-VRFY
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM: SIZE=283
RCPT TO: ORCPT=rfc822;first.last@domain.com
DATA
250 2.1.0 Ok
250 2.1.5 Ok
354 End data with .
Received: by i17p.domain.com (Postfix, from userid 0)
	id 45t8XP2XjRz5x0g; Tue, 23 Jul 2019 09:01:25 +0200 (CEST)
Message-Id: <45t8XP2XjRz5x0g@i17p.domain.com>
Date: Tue, 23 Jul 2019 09:01:25 +0200 (CEST)
From: admin@i17p.domain.com
.
QUIT
250 2.0.0 Ok: queued as 5AF7A1CC2D
221 2.0.0 Bye

Has anyone got this to work sending the original e-mail?

[MrSalazar]

Hi, 
i have the same problem.

I tried to send the original email :

#scrub send_orig_email {EMAIL_ID} all <--- or abc@company.com

The Original email was sent to abc@company.com

But the email still comes incomplete.

If anyone has a solution for this will be appreciated.

[Peter_Baumann]

Hi all,
The problem seems to be fixed when yu upgrade the MTA according to this here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

This has been verified in the CP-lab.

Best regards,
Peter