SIS and tracing the origin of an attachment

[doug]

On 3/15/2022 3:45 PM, Oscar del Rio wrote:
> On 2022-03-15 9:02 a.m., doug wrote:
>> On 3/8/2022 5:51 PM, doug wrote:
>>>
>>> I'm trying to trace an attachment within an SIS subdirectory to the 
>>> email message(s) that link to it. I say messages because I'm also 
>>> using dovecot dedup. My understanding is the linked file name is the 
>>> hash value of the attachments contents concatenated with the GUID of 
>>> the email message. I have had marginal success with a message I 
>>> created myself.
>>>
>>> Example: I generated an email with two attachments. Here are the 
>>> links in my attachment directory.
>>> ./26/c5/26c5c540d41779d83d2f5388041d05c67d720d9a-73eca8051acd276272310000f2bc99a3 
>>>
>>> ./65/cd/65cd73112a489ef07f17ed5740aa60358e2dd3fb-74eca8051acd276272310000f2bc99a3 
>>>
>>>
>>>
>>>
>>
>> I keep experimenting with this and I still haven't found a reliable 
>> way to track an attachment back to it's original message so I can 
>> either notify the user or delete the message with doveadm. Is this 
>> not possible? I'm using mdbox if that matters. I see a similar thread 
>> going right now about virus scanning and deleting messages but that 
>> is maildir and I suspect not using SIS for attachments.
>
> The very few times I've needed to trace a SIS attachment to a mailbox, 
> I just grep the "storage" folders for the file hash
>
> find username/storage -type f -exec grep 
> 9ffa4b246589f8039d123ea909f1520e791bd880 {} +
> username/storage/m.46588:X908 2409141 B72 
> 9f/fa/9ffa4b246589f8039d123ea909f1520e791bd880-c9ee303687e13062cf740012bfe47a40
> username/storage/m.46589:X1918 2409141 B72 
> 9f/fa/9ffa4b246589f8039d123ea909f1520e791bd880-080ce71390e1306299730012bfe47a40
>
> username/storage/m.46588:
> BSent
> X908 2409141 B72 
> 9f/fa/9ffa4b246589f8039d123ea909f1520e791bd880-c9ee303687e13062cf740012bfe47a40
>
> username/storage/m.46589:
> BINBOX
> X1918 2409141 B72 
> 9f/fa/9ffa4b246589f8039d123ea909f1520e791bd880-080ce71390e1306299730012bfe47a40
>
> -> Attachment in username's INBOX and Sent folders.
>

Thank you for the suggestion Oscar. My mdbox files are encrypted and 
compressed, so unfortunately directly grepping them will not work.