ripMIME(1)

💌 ripMIME — the email attachment ripper-upper 💅

ok bestie, sit down, we're talking about ripMIME today and honestly? it's giving forensic girlboss. it's a manual page, section 1, and the tool itself is literally just called ripMIME. yes the name is that iconic. lowercase r, capital MIME, no notes. 🎀

---

✨ NAME ✨

ripMIME — email attachment / decomposition tool. that's it. that's the whole vibe. it takes your mailpack and rips the attachments out of it like it's unboxing a package it did not ask for 🫶

---

🦋 SYNTAX 🦋

here's the whole shape of it, verbatim, no edits, because we do NOT freestyle the flags:

ripMIME -i <mime file> -d <directory>
[-p prefix][-e [headerfile]]
[-v][-q][--verbose-contenttype][--verbose-oldstyle][--verbose-defects][--stdout][--stderr][--syslog]
[--paranoid]
[--name-by-type][--no-nameless][--overwrite][--no_nameless]
[--unique_names[--prefix|--postfix|--infix]][--mailbox]
[--no-tnef][--no-quotedprintable][--no-uudecode][--no-ole][--no-doublecr][--no-mht]
[--disable-qmail-bounce][--recursion-max <level>]
[--no-multiple-filenames]
[--exteded-errors][--debug][--version|-V][--buildcodes][-h]

(yes, that one says --exteded-errors up there and --extended-errors down below. yes that's the original. no i am not "fixing" it. we report, we don't editorialize. ✨)

---

🌸 DESCRIPTION 🌸

so ripMIME is a command line tool, and what it does is help you extract email-borne attachments out into files, so you can then go process them with literally any other UNIX tool you want. it's the "get the thing out of the email so the rest of your pipeline can have a normal day" tool. 🧚

and it's not just RFC MIME standards compliant (it does support those, obviously, she contains multitudes). it can also behave according to various MUA "features" — and bestie, the way they put "features" in scare quotes in the original is so real, because those features are often used as exploitation holes. 😭 so ripMIME is basically that friend who knows all the weird stuff your mail client does and is not scared of it.

---

👑 OPTIONS 👑

every single one, no skipping, we're thorough in this house 💖

• -i — Input MIME encoded file (use - to input from STDIN)
• -d — Output directory
• -p — Specify prefix filename to be used on files without a filename (default text)
• -e [headers file name] — Dump headers from mailpack (default _headers_)
• -v — Turn on verbosity
• -q — Run quietly, do not report non-fatal errors
• --verbose-contenttype — Turn on verbosity of file content type
• --verbose-oldstyle — Uses the v1.2.x style or filename reporting
• --verbose-defects — Report MIME header/body defects located in the mailpack
• --stdout — All reporting goes to stdout (Default)
• --stderr — All reporting goes to stderr
• --syslog — All reporting goes to syslog
• --no-paranoid — [ Deprecated ] Turns off strict ascii-alnum filenaming
• --paranoid — Converts all filenames to strict 7-bit compliance
• --name-by-type — Saves a given attachment by its content-type if it has no other name
• --no-nameless — Do not save nameless attachments
• --overwrite — Overwrite files if they have the same name on extraction
• --unique-names — Dont overwrite existing files (This is the default behaviour)
• --prefix — rename by putting unique code at the front of the filename
• --postfix — rename by putting unique code at the end of the filename
• --infix — rename by putting unique code in the middle of the filename
• --recursion-max <maximum level> — Set the maximum recursion level into a mailpack. Often emails are forwarded copies of an existing email, each time this is done a new recursion level is required. Malicious emails can be constructed with many hundereds of recursion levels to induce stack faults in decoding programs. ripMIME is hard coded with a default of 20 levels, this may be overidden using this parameter.
• --mailbox — Process mailbox file
• --extended-errors — Returns error codes for non-fatal decoding situations
• --debug — Produces detailed information about the whole decoding process

not me pointing out that --recursion-max paragraph again: forwarded emails stack up recursion levels, malicious ones stack up hundreds to cause stack faults in decoding programs. default is hard coded at 20. you can override it. that's a real safety thing, ok? 🫶

🔥 Attachment type decoding switches 🔥

these are the little on/off toggles for each decoding format, and they all turn stuff off, which is a choice and we respect it 💅

• --no-tnef — Turn off TNEF/winmail.dat decoding
• --no-ole — Turn off OLE decoding
• --no-uudecode — Turns off the facility of detecting UUencoded attachments in emails
• --no-quotedprintable — Turns off the facility of decoding QuotedPrintable data
• --no-doublecr — Turns off saving of double-CR embedded data
• --no-mht — Turns off MHT (a Microsoft mailpack attachment format ) decoding
• --disable-qmailbounce — Turns off ripMIME's look-ahead searching for RFC822 headers within a body of text. Normally the look-ahead is useful for decoding embedded emails which have been bounced back by systems like qmail, but have been included in such a way that they are not meant to be decoded, unfortunately some MUA (Outlook for one) still decode it, hence we need to by default check for attachments in such forwarded bodies.
• --no-multiple-filenames — Turns off the behaviour of handling multiple filename occurances in a single MIME header. Normally ripMIME will generate a hard link for each additional filename beyond the original attachment filename detected.

🌈 Auxillary parameters 🌈

the support squad, the little extras, the garnish ✨

• --buildcodes — Displays the information obtained by the Makefile script when ripMIME was built. This includes the Unix timestamp, human readable version of the timestamp and the output from uname -a.
• -V --version — Give version information
• -h — Terse information on how to use ripMIME.

---

🍓 FILES 🍓

None. literally none. nothing to see here, she's self-contained 🎀

---

🧚 ENVIRONMENT VARIABLES 🧚

None. also none. we love a low-maintenance queen 💜

---

⭐ EXAMPLES ⭐

ok so say you've got an email sitting in a file called mailpack and you want to unpack it into /tmp, with verbose output of the files unpacked. you would do:

ripmime -i mailpack -v -d /tmp

that's it. that's the whole thing. ate. 🔥

---

💖 AUTHORS 💖

• Paul L Daniels
• ripMIME WWW site http://www.pldaniels.com/ripmime
• ripMIME mailing list <ripmime-general@pldaniels.com>
• For mailpacks which do not appear to decode correctly - please email to <mailpacks-2004@pldaniels.com>

real talk: if a mailpack doesn't decode right, send it to <mailpacks-2004@pldaniels.com>. that's literally what it's for, bestie, don't suffer in silence 😭

---

🌸 SEE ALSO 🌸

altermime(1), inflex(1), ripole(1), opentnef(1)

go read those too, they're the friend group 🦋

---

and that's the whole page, periodt 💅 this was ripMIME manual page, written by Paul L Daniels, version 1.4.1.0, and the date is ripMIME(1)-o'clock, no cap. ily, go unpack some emails responsibly 🫶✨🎀