Ignoring base64 encoded attahments when grepping through .eml files
base64, bash, grep, regex
Solution
If you exclude any matches consisting entirely of base64, you should be left with only the interesting matches. As an approximation, excluding any line consisting entirely of base64 with a length longer than, say, 60 characters is probably good enough for immediate human consumption.
egrep -iR "keyword|list|foo|bar" . |
egrep -v ':[0-9A-Za-z+/]{60,}$' |
less
If you need improved accuracy, maybe prefilter the messages to exclude any attachments. You might also want to check that the excluded lines are an even multiple of 4 characters long, although it's unlikely that you have a lot of false positives for that particular criterion.
Problem
I've got a huge pile of exported emails in .eml format that I'm grepping through for keywords with something like this: ``` egrep -iR "keyword|list|foo|bar" * ``` This results in a number of false positives when using relatively short keywords due to base64 encoded email attachments like this: ``` Inbox/Email Subject.eml:rcX2aiCZBfoogjNUShcWC64U7buTJE3rC5CeShpo/Uhz0SeGz290rljsr6woPNt3DQ0iFGzixrdj Inbox/Email Subject.eml:3qHXNEj5sKXUa3LxfkmEAEWOpW301Pbarq2Jr2IswluaeKqCgeHIEFmFQLeY4HIcTBe3wCf6HzPL ``` Is there a regex I can write that will identify and exclude these matches, or can I tell grep to stop reading a file once it gets to a line that says "Content-Transfer-Encoding: base64"?