How to unscramble a downloaded file

Occasionally email attachments or web downloads, such as image files, arrive as unrecognised or incorrectly-typed files. Getting access to their contents need not be complex.

Most of the time, mail client apps and OS X correctly identify the types of downloaded files, and you can quickly process and open them. Sometimes vital information is missing or incorrect, and you are stuck with a file, most commonly an image or a compressed archive, and do not know how to access it.

File types are recognised by a strict hierarchy of different information, including most obviously the extension given to the filename, such as .jpg or .jpeg for JPEG images, and .dmg for disk images to install applications and updates. This information may have become removed, or could be incorrect or ambiguous. For example, some files that have been compressed using GNU Zip are incorrectly labelled .zip instead of .gzip.

It helps to know your way around different filename extensions. Email attachments and some downloads may be compressed into an archive using tar (extension .tar) and GNU Zip (.gz, .gzip), then encoded using Base64 or BinHex (.hqx). Image files are commonly JPEG (.jpg, .jpeg), PNG (.png), or TIFF (.tif, .tiff), but could be any of dozens of other formats with their own distinctive extensions: most are listed at DotWhat? and details of how OS X uses extensions are here.

You can always change the application that opens a given document using the Finder’s Get Info dialog, but it is usually quicker and simpler to work directly with the file, changing its extension or using a conversion tool to eventually unscramble it and open it up.

Outline plan:

  1. if saving an email attachment does not work, save the whole email in text form, and edit it to extract the encoded content;
  2. decode then decompress files to reconstitute them in usable form. Inspection with a text editor can give clues as to their format;
  3. if you know the file is an image, but do not know what type, use a conversion tool, or try different filename extensions until they are properly recognised.

Important security consideration
Are you confident that the file is safe and not a Trojan or other malware? Before going any further, think carefully about this, or you may find your efforts rewarded by something nasty.

unscramble011 Save and open. Before trying to unscramble an attached or downloaded file, save it to its own folder, and save a copy in case that becomes altered. Then try double-clicking the file in the Finder, to see which default application opens it. Here a Windows executable has been opened in a hex file editor, revealing that it was probably compressed using PKZip for Windows.

2 Try changing the extension. To change the default application that tries to open a download, add or alter the filename extension. In most cases there is a limited range of different extensions that are likely: in the case of images, the chances are that it is a JPEG file, so a quick and dirty shortcut solution is simply to change its extension to .jpg, then double-click the file again.

unscramble033 Preview and QuickLook. Recent versions of OS X provide good file previews, including most image formats; if you select the file and press Command-I (File menu, Show Info), it should reveal a larger preview. Image, movie, and similar files that do not reveal a good preview are probably of a different type, so try a different extension.

unscramble044 Open in text editor. If you are still struggling to identify the file type, and common filename extensions have been no help, open the file using a text editor, such as TextWrangler (free) or BBEdit. You may then see obvious clues as to the file’s format. Here the first line reveals the file to have been encoded using BinHex: either give it an .hqx extension, or decode it direct.

5 Use converter tool. When you know or suspect that the file contains graphics, a movie, audio, or similar, try opening it using an appropriate editor/converter application that may be able to recognise the file format from the contents. For instance, although Preview is not so good at this, GraphicConverter (App Store) can often detect the file type when you try to open an image file.

6 Let the app guess. Opening a file blind to its type can overstress even the best editor/converter. GraphicConverter will work out its best guess from the content, then ask if you wish to let it try to decode the file. Ensure that all other work is saved and stable, because decoding unknown files can sometimes crash the application, and may rarely result in a kernel panic.

unscramble077 Use clues. If GraphicConverter decides that it cannot recognise the file format, and thus cannot open it, it will display the start of the file in hexadecimal values and in text. This may give you further clues as to the nature of the image. Click on the Try RAW Import button if you think that worth a shot. Otherwise you may need to return to your mail or browser.

unscramble088 Save as text. Image files that are still encoded and/or compressed will prove impossible to open in Preview and GraphicConverter. If received via email, open the original message which included the file and view its source, then save this source as a text file.

unscramble099 In-application QuickLook. Mail supports QuickLook, providing even better previews. Select the enclosure, then open the contextual menu (e.g. Ctrl-click and hold), and use the command. However it may chicken out of providing a preview, and suggest an app which should handle the file better: click on that button to try that suggestion out.

unscramble1010 Save as text (Mail). View the complete source of an email in recent versions of Mail using the Raw Source command in the Message sub-menu of the View menu. To save the whole email, including all attachments, to a text file, use the Save As command in the File menu, and choose the format option for Raw Message Source. This creates a plain text .eml file, although QuickLook will show its preview as if it were not plain text at all!

A Base64 encoded file, viewed as a message source.
A Base64 encoded file, viewed as a message source.
A Binhex encoded file, viewed as message source. Although rare now, you may still come across these.
A Binhex encoded file, viewed as message source. Although rare now, you may still come across these.

11 Convert text. Open the source in a text editor such as TextWrangler or BBEdit: shown above is a BinHex encoded file, and one using the more common Base64 encoding. Chop the top and foot of the text to leave the encoded content, then Save As a different file, but in plain text format to retain the original copy of the email. Decode and decompress the edited source using Stuffit Expander (App Store, free) or similar.

unscramble1212 (Advanced) Set default applications. If you have repeated problems with incorrect recognition of downloads, you may need to change system handling for the file type. Do this using RC Default App, which gives you access to all the MIME types you are likely to encounter. Select the file type, check that it covers the right extensions as shown, then set your chosen default application.

Based on a Masterclass which was originally published in MacUser volume 25 issue 7, 2009.