Embedded file extraction

Which file formats BriefTech can detect embedded content in, how detection works, and how extraction behaves.

BriefTech can detect embedded content inside uploaded files and make it available for extraction. This page lists every supported container format, explains how detection works, and describes the behaviour of the extraction process.

Supported container formats

BriefTech reports embedded content at depth 1 for any format in the tables below — the immediate children of the container, not recursively nested content. Inner containers that are themselves extracted appear as new documents and can be extracted in turn.

Email and mailbox containers

The highest-value containers in litigation collections. BriefTech extracts each attachment or message as a separate document.

Format	Extension(s)	MIME type	Embedded content detected
Outlook PST mailbox	.pst	application/vnd.ms-outlook-pst	All messages and attachments in the mailbox
Outlook OST mailbox	.ost	application/vnd.ms-outlook-pst	All messages and attachments — see note below
Outlook email	.msg	application/vnd.ms-outlook	Email attachments
Internet email	.eml	message/rfc822	Email attachments
Unix/Mac mailbox	.mbox	application/mbox	Each message, extracted as individual .eml files
MHTML web archive	.mht, .mhtml	message/rfc822	Embedded resources (images, stylesheets, frames)

OST caveat: OST files created by Outlook 2013 and later use a newer internal format that is only partially supported. If your OST produces fewer extracted items than expected, export to .pst or individual .msg files before uploading.

Archive containers

Format	Extension(s)	MIME type	Embedded content detected
ZIP archive	.zip	application/zip	All files in the archive
7-Zip archive	.7z	application/x-7z-compressed	All files in the archive
RAR archive	.rar	application/x-rar-compressed	All files in the archive
TAR archive	.tar, .tar.gz, .tgz, .tar.bz2, .tar.xz	application/x-tar and variants	All files in the archive
Gzip stream	.gz	application/gzip	The single compressed file
BZip2 stream	.bz2	application/x-bzip2	The single compressed file
XZ stream	.xz	application/x-xz	The single compressed file
LZMA stream	.lzma	application/x-lzma	The single compressed file
Unix compress	.Z	application/x-compress	The single compressed file
ARJ archive	.arj	application/x-arj	All files in the archive
Unix AR archive	.ar	application/x-archive	All files in the archive
CPIO archive	.cpio	application/x-cpio	All files in the archive
Java archive	.jar, .war, .ear	application/java-archive	All files in the archive

Documents with embedded content

These formats only show a non-zero embedded-file count when the document itself contains embedded file attachments or OLE objects. A standard PDF with no attached files, or a Word document with no embedded objects, will not appear in the view.

Format	Extension(s)	MIME type	Embedded content detected
PDF	.pdf	application/pdf	Embedded file attachments and PDF portfolio members
Word (OOXML)	.docx	application/vnd.openxmlformats-officedocument.wordprocessingml.document	Embedded OLE objects and attached files
Excel (OOXML)	.xlsx	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet	Embedded OLE objects and attached files
PowerPoint (OOXML)	.pptx	application/vnd.openxmlformats-officedocument.presentationml.presentation	Embedded OLE objects and attached files
Word (legacy)	.doc	application/msword	Embedded OLE objects
Excel (legacy)	.xls	application/vnd.ms-excel	Embedded OLE objects
PowerPoint (legacy)	.ppt	application/vnd.ms-powerpoint	Embedded OLE objects
OpenDocument text	.odt	application/vnd.oasis.opendocument.text	Embedded objects
OpenDocument spreadsheet	.ods	application/vnd.oasis.opendocument.spreadsheet	Embedded objects
OpenDocument presentation	.odp	application/vnd.oasis.opendocument.presentation	Embedded objects
EPUB e-book	.epub	application/epub+zip	Component documents and media

Partial support

These formats are recognised and processed, but have known limitations.

Format	Extension(s)	Limitation
Outlook OST (2013+)	.ost	Newer OST format is only partially parsed; some messages may not be detected. Export to PST or MSG before uploading for full coverage.
SQLite database	.sqlite, .db	Not available in BriefTech's current configuration.
Android package	.apk	ZIP layer is extracted (component files visible), but Android-specific structures within are not further parsed.
iOS app package	.ipa	Same as .apk — ZIP layer only.
Debian package	.deb	Outer container is extracted; inner archives are not further unpacked in a single pass.

Detection

After upload, BriefTech's file processing pipeline inspects every uploaded file to read its metadata. For supported container formats, BriefTech reports the count and names of embedded files at depth 1. This information is stored with the document and reflected in the view of the tab.

Detection runs automatically — no action is required. A file that contains embedded content shows a non-zero value in the 📎 column (hover the column header for its "Number of embedded files" tooltip).

OS-generated junk files — macOS __MACOSX/._* AppleDouble sidecars, .DS_Store, Thumbs.db, Desktop.ini and the like — are not counted. They are excluded from the 📎 count (and from the Extractable view) and are never unpacked, so the badge reflects the files you'd actually work with rather than every raw entry a Mac or Windows machine left in the archive.

Size limit on detection: BriefTech reads a file's embedded listing only while the file is within its processing size limit:

• PDFs — up to 1 GB
• Most other types (7z, RAR, TAR, GZ, PST, MBOX, EML/MSG) — up to 500 MB
• ZIP and modern Office files (.docx, .xlsx, .pptx) — no size limit

A container larger than its limit is rejected before its contents are read, so it never shows an embedded-file count or appears in the Extractable view. Split or extract a very large archive or mailbox locally before uploading.

Archive and mailbox containers (ZIP, TAR, 7z, PST, MBOX, and similar) are handled differently from ordinary documents:

• They cannot be rendered to a PDF or OCR'd.
• Detection still records their embedded file listing — the count and names of members at depth 1 — which is what makes them appear in the Extractable view.
• The container file itself does not finish processing: with no PDF rendition to produce, it halts at the conversion stage, is flagged as an unsupported type, and appears in the view.
• The content of individual members becomes searchable only after you run extraction on the container.

The Extractable view

The view in the tab shows files that:

• have at least one detected embedded file,
• have not yet been extracted, and
• are not archived or in the bin.

Once extraction has run on a file, it no longer appears in this view. The view itself is hidden from the left panel when there are no extractable files, and when shown its entry carries a badge with the number of files currently waiting to be extracted.

Extraction

Extraction is a one-time, on-demand action. To trigger it, select one or more eligible files and click in the toolbar. See Extract files from a ZIP or email attachment for step-by-step instructions.

Two ways to extract: everything, or attachments only

Two extract actions are offered, in the toolbar and the right-click menu:

• unpacks every named embedded file at depth 1 — every file in an archive (folder entries themselves are not turned into documents, and OS-generated junk such as macOS __MACOSX/._* sidecars, .DS_Store, Thumbs.db and Desktop.ini is suppressed rather than unpacked), or every named part of an email including images embedded in its body. A part that carries no filename is skipped; the one exception is a message inside a mailbox, which is named message_0001.eml, message_0002.eml, and so on.
• unpacks only genuine attachments and skips images embedded in an email's body.

  • Two kinds of body image are skipped: parts the email marks as inline, and images referenced from the message body that a mailer mislabelled as attachments.
  • For a container with no message body — a ZIP or other archive — the two actions behave identically.
  • Where neither test matches, nothing is treated as a body image and this action extracts everything the other one would. If the source cannot be parsed as an email at all, no body reference can be matched, so only parts the email itself marks as inline are still skipped.

Both actions:

• consume the file's single extraction, so only the first one run takes effect;
• are visible only while a selected file still has embedded content waiting, and are hidden — not greyed out — when nothing is eligible;
• render as icon-only buttons whose name shows as a tooltip, on the Files tab and the Review tab alike.

The number shown beside each action counts the selected files that are eligible, not the attachments inside them. For documents processed before this release, that number is an upper bound: an older email whose only embedded content is inline body images is still counted as eligible, yet Extract Attachments Only produces nothing from it.

Permissions

Only users with the Owner or Editor role on the matter can run extraction.

Inline vs background

Total size of selected files	Execution mode
Up to about 10.5 MB	Runs immediately; a success or warning notification appears when done
More than about 10.5 MB	Runs as a background job; a progress dialog opens and the job continues if closed

Add up the sizes BriefTech shows in the Size column — that is the figure this threshold applies to.

What happens during extraction

For each embedded file:

1. BriefTech writes the file's raw bytes into storage as a new document record.
2. The new document is assigned a unique ID and linked to the source file as its parent.
3. The new document is placed in the source file's folder. If the container held its own folder structure, that structure is recreated as subfolders inside it.
4. The source file is marked as extracted so it cannot be extracted again.
5. The new document enters the standard processing pipeline (detect → convert → OCR → parse → process → linearise → finalise) independently.

Already-extracted files

A file that has already been extracted cannot be extracted again. If such a file is included in a selection, it is silently skipped — the extract action counts and processes only the files that still have embedded content waiting, so an already-extracted file is simply left out.

Empty archives

A container with no embedded files has nothing to extract, so it never appears as extractable. Files with zero detected embedded content don't show up in the view, and the extract action does not appear at all unless at least one selected file still has embedded content waiting to be unpacked.

After extraction

Extracted documents appear in the matter alongside all other documents. They are full documents: they can be reviewed, indexed, moved to folders, labelled, and included in bundles.

Like any other document, an extracted document is charged the first time you commit it, and it is not charged again after that. Extracting, detecting, converting and the automatic OCR that runs during processing consume no credits. See How credits work.

The source file remains in the matter after extraction. It retains its own document record and is available for download.

How extracted families appear in the document list

After extraction, a source file and the documents unpacked from it form a family: the source is the parent and each extracted document is a child. In the document list on the and tabs, a fixed column on the far left shows this relationship:

• marks a parent — a source file that other documents were extracted from. Hover over it to see how many were extracted (for example, "3 attached files", or "1 attached file" for a single one).
• marks a child — a document that was extracted from a parent.

Hovering over any row in a family highlights all the other documents in the same family, so you can see at a glance which came from the same source. This column appears only when the current view contains at least one family; if nothing in view has extracted children, it is hidden.

Detaching a document from its family

A family is created automatically — you never group documents by hand — so BriefTech also lets you break the link when a document shouldn't stay tied to its parent. In the Document Index, open the menu on a child document (one that was extracted from a parent) and choose . BriefTech asks you to confirm, because this can't be undone:

Detach this document from its parent? It will become a standalone document and cannot be grouped back again.

Once you confirm, the document becomes standalone: it leaves the family, its child marker disappears, and the parent's attached-file count drops by one. Detaching is permanent — a standalone document cannot be regrouped into its original family.

You can detach a child from the Document Index in two ways (both ask you to confirm first):

• Open the menu on the child and choose .
• In Edit mode, drag the child's row out of its parent's group. Dragging also detaches several children at once — select the rows, then drag them out together.

Select a whole family at once. On any document that belongs to a family, the menu also offers — and once selected — to select every document in that family at once, useful before a bulk action.

Related

The document lifecycle: from upload to ready

What happens to a file between upload and the moment it can be used.

Extract files from a ZIP or email attachment

Unpack the contents of a ZIP archive or email's attachments into separate documents in your matter.

Reprocess a failed document

Re-run a document through the processing pipeline after it failed.

Background Jobs

Status indicators, columns, and row actions in the Background Jobs dialog.

Your First Matter

A guided, end-to-end first run — take a practice matter from sample files all the way to a downloaded court bundle.