# Extract and Triage Email Attachments
> Pull attachments from an email and identify their types

**Tools:** [[tools/emldump-py|emldump-py]], [[tools/file|file]], [[tools/sha256sum|sha256sum]]

## Commands
```bash
# List email structure
emldump.py <email.eml>
# Extract all attachments
emldump.py <email.eml> -d
# Identify file types
file attachment_*
# Compute hashes for lookup
sha256sum attachment_*
```

#recipe #emldump-py #file #sha256sum