Hi - this is something I worked with a while back - specifically triggering on the content of documents where the trigger phrase was a classification label, and was being FTP'd. In short, and as mentioned above, the file is inspected as a dynamic stream of data, so if the trigger string is in the 'last' part of the file being transferred then the bulk of the data will be received by the far end in the form of a truncated file. Depending on the file format, a quick modification with a HEX editor can recover the data in an easily readable format. Also note that some files, such as docX files are essentially a bunch of zipped XML files with an internal file structure (if you've never tried, just rename a DOCX file to a ZIP file and open that way to see). This can mean that, depending where your trigger string is (e.g. footer text is held in a different XML file to the body text), you can actually 'lose' the entire body XML section that can then be simply opened at the far end by merging with another docx file etc. FTP is particually prone to this as most FTP servers don't automatically delete incomplete transfers etc, and as F comes after B, the body text always 'goes first' in our testing. Rgds PS There are fixes - but that's for another day!
... View more