Detecting Compressed RTF, (Sun, Oct 28th)

I was asked how I knew that the content of the email in my last diary entry, was compressed RTF.

Article Link: https://isc.sans.edu/diary/rss/24250