Possible to archive based on attachments?

[shuttlebox]

We have found a nasty PDF attachment (targeted specifically against a
client of mine) and we would like to archive all PDF's passing through
MailScanner for analysis.

I don't know how to do this in a simple and transparent way. If I use
the filename/type rules it either blocks the PDF's or replaces the
original recipients, this won't fly as most PDF's are going to be OK,
the users shouldn't notice this.

The only way I can think of is to archive *all* mail and then find
which df-files (Sendmail) contains PDF's and extract them and delete
the rest. Is this how I should collect the samples? Or is there a
better way?

-- 
/peter