Contents of p7s files - digital-signature

Question

Does anyone out there know the content of the p7s file?
At least one digital signature is located in the file, and I can locate that pretty easily, but I want to catch the part of the file that contains the section encrypted with the private key - i.e., the non-repudiation part of the digital signature.
Does anyone know where a simple copy of the general file format can be found?
SUPPLEMENT ON EDIT:
The general format of the files I am working with is:
byte offset Record Type
0 x509 cert (or so the program says)
0 version
1 8x (information type)
3 1 offset to next information (length of file - 4)
52 x509 cert (embedded, collection member: ROOT CA)
56 x509 cert (embedded, collection member: ROOT CA)
(1 offset) x509 cert (new, subject identifier: Email)
(1 offset +4) x509 cert (embedded, collection memeber: Email )
(varies) x509 cert (new, enhanced key usage: Digital Signature, Non-Repudiation)
(varies+4) x509 cert (embedded, collection member: Digital Signature, Non-Repudiation))
(varies) x509 cert (new, certificate authority info: CA EMAIL)
(varies+4) x509 cert (embedded, collection member: CA EMAIL)
(varies) crosscertificate pair information, unknown class type
(varies) certificate of unknown class type (padded with trailing zeros, if needed)
I do know that this file does not contain a message digest, and is not unique except it is original to the certificate holder (i.e., a different certificate will product different results, but different messages all have the same p7s file attached to them).
I believe the message digest is stripped from the files when they are sent to a system that does not support encryption/decryption of emails (such as gmail or yahoo). That would be my explanation for the lack of distinct contents for the p7s files.
The files are not damaged other than the likelihood that the message digest has been stripped from them. They will not open with ASN. Regular certificate files will open with ASN (cer files).
I wrote a program that analyzes the files by brute force, essentially.
I check the file byte by byte, and copy the bytes into the input for an X509Certificate2 class instantiation in a try-catch loop.
Whether it aborts or not, I move one byte and check again.
If the check is successful, I add the resulting cert to a collection.
At the end, I examine the certs in the collection and dump both hex and formatted ascii with the file offset into a report file.
The p7s files I am referring to are detached from the original file, and apparently do not contain any signed information. That is apparently stripped when the signature is sent to an email address that does not have the capability of encrypting/decrypting information.

Answer 1

P7S file usually contains DER encoded CMS (Cryptographic Message Syntax) structure of SignedData type which is defined in RFC5652. You can use ASN.1 Editor to conveniently examine exact structure and contents of your file.

Answer 2

I recently needed to get the contents of some files ".rtf.p7s". Looking at their content, using the notepad++, I could see that the RTF was there without cryptography after a fixed number of bytes. So I made this little script that removes the first bytes containing the key information that I did not need.
Ps - Open the file in sublime did not help. It opened the file as binary.
<?php
$dir = __dir__;
$dh = opendir($dir);
while (false !== ($filename = readdir($dh))) {
if( strpos( $filename, ".p7s" ) !== false ) {
$files[] = $filename;
}
}
foreach($files as $file ){
$content = file_get_contents( $file );
$newcontent = substr( $content, 62 );
$newfilename = substr( $file , 0, -4 );
file_put_contents($newfilename, $newcontent);
}
?>