Problem about 'MessageBody' Extraction

Hi, 

There is a feature called 'MessageBody' in the DLP system. The description of this feature defined in the Symantec DLP 14.6 Incident Reporting is that:
###
The partial body text that violated the policy.
###

There are two questions:
1. whether the 'MessageBody' will also contain the part of text in attachment violated the policy

2. whether there is a method only require to extract 'MessageBody' Column, because other API data has been extracted successfully, I don't want to extract the whole dataset again, I just want to fix the problem in 'MessageBody' and only extract this information

3. The data in the 'MessageBody' Column is not the one I supposed to get, the details are attached

Thank you very much!