How far does FortiSandbox go with attachments?

Hiya,

So we're deploying our first FortiSandbox and I've been doing some testing based on our standard process for handling suspicious files, and have a query related to how it handles them....

For example, user receives email with attached PDF file, user forwards that as an attachment to helpdesk. Helpdesk drags that email (with the original email containing the pdf as an attachment) to their desktop and zip it before sending it to me.

I've uploaded that and it seems that FS is only looking at the zip, it doesn't then go on to evaluate the Outlook message items or the PDFs.

Am I wrong, have i missed something? or should i be extracting the PDF and uploading that?