1OUTLOOK.PST(5)          libpst Utilities - Version 0.6          OUTLOOK.PST(5)
2
3
4

NAME

6       outlook.pst - format of MS Outlook .pst file
7

SYNOPSIS

9       outlook.pst
10

OVERVIEW

12       Low level or primitive items in a .pst file are identified by an I_ID
13       value. Higher level or composite items in a .pst file are identified by
14       a D_ID value. There are two separate b-trees indexed by these I_ID and
15       D_ID values. Starting with Outlook 2003, the file format changed from
16       one with 32 bit pointers, to one with 64 bit pointers. We describe both
17       formats here.
18

32 BIT FILE HEADER

20       The 32 bit file header is located at offset 0 in the .pst file.
21
22           0000  21 42 44 4e 49 f8 64 d9  53 4d 0e 00 13 00 01 01
23           0010  00 00 00 00 00 00 00 00  50 d6 03 00 bd 1e 02 00
24           0020  08 4c 00 00 00 04 00 00  00 04 00 00 0f 04 00 00
25           0030  0d 40 00 00 99 0a 01 00  18 04 00 00 0d 40 00 00
26           0040  0d 40 00 00 11 80 00 00  02 04 00 00 0a 04 00 00
27           0050  00 04 00 00 00 04 00 00  0f 04 00 00 0f 04 00 00
28           0060  0f 04 00 00 0d 40 00 00  00 04 00 00 00 04 00 00
29           0070  04 40 00 00 00 04 00 00  00 04 00 00 00 04 00 00
30           0080  00 04 00 00 00 04 00 00  00 04 00 00 00 04 00 00
31           0090  00 04 00 00 00 04 00 00  00 04 00 00 00 04 00 00
32           00a0  0c 09 00 00 00 00 00 00  00 04 27 00 00 24 23 00
33           00b0  c0 09 0a 00 00 c8 00 00  bc 1e 02 00 00 7e 0c 00
34           00c0  b4 1e 02 00 00 54 00 00  01 00 00 00 23 55 44 d1
35           00d0  5a 4f ce 6b 80 ff ff ff  00 00 00 00 00 00 00 00
36           00e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
37           00f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
38           0100  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
39           0110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
40           0120  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
41           0130  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
42           0140  00 00 00 00 00 00 00 00  00 00 00 00 3f ff ff ff
43           0150  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
44           0160  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
45           0170  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
46           0180  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
47           0190  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
48           01a0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
49           01b0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
50           01c0  ff ff ff ff ff ff ff ff  ff ff ff ff 80 01 00 00
51           01d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
52           01e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
53           01f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
54
55           0000  signature       [4 bytes] 0x4e444221 constant
56           000a  indexType       [1 byte]  0x0e       constant
57           01cd  encryptionType  [1 byte]  0x01       in this case
58           00a8  total file size [4 bytes] 0x270400   in this case
59           00c0  backPointer1    [4 bytes] 0x021eb4   in this case
60           00c4  offsetIndex1    [4 bytes] 0x005400   in this case
61           00b8  backPointer2    [4 bytes] 0x021ebc   in this case
62           00bc  offsetIndex2    [4 bytes] 0x0c7e00   in this case
63
64       We only support index types 0x0e, 0x0f, 0x15, and 0x17, and encryption
65       types 0x00, 0x01 and 0x02. Index type 0x0e is the older 32 bit Outlook
66       format. Index type 0x0f seems to be rare, and so far the data seems to
67       be identical to that in type 0x0e files. Index type 0x17 is the newer
68       64 bit Outlook format. Index type 0x15 seems to be rare, and according
69       to the libpff project should have the same format as type 0x17 files.
70       It was found in a 64-bit pst file created by Visual Recovery. It may be
71       that index types less than 0x10 are 32 bit, and index types greater
72       than or equal to 0x10 are 64 bit, and the low order four bits of the
73       index type is some subtype or minor version number.
74
75       Encryption type 0x00 is no encryption, type 0x01 is "compressible"
76       encryption which is a simple substitution cipher, and type 0x02 is
77       "strong" encryption, which is a simple three rotor Enigma cipher from
78       WWII.
79
80       offsetIndex1 is the file offset of the root of the index1 b-tree, which
81       contains (I_ID, offset, size, unknown) tuples for each item in the
82       file. backPointer1 is the value that should appear in the parent
83       pointer of that root node.
84
85       offsetIndex2 is the file offset of the root of the index2 b-tree, which
86       contains (D_ID, DESC-I_ID, TREE-I_ID, PARENT-D_ID) tuples for each item
87       in the file. backPointer2 is the value that should appear in the parent
88       pointer of that root node.
89

64 BIT FILE HEADER

91       The 64 bit file header is located at offset 0 in the .pst file.
92
93           0000  21 42 44 4e 03 02 23 b2  53 4d 17 00 13 00 01 01
94           0010  00 00 00 00 00 00 00 00  04 00 00 00 01 00 00 00
95           0020  8b 00 00 00 00 00 00 00  1d 00 00 00 00 04 00 00
96           0030  00 04 00 00 04 04 00 00  00 40 00 00 02 00 01 00
97           0040  00 04 00 00 00 04 00 00  00 04 00 00 00 80 00 00
98           0050  00 04 00 00 00 04 00 00  00 04 00 00 00 04 00 00
99           0060  04 04 00 00 04 04 00 00  04 04 00 00 00 04 00 00
100           0070  00 04 00 00 00 04 00 00  00 04 00 00 00 04 00 00
101           0080  00 04 00 00 00 04 00 00  00 04 00 00 00 04 00 00
102           0090  00 04 00 00 00 04 00 00  00 04 00 00 00 04 00 00
103           00a0  00 04 00 00 00 04 00 00  02 04 00 00 00 00 00 00
104           00b0  00 00 00 00 00 00 00 00  00 24 04 00 00 00 00 00
105           00c0  00 44 00 00 00 00 00 00  00 71 03 00 00 00 00 00
106           00d0  00 22 00 00 00 00 00 00  83 00 00 00 00 00 00 00
107           00e0  00 6a 00 00 00 00 00 00  8a 00 00 00 00 00 00 00
108           00f0  00 60 00 00 00 00 00 00  01 00 00 00 00 00 00 00
109           0100  ff 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
110           0110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
111           0120  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
112           0130  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
113           0140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
114           0150  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
115           0160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
116           0170  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
117           0180  7f ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
118           0190  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
119           01a0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
120           01b0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
121           01c0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
122           01d0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
123           01e0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
124           01f0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
125           0200  80 00 00 00 e8 00 00 00  00 00 00 00 c4 68 cb 89
126
127           0000  signature       [4 bytes] 0x4e444221 constant
128           000a  indexType       [1 byte]  0x17       constant
129           0201  encryptionType  [1 byte]  0x00       in this case
130           00b8  total file size [8 bytes] 0x042400   in this case
131           00e8  backPointer1    [8 bytes] 0x00008a   in this case
132           00f0  offsetIndex1    [8 bytes] 0x006000   in this case
133           00d8  backPointer2    [8 bytes] 0x000083   in this case
134           00e0  offsetIndex2    [8 bytes] 0x006a00   in this case
135

32 BIT INDEX 1 NODE

137       The 32 bit index1 b-tree nodes are 512 byte blocks with the following
138       format.
139
140           0000  04 00 00 00  8a 1e 02 00  00 1c 0b 00
141           000c  58 27 03 00  b3 1e 02 00  00 52 00 00
142           0018  00 00 00 00  00 00 00 00  00 00 00 00
143           0024  00 00 00 00  00 00 00 00  00 00 00 00
144           0030  00 00 00 00  00 00 00 00  00 00 00 00
145           003c  00 00 00 00  00 00 00 00  00 00 00 00
146           0048  00 00 00 00  00 00 00 00  00 00 00 00
147           0054  00 00 00 00  00 00 00 00  00 00 00 00
148           0060  00 00 00 00  00 00 00 00  00 00 00 00
149           006c  00 00 00 00  00 00 00 00  00 00 00 00
150           0078  00 00 00 00  00 00 00 00  00 00 00 00
151           0084  00 00 00 00  00 00 00 00  00 00 00 00
152           0090  00 00 00 00  00 00 00 00  00 00 00 00
153           009c  00 00 00 00  00 00 00 00  00 00 00 00
154           00a8  00 00 00 00  00 00 00 00  00 00 00 00
155           00b4  00 00 00 00  00 00 00 00  00 00 00 00
156           00c0  00 00 00 00  00 00 00 00  00 00 00 00
157           00cc  00 00 00 00  00 00 00 00  00 00 00 00
158           00d8  00 00 00 00  00 00 00 00  00 00 00 00
159           00e4  00 00 00 00  00 00 00 00  00 00 00 00
160           00f0  00 00 00 00  00 00 00 00  00 00 00 00
161           00fc  00 00 00 00  00 00 00 00  00 00 00 00
162           0108  00 00 00 00  00 00 00 00  00 00 00 00
163           0114  00 00 00 00  00 00 00 00  00 00 00 00
164           0120  00 00 00 00  00 00 00 00  00 00 00 00
165           012c  00 00 00 00  00 00 00 00  00 00 00 00
166           0138  00 00 00 00  00 00 00 00  00 00 00 00
167           0144  00 00 00 00  00 00 00 00  00 00 00 00
168           0150  00 00 00 00  00 00 00 00  00 00 00 00
169           015c  00 00 00 00  00 00 00 00  00 00 00 00
170           0168  00 00 00 00  00 00 00 00  00 00 00 00
171           0174  00 00 00 00  00 00 00 00  00 00 00 00
172           0180  00 00 00 00  00 00 00 00  00 00 00 00
173           018c  00 00 00 00  00 00 00 00  00 00 00 00
174           0198  00 00 00 00  00 00 00 00  00 00 00 00
175           01a4  00 00 00 00  00 00 00 00  00 00 00 00
176           01b0  00 00 00 00  00 00 00 00  00 00 00 00
177           01bc  00 00 00 00  00 00 00 00  00 00 00 00
178           01c8  00 00 00 00  00 00 00 00  00 00 00 00
179           01d4  00 00 00 00  00 00 00 00  00 00 00 00
180           01e0  00 00 00 00  00 00 00 00  00 00 00 00
181           01ec  00 00 00 00  02 29 0c 02  80 80 b6 4a
182           01f8  b4 1e 02 00  27 9c cc 56
183
184           01f0  itemCount       [1 byte]  0x02       in this case
185           01f1  maxItemCount    [1 byte]  0x29       constant
186           01f2  itemSize        [1 byte]  0x0c       constant
187           01f3  nodeLevel       [1 byte]  0x02       in this case
188           01f8  backPointer     [4 bytes] 0x021eb4   in this case
189
190       The itemCount specifies the number of 12 byte records that are active.
191       The nodeLevel is non-zero for this style of nodes. The leaf nodes have
192       a different format. The backPointer must match the backPointer from the
193       triple that pointed to this node.
194
195       Each item in this node is a triple of (I_ID, backPointer, offset) where
196       the offset points to the next deeper node in the tree, the backPointer
197       value must match the backPointer in that deeper node, and I_ID is the
198       lowest I_ID value in the subtree.
199

64 BIT INDEX 1 NODE

201       The 64 bit index1 b-tree nodes are 512 byte blocks with the following
202       format.
203
204           0000  04 00 00 00  00 00 00 00  88 00 00 00
205           000C  00 00 00 00  00 48 00 00  00 00 00 00
206           0018  74 00 00 00  00 00 00 00  86 00 00 00
207           0024  00 00 00 00  00 54 00 00  00 00 00 00
208           0030  00 00 00 00  00 00 00 00  00 00 00 00
209           003C  00 00 00 00  00 00 00 00  00 00 00 00
210           0048  00 00 00 00  00 00 00 00  00 00 00 00
211           0054  00 00 00 00  00 00 00 00  00 00 00 00
212           0060  00 00 00 00  00 00 00 00  00 00 00 00
213           006C  00 00 00 00  00 00 00 00  00 00 00 00
214           0078  00 00 00 00  00 00 00 00  00 00 00 00
215           0084  00 00 00 00  00 00 00 00  00 00 00 00
216           0090  00 00 00 00  00 00 00 00  00 00 00 00
217           009C  00 00 00 00  00 00 00 00  00 00 00 00
218           00A8  00 00 00 00  00 00 00 00  00 00 00 00
219           00B4  00 00 00 00  00 00 00 00  00 00 00 00
220           00C0  00 00 00 00  00 00 00 00  00 00 00 00
221           00CC  00 00 00 00  00 00 00 00  00 00 00 00
222           00D8  00 00 00 00  00 00 00 00  00 00 00 00
223           00E4  00 00 00 00  00 00 00 00  00 00 00 00
224           00F0  00 00 00 00  00 00 00 00  00 00 00 00
225           00FC  00 00 00 00  00 00 00 00  00 00 00 00
226           0108  00 00 00 00  00 00 00 00  00 00 00 00
227           0114  00 00 00 00  00 00 00 00  00 00 00 00
228           0120  00 00 00 00  00 00 00 00  00 00 00 00
229           012C  00 00 00 00  00 00 00 00  00 00 00 00
230           0138  00 00 00 00  00 00 00 00  00 00 00 00
231           0144  00 00 00 00  00 00 00 00  00 00 00 00
232           0150  00 00 00 00  00 00 00 00  00 00 00 00
233           015C  00 00 00 00  00 00 00 00  00 00 00 00
234           0168  00 00 00 00  00 00 00 00  00 00 00 00
235           0174  00 00 00 00  00 00 00 00  00 00 00 00
236           0180  00 00 00 00  00 00 00 00  00 00 00 00
237           018C  00 00 00 00  00 00 00 00  00 00 00 00
238           0198  00 00 00 00  00 00 00 00  00 00 00 00
239           01A4  00 00 00 00  00 00 00 00  00 00 00 00
240           01B0  00 00 00 00  00 00 00 00  00 00 00 00
241           01BC  00 00 00 00  00 00 00 00  00 00 00 00
242           01C8  00 00 00 00  00 00 00 00  00 00 00 00
243           01D4  00 00 00 00  00 00 00 00  00 00 00 00
244           01E0  00 00 00 00  00 00 00 00  02 14 18 01
245           01EC  00 00 00 00  80 80 8a 60  68 e5 b5 19
246           01F8  8a 00 00 00  00 00 00 00
247
248           01e8  itemCount       [1 byte]  0x02       in this case
249           01e9  maxItemCount    [1 byte]  0x14       constant
250           01ea  itemSize        [1 byte]  0x18       constant
251           01eb  nodeLevel       [1 byte]  0x01       in this case
252           01f8  backPointer     [8 bytes] 0x00008a   in this case
253
254       The itemCount specifies the number of 24 byte records that are active.
255       The nodeLevel is non-zero for this style of nodes. The leaf nodes have
256       a different format. The backPointer must match the backPointer from the
257       triple that pointed to this node.
258
259       Each item in this node is a triple of (I_ID, backPointer, offset) where
260       the offset points to the next deeper node in the tree, the backPointer
261       value must match the backPointer in that deeper node, and I_ID is the
262       lowest I_ID value in the subtree.
263

32 BIT INDEX 1 LEAF NODE

265       The 32 bit index1 b-tree leaf nodes are 512 byte blocks with the
266       following format.
267
268           0000  04 00 00 00  00 58 00 00  64 00  0f 00
269           000c  08 00 00 00  80 58 00 00  ac 00  06 00
270           0018  0c 00 00 00  40 59 00 00  ac 00  06 00
271           0024  10 00 00 00  00 5a 00 00  bc 00  03 00
272           0030  14 00 00 00  00 5b 00 00  a4 00  02 00
273           003c  18 00 00 00  c0 5b 00 00  64 00  02 00
274           0048  1c 00 00 00  40 5c 00 00  5c 00  02 00
275           0054  50 00 00 00  80 62 00 00  60 00  02 00
276           0060  74 00 00 00  00 77 00 00  5e 00  02 00
277           006c  7c 00 00 00  80 77 00 00  66 00  02 00
278           0078  84 00 00 00  00 76 00 00  ca 00  02 00
279           0084  88 00 00 00  00 63 00 00  52 00  02 00
280           0090  90 00 00 00  00 79 00 00  58 00  02 00
281           009c  cc 00 00 00  c0 61 00 00  76 00  02 00
282           00a8  e0 00 00 00  00 61 00 00  74 00  02 00
283           00b4  f4 00 00 00  80 65 00 00  6e 00  02 00
284           00c0  8c 01 00 00  40 60 00 00  70 00  02 00
285           00cc  ea 01 00 00  80 61 00 00  10 00  02 00
286           00d8  ec 01 00 00  40 8a 00 00  f3 01  02 00
287           00e4  f0 01 00 00  80 93 00 00  f4 1f  02 00
288           00f0  fa 01 00 00  c0 7f 00 00  10 00  02 00
289           00fc  00 02 00 00  00 89 00 00  34 01  02 00
290           0108  1c 02 00 00  40 ec 00 00  12 06  02 00
291           0114  22 02 00 00  00 84 00 00  10 00  02 00
292           0120  24 02 00 00  c0 ea 00 00  3c 01  02 00
293           012c  40 02 00 00  00 f4 00 00  0a 06  02 00
294           0138  46 02 00 00  40 8c 00 00  10 00  02 00
295           0144  48 02 00 00  80 f2 00 00  36 01  02 00
296           0150  64 02 00 00  80 fb 00 00  bf 07  02 00
297           015c  6a 02 00 00  80 63 00 00  10 00  02 00
298           0168  6c 02 00 00  40 fa 00 00  2a 01  02 00
299           0174  6c 02 00 00  40 fa 00 00  2a 01  02 00
300           0180  6c 02 00 00  40 fa 00 00  2a 01  02 00
301           018c  6c 02 00 00  40 fa 00 00  2a 01  02 00
302           0198  6c 02 00 00  40 fa 00 00  2a 01  02 00
303           01a4  6c 02 00 00  40 fa 00 00  2a 01  02 00
304           01b0  64 02 00 00  80 fb 00 00  bf 07  02 00
305           01bc  64 02 00 00  80 fb 00 00  bf 07  02 00
306           01c8  64 02 00 00  80 fb 00 00  bf 07  02 00
307           01d4  64 02 00 00  80 fb 00 00  bf 07  02 00
308           01e0  64 02 00 00  80 fb 00 00  bf 07  02 00
309           01ec  00 00 00 00  1f 29 0c 00  80 80  5b b3
310           01f8  5a 67 01 00  4f ae 70 a7
311
312           01f0  itemCount       [1 byte]  0x1f       in this case
313           01f1  maxItemCount    [1 byte]  0x29       constant
314           01f2  itemSize        [1 byte]  0x0c       constant
315           01f3  nodeLevel       [1 byte]  0x00       defines a leaf node
316           01f8  backPointer     [4 bytes] 0x01675a   in this case
317
318       The itemCount specifies the number of 12 byte records that are active.
319       The nodeLevel is zero for these leaf nodes. The backPointer must match
320       the backPointer from the triple that pointed to this node.
321
322       Each item in this node is a tuple of (I_ID, offset, size, unknown) The
323       two low order bits of the I_ID value seem to be flags. I have never
324       seen a case with bit zero set. Bit one indicates that the item is not
325       encrypted. Note that references to these I_ID values elsewhere may have
326       the low order bit set (and I don´t know what that means), but when we
327       do the search in this tree we need to clear that bit so that we can
328       find the correct item.
329

64 BIT INDEX 1 LEAF NODE

331       The 64 bit index1 b-tree leaf nodes are 512 byte blocks with the
332       following format.
333
334           0000  04 00 00 00  00 00 00 00  00 58 00 00
335           000C  00 00 00 00  6c 00 05 00  00 00 00 00
336           0018  08 00 00 00  00 00 00 00  80 58 00 00
337           0024  00 00 00 00  b4 00 06 00  d8 22 37 08
338           0030  0c 00 00 00  00 00 00 00  80 59 00 00
339           003C  00 00 00 00  ac 00 07 00  d8 22 37 08
340           0048  10 00 00 00  00 00 00 00  40 5a 00 00
341           0054  00 00 00 00  bc 00 03 00  d8 22 37 08
342           0060  14 00 00 00  00 00 00 00  40 5b 00 00
343           006C  00 00 00 00  a4 00 02 00  d8 22 37 08
344           0078  18 00 00 00  00 00 00 00  00 5c 00 00
345           0084  00 00 00 00  64 00 02 00  d8 22 37 08
346           0090  1c 00 00 00  00 00 00 00  80 5c 00 00
347           009C  00 00 00 00  5c 00 02 00  d8 22 37 08
348           00A8  24 00 00 00  00 00 00 00  80 5d 00 00
349           00B4  00 00 00 00  72 00 02 00  d8 22 37 08
350           00C0  34 00 00 00  00 00 00 00  00 70 00 00
351           00CC  00 00 00 00  8c 00 02 00  00 0d 00 00
352           00D8  38 00 00 00  00 00 00 00  c0 71 00 00
353           00E4  00 00 00 00  5c 00 02 00  d8 22 9c 00
354           00F0  40 00 00 00  00 00 00 00  40 72 00 00
355           00FC  00 00 00 00  26 00 02 00  d8 22 9c 00
356           0108  4c 00 00 00  00 00 00 00  80 5f 00 00
357           0114  00 00 00 00  3e 00 02 00  d8 22 9c 00
358           0120  5c 00 00 00  00 00 00 00  c0 76 00 00
359           012C  00 00 00 00  8c 00 02 00  d8 22 9c 00
360           0138  64 00 00 00  00 00 00 00  40 75 00 00
361           0144  00 00 00 00  76 00 02 00  d8 22 9c 00
362           0150  6c 00 00 00  00 00 00 00  c0 73 00 00
363           015C  00 00 00 00  5e 00 02 00  d8 22 9c 00
364           0168  70 00 00 00  00 00 00 00  80 72 00 00
365           0174  00 00 00 00  1e 01 02 00  d8 22 9c 00
366           0180  70 00 00 00  00 00 00 00  80 72 00 00
367           018C  00 00 00 00  1e 01 02 00  d8 22 9c 00
368           0198  70 00 00 00  00 00 00 00  80 72 00 00
369           01A4  00 00 00 00  1e 01 02 00  d8 22 9c 00
370           01B0  74 00 00 00  00 00 00 00  40 74 00 00
371           01BC  00 00 00 00  e0 00 02 00  d8 22 9c 00
372           01C8  7c 00 00 00  00 00 00 00  80 77 00 00
373           01D4  00 00 00 00  dc 00 02 00  d8 22 9c 00
374           01E0  00 00 00 00  00 00 00 00  10 14 18 00
375           01EC  00 00 00 00  80 80 88 48  3f 50 0b 04
376           01F8  88 00 00 00  00 00 00 00
377
378           01e8  itemCount       [1 byte]  0x10       in this case
379           01e9  maxItemCount    [1 byte]  0x14       constant
380           01ea  itemSize        [1 byte]  0x18       constant
381           01eb  nodeLevel       [1 byte]  0x00       defines a leaf node
382           01f8  backPointer     [8 bytes] 0x000088   in this case
383
384       The itemCount specifies the number of 24 byte records that are active.
385       The nodeLevel is zero for these leaf nodes. The backPointer must match
386       the backPointer from the triple that pointed to this node.
387
388       Each item in this node is a tuple of (I_ID, offset, size, unknown) The
389       two low order bits of the I_ID value seem to be flags. I have never
390       seen a case with bit zero set. Bit one indicates that the item is not
391       encrypted. Note that references to these I_ID values elsewhere may have
392       the low order bit set (and I don´t know what that means), but when we
393       do the search in this tree we need to clear that bit so that we can
394       find the correct item.
395

32 BIT INDEX 2 NODE

397       The 32 bit index2 b-tree nodes are 512 byte blocks with the following
398       format.
399
400           0000  21 00 00 00  bb 1e 02 00  00 e2 0b 00
401           000c  64 78 20 00  8c 1e 02 00  00 dc 0b 00
402           0018  00 00 00 00  00 00 00 00  00 00 00 00
403           0024  00 00 00 00  00 00 00 00  00 00 00 00
404           0030  00 00 00 00  00 00 00 00  00 00 00 00
405           003c  00 00 00 00  00 00 00 00  00 00 00 00
406           0048  00 00 00 00  00 00 00 00  00 00 00 00
407           0054  00 00 00 00  00 00 00 00  00 00 00 00
408           0060  00 00 00 00  00 00 00 00  00 00 00 00
409           006c  00 00 00 00  00 00 00 00  00 00 00 00
410           0078  00 00 00 00  00 00 00 00  00 00 00 00
411           0084  00 00 00 00  00 00 00 00  00 00 00 00
412           0090  00 00 00 00  00 00 00 00  00 00 00 00
413           009c  00 00 00 00  00 00 00 00  00 00 00 00
414           00a8  00 00 00 00  00 00 00 00  00 00 00 00
415           00b4  00 00 00 00  00 00 00 00  00 00 00 00
416           00c0  00 00 00 00  00 00 00 00  00 00 00 00
417           00cc  00 00 00 00  00 00 00 00  00 00 00 00
418           00d8  00 00 00 00  00 00 00 00  00 00 00 00
419           00e4  00 00 00 00  00 00 00 00  00 00 00 00
420           00f0  00 00 00 00  00 00 00 00  00 00 00 00
421           00fc  00 00 00 00  00 00 00 00  00 00 00 00
422           0108  00 00 00 00  00 00 00 00  00 00 00 00
423           0114  00 00 00 00  00 00 00 00  00 00 00 00
424           0120  00 00 00 00  00 00 00 00  00 00 00 00
425           012c  00 00 00 00  00 00 00 00  00 00 00 00
426           0138  00 00 00 00  00 00 00 00  00 00 00 00
427           0144  00 00 00 00  00 00 00 00  00 00 00 00
428           0150  00 00 00 00  00 00 00 00  00 00 00 00
429           015c  00 00 00 00  00 00 00 00  00 00 00 00
430           0168  00 00 00 00  00 00 00 00  00 00 00 00
431           0174  00 00 00 00  00 00 00 00  00 00 00 00
432           0180  00 00 00 00  00 00 00 00  00 00 00 00
433           018c  00 00 00 00  00 00 00 00  00 00 00 00
434           0198  00 00 00 00  00 00 00 00  00 00 00 00
435           01a4  00 00 00 00  00 00 00 00  00 00 00 00
436           01b0  00 00 00 00  00 00 00 00  00 00 00 00
437           01bc  00 00 00 00  00 00 00 00  00 00 00 00
438           01c8  00 00 00 00  00 00 00 00  00 00 00 00
439           01d4  00 00 00 00  00 00 00 00  00 00 00 00
440           01e0  00 00 00 00  00 00 00 00  00 00 00 00
441           01ec  00 00 00 00  02 29 0c 02  81 81 b2 60
442           01f8  bc 1e 02 00  7e 70 dc e3
443
444           01f0  itemCount       [1 byte]  0x02       in this case
445           01f1  maxItemCount    [1 byte]  0x29       constant
446           01f2  itemSize        [1 byte]  0x0c       constant
447           01f3  nodeLevel       [1 byte]  0x02       in this case
448           01f8  backPointer     [4 bytes] 0x021ebc   in this case
449
450       The itemCount specifies the number of 12 byte records that are active.
451       The nodeLevel is non-zero for this style of nodes. The leaf nodes have
452       a different format. The backPointer must match the backPointer from the
453       triple that pointed to this node.
454
455       Each item in this node is a triple of (D_ID, backPointer, offset) where
456       the offset points to the next deeper node in the tree, the backPointer
457       value must match the backPointer in that deeper node, and D_ID is the
458       lowest D_ID value in the subtree.
459

64 BIT INDEX 2 NODE

461       The 64 bit index2 b-tree nodes are 512 byte blocks with the following
462       format.
463
464           0000  21 00 00 00  00 00 00 00  77 00 00 00
465           000C  00 00 00 00  00 56 00 00  00 00 00 00
466           0018  4c 06 00 00  00 00 00 00  82 00 00 00
467           0024  00 00 00 00  00 68 00 00  00 00 00 00
468           0030  4f 80 00 00  00 00 00 00  84 00 00 00
469           003C  00 00 00 00  00 6e 00 00  00 00 00 00
470           0048  00 00 00 00  00 00 00 00  00 00 00 00
471           0054  00 00 00 00  00 00 00 00  00 00 00 00
472           0060  00 00 00 00  00 00 00 00  00 00 00 00
473           006C  00 00 00 00  00 00 00 00  00 00 00 00
474           0078  00 00 00 00  00 00 00 00  00 00 00 00
475           0084  00 00 00 00  00 00 00 00  00 00 00 00
476           0090  00 00 00 00  00 00 00 00  00 00 00 00
477           009C  00 00 00 00  00 00 00 00  00 00 00 00
478           00A8  00 00 00 00  00 00 00 00  00 00 00 00
479           00B4  00 00 00 00  00 00 00 00  00 00 00 00
480           00C0  00 00 00 00  00 00 00 00  00 00 00 00
481           00CC  00 00 00 00  00 00 00 00  00 00 00 00
482           00D8  00 00 00 00  00 00 00 00  00 00 00 00
483           00E4  00 00 00 00  00 00 00 00  00 00 00 00
484           00F0  00 00 00 00  00 00 00 00  00 00 00 00
485           00FC  00 00 00 00  00 00 00 00  00 00 00 00
486           0108  00 00 00 00  00 00 00 00  00 00 00 00
487           0114  00 00 00 00  00 00 00 00  00 00 00 00
488           0120  00 00 00 00  00 00 00 00  00 00 00 00
489           012C  00 00 00 00  00 00 00 00  00 00 00 00
490           0138  00 00 00 00  00 00 00 00  00 00 00 00
491           0144  00 00 00 00  00 00 00 00  00 00 00 00
492           0150  00 00 00 00  00 00 00 00  00 00 00 00
493           015C  00 00 00 00  00 00 00 00  00 00 00 00
494           0168  00 00 00 00  00 00 00 00  00 00 00 00
495           0174  00 00 00 00  00 00 00 00  00 00 00 00
496           0180  00 00 00 00  00 00 00 00  00 00 00 00
497           018C  00 00 00 00  00 00 00 00  00 00 00 00
498           0198  00 00 00 00  00 00 00 00  00 00 00 00
499           01A4  00 00 00 00  00 00 00 00  00 00 00 00
500           01B0  00 00 00 00  00 00 00 00  00 00 00 00
501           01BC  00 00 00 00  00 00 00 00  00 00 00 00
502           01C8  00 00 00 00  00 00 00 00  00 00 00 00
503           01D4  00 00 00 00  00 00 00 00  00 00 00 00
504           01E0  00 00 00 00  00 00 00 00  03 14 18 01
505           01EC  00 00 00 00  81 81 83 6a  49 da f3 d3
506           01F8  83 00 00 00  00 00 00 00
507
508           01e8  itemCount       [1 byte]  0x03       in this case
509           01e9  maxItemCount    [1 byte]  0x14       constant
510           01ea  itemSize        [1 byte]  0x18       constant
511           01eb  nodeLevel       [1 byte]  0x01       in this case
512           01f8  backPointer     [8 bytes] 0x000083   in this case
513
514       The itemCount specifies the number of 24 byte records that are active.
515       The nodeLevel is non-zero for this style of nodes. The leaf nodes have
516       a different format. The backPointer must match the backPointer from the
517       triple that pointed to this node.
518
519       Each item in this node is a triple of (D_ID, backPointer, offset) where
520       the offset points to the next deeper node in the tree, the backPointer
521       value must match the backPointer in that deeper node, and D_ID is the
522       lowest D_ID value in the subtree.
523

32 BIT INDEX 2 LEAF NODE

525       The 32 bit index2 b-tree leaf nodes are 512 byte blocks with the
526       following format.
527
528           0000  21 00 00 00  38 e6 00 00  00 00 00 00  00 00 00 00
529           0010  61 00 00 00  2c a8 02 00  36 a8 02 00  00 00 00 00
530           0020  22 01 00 00  20 a2 02 00  00 00 00 00  22 01 00 00
531           0030  2d 01 00 00  88 7b 03 00  00 00 00 00  00 00 00 00
532           0040  2e 01 00 00  08 00 00 00  00 00 00 00  00 00 00 00
533           0050  2f 01 00 00  0c 00 00 00  00 00 00 00  00 00 00 00
534           0060  e1 01 00 00  00 00 00 00  00 00 00 00  00 00 00 00
535           0070  01 02 00 00  b4 e4 02 00  00 00 00 00  00 00 00 00
536           0080  61 02 00 00  a0 e4 02 00  00 00 00 00  00 00 00 00
537           0090  0d 06 00 00  04 00 00 00  00 00 00 00  00 00 00 00
538           00A0  0e 06 00 00  08 00 00 00  00 00 00 00  00 00 00 00
539           00B0  0f 06 00 00  0c 00 00 00  00 00 00 00  00 00 00 00
540           00C0  10 06 00 00  10 00 00 00  00 00 00 00  00 00 00 00
541           00D0  2b 06 00 00  84 00 00 00  00 00 00 00  00 00 00 00
542           00E0  4c 06 00 00  1c 00 00 00  00 00 00 00  00 00 00 00
543           00F0  71 06 00 00  18 00 00 00  00 00 00 00  00 00 00 00
544           0100  92 06 00 00  14 00 00 00  00 00 00 00  00 00 00 00
545           0110  23 22 00 00  14 a0 02 00  00 00 00 00  22 01 00 00
546           0120  26 22 00 00  00 00 00 00  00 00 00 00  00 00 00 00
547           0130  27 22 00 00  1c a0 02 00  00 00 00 00  00 00 00 00
548           0140  22 80 00 00  50 00 00 00  00 00 00 00  22 01 00 00
549           0150  2d 80 00 00  f8 9f 02 00  00 00 00 00  00 00 00 00
550           0160  2e 80 00 00  08 00 00 00  00 00 00 00  00 00 00 00
551           0170  2f 80 00 00  34 e6 00 00  00 00 00 00  00 00 00 00
552           0180  42 80 00 00  3c 6d 02 00  00 00 00 00  22 80 00 00
553           0190  4d 80 00 00  04 00 00 00  00 00 00 00  00 00 00 00
554           01A0  4e 80 00 00  10 6d 02 00  00 00 00 00  00 00 00 00
555           01B0  4f 80 00 00  ec 23 00 00  00 00 00 00  00 00 00 00
556           01C0  62 80 00 00  38 78 02 00  00 00 00 00  22 01 00 00
557           01D0  6d 80 00 00  34 78 02 00  00 00 00 00  00 00 00 00
558           01E0  6e 80 00 00  08 00 00 00  00 00 00 00  00 00 00 00
559           01F0  10 1f 10 00  81 81 a0 9a  ae 1e 02 00  89 44 6a 0f
560
561           01f0  itemCount       [1 byte]  0x10       in this case
562           01f1  maxItemCount    [1 byte]  0x1f       constant
563           01f2  itemSize        [1 byte]  0x10       constant
564           01f3  nodeLevel       [1 byte]  0x00       in this case
565           01f8  backPointer     [4 bytes] 0x021eae   in this case
566
567       The itemCount specifies the number of 16 byte records that are active.
568       The nodeLevel is zero for these leaf nodes. The backPointer must match
569       the backPointer from the triple that pointed to this node.
570
571       Each item in this node is a tuple of (D_ID, DESC-I_ID, TREE-I_ID,
572       PARENT-D_ID) The DESC-I_ID points to the main data for this item
573       (Associated Descriptor Items 0x7cec, 0xbcec, or 0x0101) via the index1
574       tree. The TREE-I_ID is zero or points to an Associated Tree Item 0x0002
575       via the index1 tree. The PARENT-D_ID points to the parent of this item
576       in this index2 tree.
577

64 BIT INDEX 2 LEAF NODE

579       The 64 bit index2 b-tree leaf nodes are 512 byte blocks with the
580       following format.
581
582           0000  21 00 00 00 00 00 00 00  74 00 00 00 00 00 00 00
583           0010  00 00 00 00 00 00 00 00  00 00 00 00 02 00 00 00
584           0020  61 00 00 00 00 00 00 00  34 00 00 00 00 00 00 00
585           0030  00 00 00 00 00 00 00 00  00 00 00 00 02 00 00 00
586           0040  22 01 00 00 00 00 00 00  4c 00 00 00 00 00 00 00
587           0050  00 00 00 00 00 00 00 00  22 01 00 00 02 00 00 00
588           0060  2d 01 00 00 00 00 00 00  70 00 00 00 00 00 00 00
589           0070  00 00 00 00 00 00 00 00  00 00 00 00 02 00 00 00
590           0080  2e 01 00 00 00 00 00 00  08 00 00 00 00 00 00 00
591           0090  00 00 00 00 00 00 00 00  00 00 00 00 02 00 00 00
592           00A0  2f 01 00 00 00 00 00 00  0c 00 00 00 00 00 00 00
593           00B0  00 00 00 00 00 00 00 00  00 00 00 00 02 00 00 00
594           00C0  e1 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00
595           00D0  00 00 00 00 00 00 00 00  00 00 00 00 d8 e3 13 00
596           00E0  01 02 00 00 00 00 00 00  8c 00 00 00 00 00 00 00
597           00F0  00 00 00 00 00 00 00 00  00 00 00 00 b0 e3 13 00
598           0100  61 02 00 00 00 00 00 00  00 00 00 00 00 00 00 00
599           0110  00 00 00 00 00 00 00 00  00 00 00 00 d8 e3 13 00
600           0120  0d 06 00 00 00 00 00 00  04 00 00 00 00 00 00 00
601           0130  00 00 00 00 00 00 00 00  00 00 00 00 02 00 00 00
602           0140  0e 06 00 00 00 00 00 00  08 00 00 00 00 00 00 00
603           0150  00 00 00 00 00 00 00 00  00 00 00 00 02 00 00 00
604           0160  0f 06 00 00 00 00 00 00  0c 00 00 00 00 00 00 00
605           0170  00 00 00 00 00 00 00 00  00 00 00 00 02 00 00 00
606           0180  10 06 00 00 00 00 00 00  10 00 00 00 00 00 00 00
607           0190  00 00 00 00 00 00 00 00  00 00 00 00 02 00 00 00
608           01A0  2b 06 00 00 00 00 00 00  24 00 00 00 00 00 00 00
609           01B0  00 00 00 00 00 00 00 00  00 00 00 00 02 00 00 00
610           01C0  71 06 00 00 00 00 00 00  18 00 00 00 00 00 00 00
611           01D0  00 00 00 00 00 00 00 00  00 00 00 00 02 00 00 00
612           01E0  00 00 00 00 00 00 00 00  0e 0f 20 00 00 00 00 00
613           01F0  81 81 77 56 f8 32 43 49  77 00 00 00 00 00 00 00
614
615           01e8  itemCount       [1 byte]  0x0e       in this case
616           01e9  maxItemCount    [1 byte]  0x0f       constant
617           01ea  itemSize        [1 byte]  0x20       constant
618           01eb  nodeLevel       [1 byte]  0x00       defines a leaf node
619           01f8  backPointer     [8 bytes] 0x000077   in this case
620
621       The itemCount specifies the number of 32 byte records that are active.
622       The nodeLevel is zero for these leaf nodes. The backPointer must match
623       the backPointer from the triple that pointed to this node.
624
625       Each item in this node is a tuple of (D_ID, DESC-I_ID, TREE-I_ID,
626       PARENT-D_ID) The DESC-I_ID points to the main data for this item
627       (Associated Descriptor Items 0x7cec, 0xbcec, or 0x0101) via the index1
628       tree. The TREE-I_ID is zero or points to an Associated Tree Item 0x0002
629       via the index1 tree. The PARENT-D_ID points to the parent of this item
630       in this index2 tree.
631

32 BIT ASSOCIATED TREE ITEM 0X0002

633       A D_ID value may point to an entry in the index2 tree with a non-zero
634       TREE-I_ID which points to this descriptor block via the index1 tree. It
635       maps local ID2 values (referenced in the main data for the original
636       D_ID item) to I_ID values. This descriptor block contains triples of
637       (ID2, I_ID, CHILD-I_ID) where the local ID2 data can be found via I_ID,
638       and CHILD-I_ID is either zero or it points to another Associated Tree
639       Item via the index1 tree.
640
641       In the above 32 bit leaf node, we have a tuple of (0x61, 0x02a82c,
642       0x02a836, 0) 0x02a836 is the I_ID of the associated tree, and we can
643       lookup that I_ID value in the index1 b-tree to find the (offset,size)
644       of the data in the .pst file.
645
646           0000  02 00  01 00  9f 81 00 00  30 a8 02 00  00 00 00 00
647
648           0000  signature       [2 bytes] 0x0002     constant
649           0002  count           [2 bytes] 0x0001     in this case
650             repeating
651           0004  id2             [4 bytes] 0x00819f   in this case
652           0008  i_id            [4 bytes] 0x02a830   in this case
653           000c  child-i_id      [4 bytes] 0          in this case
654

64 BIT ASSOCIATED TREE ITEM 0X0002

656       This descriptor block contains a tree that maps local ID2 values to
657       I_ID entries, similar to the 32 bit version described above.
658
659           0000  02 00 02 00  00 00 00 00  92 06 00 00  00 00 00 00
660           0010  a8 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00
661           0020  3f 80 00 00  00 00 00 00  98 00 00 00  00 00 00 00
662           0030  00 00 00 00  00 00 00 00
663
664           0000  signature       [2 bytes] 0x0002     constant
665           0002  count           [2 bytes] 0x0002     in this case
666           0004  unknown         [4 bytes] 0          possibly constant
667             repeating
668           0008  id2             [4 bytes] 0x000692   in this case
669           000c  unknown1        [2 bytes] 0          may be a count or size
670           000e  unknown2        [2 bytes] 0          may be a count or size
671           0010  i_id            [8 bytes] 0x0000a8   in this case
672           0018  child-i_id      [8 bytes] 0          in this case
673

ASSOCIATED DESCRIPTOR ITEM 0XBCEC

675       Contains information about the item, which may be email, contact, or
676       other outlook types. In the above leaf node, we have a tuple of (0x21,
677       0x00e638, 0, 0) 0x00e638 is the I_ID of the associated descriptor, and
678       we can lookup that I_ID value in the index1 b-tree to find the
679       (offset,size) of the data in the .pst file. This descriptor is
680       eventually decoded to a list of MAPI elements.
681
682           0000  3c 01 ec bc  20 00 00 00  00 00 00 00  b5 02 06 00
683           0010  40 00 00 00  f9 0f 02 01  60 00 00 00  01 30 1e 00
684           0020  80 00 00 00  04 30 1e 00  00 00 00 00  df 35 03 00
685           0030  ff 00 00 00  e0 35 02 01  a0 00 00 00  e2 35 02 01
686           0040  e0 00 00 00  e3 35 02 01  c0 00 00 00  e4 35 02 01
687           0050  00 01 00 00  e5 35 02 01  20 01 00 00  e6 35 02 01
688           0060  40 01 00 00  e7 35 02 01  60 01 00 00  1e 66 0b 00
689           0070  00 00 00 00  ff 67 03 00  00 00 00 00  d2 7f 17 d8
690           0080  64 8c d5 11  83 24 00 50  04 86 95 45  53 74 61 6e
691           0090  6c 65 79 00  00 00 00 d2  7f 17 d8 64  8c d5 11 83
692           00A0  24 00 50 04  86 95 45 22  80 00 00 00  00 00 00 d2
693           00B0  7f 17 d8 64  8c d5 11 83  24 00 50 04  86 95 45 42
694           00C0  80 00 00 00  00 00 00 d2  7f 17 d8 64  8c d5 11 83
695           00D0  24 00 50 04  86 95 45 a2  80 00 00 00  00 00 00 d2
696           00E0  7f 17 d8 64  8c d5 11 83  24 00 50 04  86 95 45 c2
697           00F0  80 00 00 00  00 00 00 d2  7f 17 d8 64  8c d5 11 83
698           0100  24 00 50 04  86 95 45 e2  80 00 00 00  00 00 00 d2
699           0110  7f 17 d8 64  8c d5 11 83  24 00 50 04  86 95 45 02
700           0120  81 00 00 00  00 00 00 d2  7f 17 d8 64  8c d5 11 83
701           0130  24 00 50 04  86 95 45 62  80 00 00 00  0b 00 00 00
702           0140  0c 00 14 00  7c 00 8c 00  93 00 ab 00  c3 00 db 00
703           0150  f3 00 0b 01  23 01 3b 01
704
705           0000  indexOffset     [2 bytes] 0x013c     in this case
706           0002  signature       [2 bytes] 0xbcec     constant
707           0004  b5offset        [4 bytes] 0x0020     index reference
708
709       Note the signature of 0xbcec. There are other descriptor block formats
710       with other signatures. Note the indexOffset of 0x013c - starting at
711       that position in the descriptor block, we have an array of two byte
712       integers. The first integer (0x000b) is a (count-1) of the number of
713       overlapping pairs following the count. The first pair is (0, 0xc), the
714       next pair is (0xc, 0x14) and the last (12th) pair is (0x123, 0x13b).
715       These pairs are (start,end+1) offsets of items in this block. So we
716       have count+2 integers following the count value.
717
718       Note the b5offset of 0x0020, which is a type that I will call an index
719       reference. Such index references have at least two different forms, and
720       may point to data either in this block, or in some other block.
721       External pointer references have the low order 4 bits all set, and are
722       ID2 values that can be used to fetch data. This value of 0x0020 is an
723       internal pointer reference, which needs to be right shifted by 4 bits
724       to become 0x0002, which is then a byte offset to be added to the above
725       indexOffset plus two (to skip the count), so it points to the (0xc,
726       0x14) pair.
727
728       So far we have only described internal index references where the high
729       order 16 bits are zero. That suffices for single descriptor blocks. But
730       in the case of the type 0x0101 descriptor block, we have an array of
731       subblocks. In this case, the high order 16 bits of an internal index
732       reference are used to select the subblock. Each subblock starts with a
733       16 bit indexOffset which points to the count and array of 16 bit
734       integer pairs which are offsets in the current subblock.
735
736       Finally, we have the offset and size of the "b5" block located at
737       offset 0xc with a size of 8 bytes in this descriptor block. The "b5"
738       block has the following format:
739
740           0000  signature       [2 bytes] 0x02b5     constant
741           0002  datasize        [2 bytes] 0x0006     constant +2 for 8 byte entries
742           0004  descoffset      [4 bytes] 0x0040     index reference
743
744       Note the descoffset of 0x0040, which again is an index reference. In
745       this case, it is an internal pointer reference, which needs to be right
746       shifted by 4 bits to become 0x0004, which is then a byte offset to be
747       added to the above indexOffset plus two (to skip the count), so it
748       points to the (0x14, 0x7c) pair. The datasize (6) plus the b5 code (02)
749       gives the size of the entries, in this case 8 bytes. We now have the
750       offset 0x14 of the descriptor array, composed of 8 byte entries that
751       describe MAPI elements. Each descriptor entry has the following format:
752
753           0000  itemType        [2 bytes]
754           0002  referenceType   [2 bytes]
755           0004  value           [4 bytes]
756
757       For some reference types (2, 3, 0xb) the value is used directly.
758       Otherwise, the value is an index reference, which is either an ID2
759       value, or an offset, to be right shifted by 4 bits and used to fetch a
760       pair from the index table to find the offset and size of the item in
761       this descriptor block.
762
763       The following reference types are known, but not all of these are
764       implemented in the code yet.
765
766           0x0002 - Signed 16bit value
767           0x0003 - Signed 32bit value
768           0x0004 - 4-byte floating point
769           0x0005 - Floating point double
770           0x0006 - Signed 64-bit int
771           0x0007 - Application Time
772           0x000A - 32-bit error value
773           0x000B - Boolean (non-zero = true)
774           0x000D - Embedded Object
775           0x0014 - 8-byte signed integer (64-bit)
776           0x001E - Null terminated String
777           0x001F - Unicode string
778           0x0040 - Systime - Filetime structure
779           0x0048 - OLE Guid
780           0x0102 - Binary data
781           0x1003 - Array of 32bit values
782           0x1014 - Array of 64bit values
783           0x101E - Array of Strings
784           0x1102 - Array of Binary data
785
786       The following item types are known, but not all of these are
787       implemented in the code yet.
788
789           0x0002  Alternate recipient allowed
790           0x0003  Extended Attributes Table
791           0x0017  Importance Level
792           0x001a  IPM Context, message class
793           0x0023  Global delivery report requested
794           0x0026  Priority
795           0x0029  Read Receipt
796           0x002b  Reassignment Prohibited
797           0x002e  Original Sensitivity
798           0x0032  Report time
799           0x0036  Sensitivity
800           0x0037  Email Subject
801           0x0039  Client submit time / date sent
802           0x003b  Outlook Address of Sender
803           0x003f  Outlook structure describing the recipient
804           0x0040  Name of the Outlook recipient structure
805           0x0041  Outlook structure describing the sender
806           0x0042  Name of the Outlook sender structure
807           0x0043  Another structure describing the recipient
808           0x0044  Name of the second recipient structure
809           0x004f  Reply-To Outlook Structure
810           0x0050  Name of the Reply-To structure
811           0x0051  Outlook Name of recipient
812           0x0052  Second Outlook name of recipient
813           0x0057  My address in TO field
814           0x0058  My address in CC field
815           0x0059  Message addressed to me
816           0x0063  Response requested
817           0x0064  Sender´s Address access method (SMTP, EX)
818           0x0065  Sender´s Address
819           0x0070  Conversation topic, processed subject (with Fwd:, Re, ... removed)
820           0x0071  Conversation index
821           0x0072  Original display BCC
822           0x0073  Original display CC
823           0x0074  Original display TO
824           0x0075  Recipient Address Access Method (SMTP, EX)
825           0x0076  Recipient´s Address
826           0x0077  Second Recipient Access Method (SMTP, EX)
827           0x0078  Second Recipient Address
828           0x007d  Email Header. This is the header that was attached to the email
829           0x0c04  NDR Reason code
830           0x0c05  NDR Diag code
831           0x0c06  Non-receipt notification requested
832           0x0c17  Reply Requested
833           0x0c19  Second sender structure
834           0x0c1a  Name of second sender structure
835           0x0c1b  Supplementary info
836           0x0c1d  Second outlook name of sender
837           0x0c1e  Second sender access method (SMTP, EX)
838           0x0c1f  Second Sender Address
839           0x0c20  NDR status code
840           0x0e01  Delete after submit
841           0x0e02  BCC Addresses
842           0x0e03  CC Addresses
843           0x0e04  SentTo Address
844           0x0e06  Date.
845           0x0e07  Flag bits
846                       0x01 - Read
847                       0x02 - Unmodified
848                       0x04 - Submit
849                       0x08 - Unsent
850                       0x10 - Has Attachments
851                       0x20 - From Me
852                       0x40 - Associated
853                       0x80 - Resend
854                       0x100 - RN Pending
855                       0x200 - NRN Pending
856           0x0e08  Message Size
857           0x0e0a  Sentmail EntryID
858           0x0e1d  Normalized subject
859           0x0e1f  Compressed RTF in Sync
860           0x0e20  Attachment Size
861           0x0ff9  binary record header
862           0x1000  Plain Text Email Body. Does not exist if the email doesn´t have a plain text version
863           0x1001  Report Text
864           0x1006  RTF Sync Body CRC
865           0x1007  RTF Sync Body character count
866           0x1008  RTF Sync body tag
867           0x1009  RTF Compressed body
868           0x1010  RTF whitespace prefix count
869           0x1011  RTF whitespace tailing count
870           0x1013  HTML Email Body. Does not exist if the email doesn´t have an HTML version
871           0x1035  Message ID
872           0x1042  In-Reply-To or Parent´s Message ID
873           0x1046  Return Path
874           0x3001  Folder Name? I have also seen this value used for the contacts record
875           0x3002  Address Type
876           0x3003  Contact Address
877           0x3004  Comment
878           0x3007  Date item creation
879           0x3008  Date item modification
880           0x300b  binary record header
881           0x35df  Valid Folder Mask
882           0x35e0  binary record contains a reference to "Top of Personal Folder" item
883           0x35e2  binary record contains a reference to default outbox item
884           0x35e3  binary record contains a reference to "Deleted Items" item
885           0x35e4  binary record contains a reference to sent items folder item
886           0x35e5  binary record contains a reference to user views folder item
887           0x35e6  binary record contains a reference to common views folder item
888           0x35e7  binary record contains a reference to "Search Root" item
889           0x3602  the number of emails stored in a folder
890           0x3603  the number of unread emails in a folder
891           0x360a  Has Subfolders
892           0x3613  the folder content description
893           0x3617  Associate Content count
894           0x3701  Binary Data attachment
895           0x3704  Attachment Filename
896           0x3705  Attachement method
897           0x3707  Attachment Filename long
898           0x370b  Attachment Position
899           0x370e  Attachment mime encoding
900           0x3710  Attachment mime Sequence
901           0x3712  Content ID
902           0x3a00  Contact´s Account name
903           0x3a01  Contact Alternate Recipient
904           0x3a02  Callback telephone number
905           0x3a03  Message Conversion Prohibited
906           0x3a05  Contacts Suffix
907           0x3a06  Contacts First Name
908           0x3a07  Contacts Government ID Number
909           0x3a08  Business Telephone Number
910           0x3a09  Home Telephone Number
911           0x3a0a  Contacts Initials
912           0x3a0b  Keyword
913           0x3a0c  Contact´s Language
914           0x3a0d  Contact´s Location
915           0x3a0e  Mail Permission
916           0x3a0f  MHS Common Name
917           0x3a10  Organizational ID #
918           0x3a11  Contacts Surname
919           0x3a12  original entry id
920           0x3a13  original display name
921           0x3a14  original search key
922           0x3a15  Default Postal Address
923           0x3a16  Company Name
924           0x3a17  Job Title
925           0x3a18  Department Name
926           0x3a19  Office Location
927           0x3a1a  Primary Telephone
928           0x3a1b  Business Phone Number 2
929           0x3a1c  Mobile Phone Number
930           0x3a1d  Radio Phone Number
931           0x3a1e  Car Phone Number
932           0x3a1f  Other Phone Number
933           0x3a20  Transmittable Display Name
934           0x3a21  Pager Phone Number
935           0x3a22  user certificate
936           0x3a23  Primary Fax Number
937           0x3a24  Business Fax Number
938           0x3a25  Home Fax Number
939           0x3a26  Business Address Country
940           0x3a27  Business Address City
941           0x3a28  Business Address State
942           0x3a29  Business Address Street
943           0x3a2a  Business Postal Code
944           0x3a2b  Business PO Box
945           0x3a2c  Telex Number
946           0x3a2d  ISDN Number
947           0x3a2e  Assistant Phone Number
948           0x3a2f  Home Phone 2
949           0x3a30  Assistant´s Name
950           0x3a40  Can receive Rich Text
951           0x3a41  Wedding Anniversary
952           0x3a42  Birthday
953           0x3a43  Hobbies
954           0x3a44  Middle Name
955           0x3a45  Display Name Prefix (Title)
956           0x3a46  Profession
957           0x3a47  Preferred By Name
958           0x3a48  Spouse´s Name
959           0x3a49  Computer Network Name
960           0x3a4a  Customer ID
961           0x3a4b  TTY/TDD Phone
962           0x3a4c  Ftp Site
963           0x3a4d  Gender
964           0x3a4e  Manager´s Name
965           0x3a4f  Nickname
966           0x3a50  Personal Home Page
967           0x3a51  Business Home Page
968           0x3a57  Company Main Phone
969           0x3a58  childrens names
970           0x3a59  Home Address City
971           0x3a5a  Home Address Country
972           0x3a5b  Home Address Postal Code
973           0x3a5c  Home Address State or Province
974           0x3a5d  Home Address Street
975           0x3a5e  Home Address Post Office Box
976           0x3a5f  Other Address City
977           0x3a60  Other Address Country
978           0x3a61  Other Address Postal Code
979           0x3a62  Other Address State
980           0x3a63  Other Address Street
981           0x3a64  Other Address Post Office box
982           0x3fde  Internet code page
983           0x3ffd  Message code page
984           0x65e3  Entry ID
985           0x67f2  Attachment ID2 value
986           0x67ff  Password checksum
987           0x6f02  Secure HTML Body
988           0x6f04  Secure Text Body
989           0x7c07  Top of folders RecID
990           0x8005  Contact Fullname
991           0x801a  Home Address
992           0x801b  Business Address
993           0x801c  Other Address
994           0x8045  Work Address Street
995           0x8046  Work Address City
996           0x8047  Work Address State
997           0x8048  Work Address Postal Code
998           0x8049  Work Address Country
999           0x804a  Work Address Post Office Box
1000           0x8082  Email Address 1 Transport
1001           0x8083  Email Address 1 Address
1002           0x8084  Email Address 1 Description
1003           0x8085  Email Address 1 Record
1004           0x8092  Email Address 2 Transport
1005           0x8093  Email Address 2 Address
1006           0x8094  Email Address 2 Description
1007           0x8095  Email Address 2 Record
1008           0x80a2  Email Address 3 Transport
1009           0x80a3  Email Address 3 Address
1010           0x80a4  Email Address 3 Description
1011           0x80a5  Email Address 3 Record
1012           0x80d8  Internet Free/Busy
1013           0x8205  Appointment shows as
1014           0x8208  Appointment Location
1015           0x820d  Appointment start
1016           0x820e  Appointment end
1017           0x8214  Label for appointment
1018           0x8215  All day appointment flag
1019           0x8216  Appointment recurrence data
1020           0x8223  Appointment is recurring
1021           0x8231  Recurrence type
1022           0x8232  Recurrence description
1023           0x8234  TimeZone of times
1024           0x8235  Recurrence Start Time
1025           0x8236  Recurrence End Time
1026           0x8501  Reminder minutes before appointment start
1027           0x8503  Reminder alarm
1028           0x8516  Common Time Start
1029           0x8517  Common Time End
1030           0x851f  Play reminder sound filename
1031           0x8530  Followup String
1032           0x8534  Mileage
1033           0x8535  Billing Information
1034           0x8554  Outlook Version
1035           0x8560  Appointment Reminder Time
1036           0x8700  Journal Entry Type
1037           0x8706  Start Timestamp
1038           0x8708  End Timestamp
1039           0x8712  Journal Entry Type - duplicate?
1040

ASSOCIATED DESCRIPTOR ITEM 0X7CEC

1042       This style of descriptor block is similar to the 0xbcec format. This
1043       descriptor is also eventually decoded to a list of MAPI elements.
1044
1045           0000  7a 01 ec 7c  40 00 00 00  00 00 00 00  b5 04 02 00
1046           0010  60 00 00 00  7c 18 60 00  60 00 62 00  65 00 20 00
1047           0020  00 00 80 00  00 00 00 00  00 00 03 00  20 0e 0c 00
1048           0030  04 03 1e 00  01 30 2c 00  04 0b 1e 00  03 37 28 00
1049           0040  04 0a 1e 00  04 37 14 00  04 05 03 00  05 37 10 00
1050           0050  04 04 1e 00  07 37 24 00  04 09 1e 00  08 37 20 00
1051           0060  04 08 02 01  0a 37 18 00  04 06 03 00  0b 37 08 00
1052           0070  04 02 1e 00  0d 37 1c 00  04 07 1e 00  0e 37 40 00
1053           0080  04 10 02 01  0f 37 30 00  04 0c 1e 00  11 37 34 00
1054           0090  04 0d 1e 00  12 37 3c 00  04 0f 1e 00  13 37 38 00
1055           00A0  04 0e 03 00  f2 67 00 00  04 00 03 00  f3 67 04 00
1056           00B0  04 01 03 00  09 69 44 00  04 11 03 00  fa 7f 5c 00
1057           00C0  04 15 40 00  fb 7f 4c 00  08 13 40 00  fc 7f 54 00
1058           00D0  08 14 03 00  fd 7f 48 00  04 12 0b 00  fe 7f 60 00
1059           00E0  01 16 0b 00  ff 7f 61 00  01 17 45 82  00 00 00 00
1060           00F0  45 82 00 00  78 3c 00 00  ff ff ff ff  49 1e 00 00
1061           0100  06 00 00 00  00 00 00 00  a0 00 00 00  00 00 00 00
1062           0110  00 00 00 00  00 00 00 00  00 00 00 00  c0 00 00 00
1063           0120  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00
1064           0130  00 00 00 00  00 00 00 00  00 00 00 00  00 40 dd a3
1065           0140  57 45 b3 0c  00 40 dd a3  57 45 b3 0c  02 00 00 00
1066           0150  00 00 fa 10  3e 2a 86 48  86 f7 14 03  0a 03 02 01
1067           0160  4a 2e 20 44  61 76 69 64  20 4b 61 72  61 6d 27 73
1068           0170  20 42 69 72  74 68 64 61  79 00 06 00  00 00 0c 00
1069           0180  14 00 ea 00  f0 00 55 01  60 01 79 01
1070
1071           0000  indexOffset     [2 bytes] 0x017a     in this case
1072           0002  signature       [2 bytes] 0x7cec     constant
1073           0004  7coffset        [4 bytes] 0x0040     index reference
1074
1075       Note the signature of 0x7cec. There are other descriptor block formats
1076       with other signatures. Note the indexOffset of 0x017a - starting at
1077       that position in the descriptor block, we have an array of two byte
1078       integers. The first integer (0x0006) is a (count-1) of the number of
1079       overlapping pairs following the count. The first pair is (0, 0xc), the
1080       next pair is (0xc, 0x14) and the last (7th) pair is (0x160, 0x179).
1081       These pairs are (start,end+1) offsets of items in this block. So we
1082       have count+2 integers following the count value.
1083
1084       Note the 7coffset of 0x0040, which is an index reference. In this case,
1085       it is an internal reference pointer, which needs to be right shifted by
1086       4 bits to become 0x0004, which is then a byte offset to be added to the
1087       above indexOffset plus two (to skip the count), so it points to the
1088       (0x14, 0xea) pair. We have the offset and size of the "7c" block
1089       located at offset 0x14 with a size of 214 bytes in this case. The "7c"
1090       block starts with a header with the following format:
1091
1092           0000  signature       [1 bytes] 0x7c       constant
1093           0001  itemCount       [1 bytes] 0x18       in this case
1094           0002  unknown         [2 bytes] 0x0060     in this case
1095           0004  unknown         [2 bytes] 0x0060     in this case
1096           0006  unknown         [2 bytes] 0x0062     in this case
1097           0008  recordSize      [2 bytes] 0x0065     in this case
1098           000a  b5Offset        [4 bytes] 0x0020     index reference
1099           000e  index2Offset    [4 bytes] 0x0080     index reference
1100           0012  unknown         [2 bytes] 0x0000     in this case
1101           0014  unknown         [2 bytes] 0x0000     in this case
1102
1103       Note the b5Offset of 0x0020, which is an index reference. In this case,
1104       it is an internal reference pointer, which needs to be right shifted by
1105       4 bits to become 0x0002, which is then a byte offset to be added to the
1106       above indexOffset plus two (to skip the count), so it points to the
1107       (0xc, 0x14) pair. Finally, we have the offset and size of the "b5"
1108       block located at offset 0xc with a size of 8 bytes in this descriptor
1109       block. The "b5" block has the following format:
1110
1111           0000  signature       [2 bytes] 0x04b5     constant
1112           0002  datasize        [2 bytes] 0x0002     +4 for 6 byte entries in this case
1113           0004  descoffset      [4 bytes] 0x0060     index reference
1114
1115       Note the descoffset of 0x0060, which again is an index reference. In
1116       this case, it is an internal pointer reference, which needs to be right
1117       shifted by 4 bits to become 0x0006, which is then a byte offset to be
1118       added to the above indexOffset plus two (to skip the count), so it
1119       points to the (0xea, 0xf0) pair. The datasize (2) plus the b5 code (04)
1120       gives the size of the entries, in this case 6 bytes. We now have the
1121       offset 0xea of an unused block of data in an unknown format, composed
1122       of 6 byte entries. That gives us (0xf0 - 0xea)/6 = 1, so we have a
1123       recordCount of one.
1124
1125       We have seen cases where the descoffset in the b5 block is zero, and
1126       the index2Offset in the 7c block is zero. This has been seen for
1127       objects that seem to be attachments on messages that have been read.
1128       Before the message was read, it did not have any attachments.
1129
1130       Note the index2Offset above of 0x0080, which again is an index
1131       reference. In this case, it is an internal pointer reference, which
1132       needs to be right shifted by 4 bits to become 0x0008, which is then a
1133       byte offset to be added to the above indexOffset plus two (to skip the
1134       count), so it points to the (0xf0, 0x155) pair. This is an array of
1135       tables of four byte integers. We will call these the IND2 tables. The
1136       size of each of these tables is specified by the recordSize field of
1137       the "7c" header. The number of these tables is the above recordCount
1138       value derived from the "b5" block.
1139
1140       Now the remaining data in the "7c" block after the header starts at
1141       offset 0x2a. There should be itemCount 8 byte items here, with the
1142       following format:
1143
1144           0000  referenceType   [2 bytes]
1145           0002  itemType        [2 bytes]
1146           0004  ind2Offset      [2 bytes]
1147           0006  size            [1 byte]
1148           0007  unknown         [1 byte]
1149
1150       The ind2Offset is a byte offset into the current IND2 table of some
1151       value. If that is a four byte integer value, then once we fetch that,
1152       we have the same triple (item type, reference type, value) as we find
1153       in the 0xbcec style descriptor blocks. If not, then this value is used
1154       directly. These 8 byte descriptors are processed recordCount times,
1155       each time using the next IND2 table. The item and reference types are
1156       as described above for the 0xbcec format descriptor block.
1157

32 BIT ASSOCIATED DESCRIPTOR ITEM 0X0101

1159       This descriptor block contains a list of I_ID values. It is used when
1160       an I_ID (that would normally point to a type 0x7cec or 0xbcec
1161       descriptor block) contains more data than can fit in any single
1162       descriptor of those types. In this case, it points to a type 0x0101
1163       block, which contains a list of I_ID values that themselves point to
1164       the actual descriptor blocks. The total length value in the 0x0101
1165       header is the sum of the lengths of the blocks pointed to by the list
1166       of I_ID values. The result is an array of subblocks, that may contain
1167       index references where the high order 16 bits specify which descriptor
1168       subblock to use. Only the first descriptor subblock contains the
1169       signature (0xbcec or 0x7cec).
1170
1171           0000  01 01 02 00  26 28 00 00  18 77 0c 00  b8 04 00 00
1172
1173           0000  signature       [2 bytes] 0x0101     constant
1174           0002  count           [2 bytes] 0x0002     in this case
1175           0004  total length    [4 bytes] 0x002826   in this case
1176             repeating
1177           0008  i_id            [4 bytes] 0x0c7718   in this case
1178           000c  i_id            [4 bytes] 0x0004b8   in this case
1179

64 BIT ASSOCIATED DESCRIPTOR ITEM 0X0101

1181       This descriptor block contains a list of I_ID values, similar to the 32
1182       bit version described above.
1183
1184           0000  01 01 02 00  ea 29 00 00  10 83 00 00  00 00 00 00
1185           0010  1c 83 00 00  00 00 00 00
1186
1187           0000  signature       [2 bytes] 0x0101     constant
1188           0002  count           [2 bytes] 0x0002     in this case
1189           0004  total length    [4 bytes] 0x0029ea   in this case
1190             repeating
1191           0008  i_id            [8 bytes] 0x008310   in this case
1192           0010  i_id            [8 bytes] 0x00831c   in this case
1193
1194
1195
1196[FIXME: source]                   2017-12-07                    OUTLOOK.PST(5)
Impressum