|
16
|
1 <reference>
|
|
|
2 <title>@PACKAGE@ Utilities - Version @VERSION@</title>
|
|
|
3 <partintro>
|
|
|
4 <title>Packages</title>
|
|
|
5 <para>The various source and binary packages are available at <ulink
|
|
|
6 url="http://www.five-ten-sg.com/@PACKAGE@/packages/">http://www.five-ten-sg.com/@PACKAGE@/packages/</ulink>
|
|
|
7 The most recent documentation is available at <ulink
|
|
|
8 url="http://www.five-ten-sg.com/@PACKAGE@/">http://www.five-ten-sg.com/@PACKAGE@/</ulink>
|
|
|
9 </para>
|
|
24
|
10 </partintro>
|
|
16
|
11
|
|
|
12
|
|
|
13 <refentry id="readpst.1">
|
|
|
14 <refentryinfo>
|
|
24
|
15 <date>2006-02-20</date>
|
|
16
|
16 </refentryinfo>
|
|
|
17
|
|
|
18 <refmeta>
|
|
|
19 <refentrytitle>readpst</refentrytitle>
|
|
|
20 <manvolnum>1</manvolnum>
|
|
|
21 <refmiscinfo>readpst @VERSION@</refmiscinfo>
|
|
|
22 </refmeta>
|
|
|
23
|
|
20
|
24 <refnamediv id='readpst.name.1'>
|
|
16
|
25 <refname>readpst</refname>
|
|
|
26 <refpurpose>convert PST (MS Outlook Personal Folders) files to mbox format</refpurpose>
|
|
|
27 </refnamediv>
|
|
|
28
|
|
20
|
29 <refsynopsisdiv id='readpst.synopsis.1'>
|
|
16
|
30 <title>Synopsis</title>
|
|
|
31 <cmdsynopsis>
|
|
|
32 <command>readpst</command>
|
|
|
33 <arg><option>-c <replaceable class="parameter">format</replaceable></option></arg>
|
|
|
34 <arg><option>-d <replaceable class="parameter">debug-file</replaceable></option></arg>
|
|
|
35 <arg><option>-h</option></arg>
|
|
|
36 <arg><option>-k</option></arg>
|
|
|
37 <arg><option>-o <replaceable class="parameter">output-directory</replaceable></option></arg>
|
|
|
38 <arg><option>-q</option></arg>
|
|
|
39 <arg><option>-r</option></arg>
|
|
|
40 <arg><option>-S</option></arg>
|
|
25
|
41 <arg><option>-M</option></arg>
|
|
16
|
42 <arg><option>-V</option></arg>
|
|
|
43 <arg><option>-w</option></arg>
|
|
24
|
44 <arg rep='repeat' choice='plain'>files</arg>
|
|
16
|
45 </cmdsynopsis>
|
|
|
46 </refsynopsisdiv>
|
|
|
47
|
|
20
|
48 <refsect1 id='readpst.description.1'>
|
|
|
49 <title>Description</title>
|
|
28
|
50 <para><command>readpst</command> is a program that can read an Outlook
|
|
|
51 PST (Personal Folders) file and convert it into an mbox file, a format
|
|
|
52 suitable for KMail, a recursive mbox structure, or separate emails.
|
|
20
|
53 </para>
|
|
|
54 </refsect1>
|
|
|
55
|
|
|
56 <refsect1 id='readpst.options.1'>
|
|
16
|
57 <title>Options</title>
|
|
|
58 <variablelist>
|
|
|
59 <varlistentry>
|
|
|
60 <term>-c <replaceable class="parameter">format</replaceable></term>
|
|
|
61 <listitem><para>
|
|
|
62 Set the Contact output mode. Use -cv for vcard format or -cl for an email list.
|
|
|
63 </para></listitem>
|
|
|
64 </varlistentry>
|
|
|
65 <varlistentry>
|
|
|
66 <term>-d <replaceable class="parameter">debug-file</replaceable></term>
|
|
|
67 <listitem><para>
|
|
28
|
68 Specify name of debug log file. Defaults to "readpst.log". The
|
|
|
69 log file is not an ascii file, it is a binary file readable
|
|
|
70 by <command>readpstlog</command>.
|
|
16
|
71 </para></listitem>
|
|
|
72 </varlistentry>
|
|
|
73 <varlistentry>
|
|
|
74 <term>-h</term>
|
|
|
75 <listitem><para>
|
|
24
|
76 Show summary of options. Subsequent options are then ignored.
|
|
16
|
77 </para></listitem>
|
|
|
78 </varlistentry>
|
|
|
79 <varlistentry>
|
|
|
80 <term>-k</term>
|
|
|
81 <listitem><para>
|
|
|
82 Changes the output format to KMail.
|
|
|
83 </para></listitem>
|
|
|
84 </varlistentry>
|
|
|
85 <varlistentry>
|
|
20
|
86 <term>-o <replaceable class="parameter">output-directory</replaceable></term>
|
|
16
|
87 <listitem><para>
|
|
|
88 Specifies the output directory. The directory must already exist, and
|
|
|
89 is entered after the PST file is opened, but before any processing of
|
|
|
90 files commences.
|
|
|
91 </para></listitem>
|
|
|
92 </varlistentry>
|
|
|
93 <varlistentry>
|
|
|
94 <term>-q</term>
|
|
|
95 <listitem><para>
|
|
|
96 Changes to silent mode. No feedback is printed to the screen, except
|
|
|
97 for error messages.
|
|
|
98 </para></listitem>
|
|
|
99 </varlistentry>
|
|
|
100 <varlistentry>
|
|
|
101 <term>-r</term>
|
|
|
102 <listitem><para>
|
|
|
103 Changes the output format to Recursive. This will create folders as
|
|
21
|
104 named in the PST file, and will put all emails in a file called "mbox"
|
|
16
|
105 inside each folder. These files are then compatible with all
|
|
|
106 mbox-compatible email clients.
|
|
|
107 </para></listitem>
|
|
|
108 </varlistentry>
|
|
|
109 <varlistentry>
|
|
|
110 <term>-S</term>
|
|
|
111 <listitem><para>
|
|
25
|
112 Output messages into separate files. This will create folders as named
|
|
|
113 in the PST file, and will put each email in its own file. These files
|
|
28
|
114 will be numbered from 1 increasing in intervals of 1 (ie 1, 2, 3, ...).
|
|
|
115 Any attachments are saved alongside each email as XXXXXXXXX-attach1,
|
|
|
116 XXXXXXXXX-attach2 and so on, or with the name of the attachment if one
|
|
|
117 is present.
|
|
16
|
118 </para></listitem>
|
|
|
119 </varlistentry>
|
|
|
120 <varlistentry>
|
|
25
|
121 <term>-M</term>
|
|
|
122 <listitem><para>
|
|
|
123 Output messages in MH format as separate files. This will create
|
|
28
|
124 folders as named in the PST file, and will put each email together with
|
|
|
125 any attachments into its own file. These files will be numbered from 1
|
|
|
126 to n with no leading zeros.
|
|
25
|
127 </para></listitem>
|
|
|
128 </varlistentry>
|
|
|
129 <varlistentry>
|
|
16
|
130 <term>-V</term>
|
|
|
131 <listitem><para>
|
|
24
|
132 Show program version. Subsequent options are then ignored.
|
|
16
|
133 </para></listitem>
|
|
|
134 </varlistentry>
|
|
|
135 <varlistentry>
|
|
|
136 <term>-w</term>
|
|
|
137 <listitem><para>
|
|
20
|
138 Overwrite any previous output files. Beware: When used with the -S
|
|
16
|
139 switch, this will remove all files from the target folder before
|
|
|
140 writing. This is to keep the count of emails and attachments correct.
|
|
|
141 </para></listitem>
|
|
|
142 </varlistentry>
|
|
|
143 </variablelist>
|
|
|
144 </refsect1>
|
|
|
145
|
|
20
|
146 <refsect1 id='readpst.also.1'>
|
|
16
|
147 <title>See Also</title>
|
|
|
148 <para>
|
|
25
|
149 <citerefentry><refentrytitle>readpstlog</refentrytitle> <manvolnum>1</manvolnum> </citerefentry>
|
|
16
|
150 </para>
|
|
|
151 </refsect1>
|
|
|
152
|
|
20
|
153 <refsect1 id='readpst.author.1'>
|
|
16
|
154 <title>Author</title>
|
|
|
155 <para>
|
|
|
156 This manual page was originally written by Dave Smith
|
|
|
157 <dave.s@earthcorp.com>, and updated by Joe Nahmias <joe@nahmias.net>
|
|
|
158 for the Debian GNU/Linux system (but may be used by others). It was
|
|
20
|
159 subsequently updated by Brad Hards <bradh@frogmouth.net>, and converted to
|
|
16
|
160 xml format by Carl Byington <carl@five-ten-sg.com>.
|
|
|
161 </para>
|
|
|
162 </refsect1>
|
|
|
163
|
|
20
|
164 <refsect1 id='readpst.copyright.1'>
|
|
16
|
165 <title>Copyright</title>
|
|
|
166 <para>
|
|
|
167 Copyright (C) 2002 by David Smith <dave.s@earthcorp.com>.
|
|
28
|
168 XML version Copyright (C) 2006 by 510 Software Group <carl@five-ten-sg.com>.
|
|
16
|
169 </para>
|
|
|
170 <para>
|
|
|
171 This program is free software; you can redistribute it and/or modify it
|
|
|
172 under the terms of the GNU General Public License as published by the
|
|
|
173 Free Software Foundation; either version 2, or (at your option) any
|
|
|
174 later version.
|
|
|
175 </para>
|
|
|
176 <para>
|
|
|
177 You should have received a copy of the GNU General Public License along
|
|
|
178 with this program; see the file COPYING. If not, please write to the
|
|
|
179 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
|
180 </para>
|
|
|
181 </refsect1>
|
|
|
182
|
|
20
|
183 <refsect1 id='readpst.version.1'>
|
|
16
|
184 <title>CVS Version</title>
|
|
|
185 <para>
|
|
|
186 $Id$
|
|
|
187 </para>
|
|
|
188 </refsect1>
|
|
|
189 </refentry>
|
|
|
190
|
|
|
191
|
|
|
192 <refentry id="readpstlog.1">
|
|
|
193 <refentryinfo>
|
|
24
|
194 <date>2006-02-20</date>
|
|
16
|
195 </refentryinfo>
|
|
|
196
|
|
|
197 <refmeta>
|
|
|
198 <refentrytitle>readpstlog</refentrytitle>
|
|
|
199 <manvolnum>1</manvolnum>
|
|
|
200 <refmiscinfo>readpstlog @VERSION@</refmiscinfo>
|
|
|
201 </refmeta>
|
|
|
202
|
|
20
|
203 <refnamediv id='readpstlog.name.1'>
|
|
16
|
204 <refname>readpstlog</refname>
|
|
24
|
205 <refpurpose>convert a <command>readpst</command> logfile to text format</refpurpose>
|
|
16
|
206 </refnamediv>
|
|
|
207
|
|
20
|
208 <refsynopsisdiv id='readpstlog.synopsis.1'>
|
|
16
|
209 <title>Synopsis</title>
|
|
|
210 <cmdsynopsis>
|
|
24
|
211 <command>readpstlog</command>
|
|
16
|
212 <arg><option>-f <replaceable class="parameter">format</replaceable></option></arg>
|
|
|
213 <arg><option>-t <replaceable class="parameter">include-types</replaceable></option></arg>
|
|
|
214 <arg><option>-x <replaceable class="parameter">exclude-types</replaceable></option></arg>
|
|
24
|
215 <arg choice='plain'>logfile</arg>
|
|
16
|
216 </cmdsynopsis>
|
|
|
217 </refsynopsisdiv>
|
|
|
218
|
|
20
|
219 <refsect1 id='readpstlog.description.1'>
|
|
|
220 <title>Description</title>
|
|
21
|
221 <para><command>readpstlog</command>
|
|
24
|
222 is a program that converts the binary logfile generated
|
|
|
223 by <command>readpst</command> to a more desirable text format.
|
|
20
|
224 </para>
|
|
|
225 </refsect1>
|
|
|
226
|
|
|
227 <refsect1 id='readpstlog.options.1'>
|
|
16
|
228 <title>Options</title>
|
|
|
229 <variablelist>
|
|
|
230 <varlistentry>
|
|
|
231 <term>-f <replaceable class="parameter">format</replaceable></term>
|
|
|
232 <listitem><para>
|
|
|
233 Sets the format of the text log output. Currently, the only valid output
|
|
|
234 format is T, for text; anything else gives the default.
|
|
|
235 </para></listitem>
|
|
|
236 </varlistentry>
|
|
|
237 <varlistentry>
|
|
|
238 <term>-t <replaceable class="parameter">include-types</replaceable></term>
|
|
|
239 <listitem><para>
|
|
|
240 Print only the specified types of log messages.
|
|
|
241 Types are specified in a comma-delimited list (e.g. 3,10,5,6).
|
|
|
242 </para></listitem>
|
|
|
243 </varlistentry>
|
|
|
244 <varlistentry>
|
|
|
245 <term>-x <replaceable class="parameter">exclude-types</replaceable></term>
|
|
|
246 <listitem><para>
|
|
|
247 Exclude the specified types of log messages.
|
|
|
248 Types are specified in a comma-delimited list (e.g. 3,10,5,6).
|
|
|
249 </para></listitem>
|
|
|
250 </varlistentry>
|
|
|
251 </variablelist>
|
|
|
252 </refsect1>
|
|
|
253
|
|
20
|
254 <refsect1 id='readpstlog.message.types.1'>
|
|
16
|
255 <title>Message Types</title>
|
|
24
|
256 <para><command>readpstlog</command> understands the following types of log
|
|
|
257 messages:
|
|
16
|
258 </para>
|
|
|
259 <variablelist>
|
|
20
|
260 <varlistentry>
|
|
|
261 <term>1</term>
|
|
|
262 <listitem><para>
|
|
|
263 File accesses
|
|
|
264 </para></listitem>
|
|
|
265 </varlistentry>
|
|
|
266 <varlistentry>
|
|
|
267 <term>2</term>
|
|
|
268 <listitem><para>
|
|
|
269 Index accesses
|
|
|
270 </para></listitem>
|
|
|
271 </varlistentry>
|
|
|
272 <varlistentry>
|
|
|
273 <term>3</term>
|
|
|
274 <listitem><para>
|
|
|
275 New email found
|
|
|
276 </para></listitem>
|
|
|
277 </varlistentry>
|
|
|
278 <varlistentry>
|
|
|
279 <term>4</term>
|
|
|
280 <listitem><para>
|
|
|
281 Warnings
|
|
|
282 </para></listitem>
|
|
|
283 </varlistentry>
|
|
|
284 <varlistentry>
|
|
|
285 <term>5</term>
|
|
|
286 <listitem><para>
|
|
|
287 Read accesses
|
|
|
288 </para></listitem>
|
|
|
289 </varlistentry>
|
|
|
290 <varlistentry>
|
|
|
291 <term>6</term>
|
|
|
292 <listitem><para>
|
|
|
293 Informational messages
|
|
|
294 </para></listitem>
|
|
|
295 </varlistentry>
|
|
|
296 <varlistentry>
|
|
|
297 <term>7</term>
|
|
|
298 <listitem><para>
|
|
|
299 Main function calls
|
|
|
300 </para></listitem>
|
|
|
301 </varlistentry>
|
|
|
302 <varlistentry>
|
|
|
303 <term>8</term>
|
|
|
304 <listitem><para>
|
|
|
305 Decrypting calls
|
|
|
306 </para></listitem>
|
|
|
307 </varlistentry>
|
|
|
308 <varlistentry>
|
|
|
309 <term>10</term>
|
|
|
310 <listitem><para>
|
|
|
311 Function calls
|
|
|
312 </para></listitem>
|
|
|
313 </varlistentry>
|
|
|
314 <varlistentry>
|
|
|
315 <term>11</term>
|
|
|
316 <listitem><para>
|
|
|
317 HexDump calls
|
|
|
318 </para></listitem>
|
|
|
319 </varlistentry>
|
|
16
|
320 </variablelist>
|
|
|
321 </refsect1>
|
|
|
322
|
|
20
|
323 <refsect1 id='readpstlog.author.1'>
|
|
16
|
324 <title>Author</title>
|
|
|
325 <para>
|
|
|
326 This manual page was written by Joe Nahmias <joe@nahmias.net>
|
|
|
327 for the Debian GNU/Linux system (but may be used by others). It was
|
|
|
328 converted to xml format by Carl Byington <carl@five-ten-sg.com>.
|
|
|
329 </para>
|
|
|
330 </refsect1>
|
|
|
331
|
|
20
|
332 <refsect1 id='readpstlog.copyright.1'>
|
|
16
|
333 <title>Copyright</title>
|
|
|
334 <para>
|
|
|
335 Copyright (C) 2002 by David Smith <dave.s@earthcorp.com>.
|
|
|
336 XML version Copyright (C) 2005 by 510 Software Group <carl@five-ten-sg.com>.
|
|
|
337 </para>
|
|
|
338 <para>
|
|
|
339 This program is free software; you can redistribute it and/or modify it
|
|
|
340 under the terms of the GNU General Public License as published by the
|
|
|
341 Free Software Foundation; either version 2, or (at your option) any
|
|
|
342 later version.
|
|
|
343 </para>
|
|
|
344 <para>
|
|
|
345 You should have received a copy of the GNU General Public License along
|
|
|
346 with this program; see the file COPYING. If not, please write to the
|
|
|
347 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
|
348 </para>
|
|
|
349 </refsect1>
|
|
|
350
|
|
20
|
351 <refsect1 id='readpstlog.version.1'>
|
|
16
|
352 <title>CVS Version</title>
|
|
|
353 <para>
|
|
|
354 $Id$
|
|
|
355 </para>
|
|
|
356 </refsect1>
|
|
|
357 </refentry>
|
|
24
|
358
|
|
|
359
|
|
|
360 <refentry id="pst2ldif.1">
|
|
|
361 <refentryinfo>
|
|
|
362 <date>2006-02-20</date>
|
|
|
363 </refentryinfo>
|
|
|
364
|
|
|
365 <refmeta>
|
|
|
366 <refentrytitle>pst2ldif</refentrytitle>
|
|
|
367 <manvolnum>1</manvolnum>
|
|
|
368 <refmiscinfo>pst2ldif @VERSION@</refmiscinfo>
|
|
|
369 </refmeta>
|
|
|
370
|
|
|
371 <refnamediv id='pst2ldif.name.1'>
|
|
|
372 <refname>pst2ldif</refname>
|
|
|
373 <refpurpose>extract contacts from a MS Outlook .pst file in .ldif format</refpurpose>
|
|
|
374 </refnamediv>
|
|
|
375
|
|
|
376 <refsynopsisdiv id='pst2ldif.synopsis.1'>
|
|
|
377 <title>Synopsis</title>
|
|
|
378 <cmdsynopsis>
|
|
|
379 <command>pst2ldif</command>
|
|
|
380 <arg><option>-h</option></arg>
|
|
|
381 <arg><option>-V</option></arg>
|
|
|
382 <arg><option>-b <replaceable class="parameter">ldap-base</replaceable></option></arg>
|
|
|
383 <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
|
|
|
384 <arg choice='plain'>pstfilename</arg>
|
|
|
385 </cmdsynopsis>
|
|
|
386 </refsynopsisdiv>
|
|
|
387
|
|
|
388 <refsect1 id='pst2ldif.options.1'>
|
|
|
389 <title>Options</title>
|
|
|
390 <variablelist>
|
|
|
391 <varlistentry>
|
|
|
392 <term>-h</term>
|
|
|
393 <listitem><para>
|
|
|
394 Show summary of options. Subsequent options are then ignored.
|
|
|
395 </para></listitem>
|
|
|
396 </varlistentry>
|
|
|
397 <varlistentry>
|
|
|
398 <term>-V <replaceable class="parameter">include-types</replaceable></term>
|
|
|
399 <listitem><para>
|
|
|
400 Show program version. Subsequent options are then ignored.
|
|
|
401 </para></listitem>
|
|
|
402 </varlistentry>
|
|
|
403 <varlistentry>
|
|
|
404 <term>-b <replaceable class="parameter">ldap-base</replaceable></term>
|
|
|
405 <listitem><para>
|
|
|
406 Sets the ldap base value used in the dn records. You probably want to
|
|
|
407 use something like "o=organization, c=US".
|
|
|
408 </para></listitem>
|
|
|
409 </varlistentry>
|
|
|
410 <varlistentry>
|
|
|
411 <term>-c <replaceable class="parameter">class</replaceable></term>
|
|
|
412 <listitem><para>
|
|
|
413 Sets the objectClass values for the contact items. This class needs to be
|
|
|
414 defined in the schema used by your LDAP server, and at a minimum it must
|
|
|
415 contain the ldap attributes given below.
|
|
|
416 </para></listitem>
|
|
|
417 </varlistentry>
|
|
|
418 </variablelist>
|
|
|
419 </refsect1>
|
|
|
420
|
|
|
421 <refsect1 id='pst2ldif.description.1'>
|
|
|
422 <title>Description</title>
|
|
|
423 <para><command>pst2ldif</command>
|
|
|
424 reads the contact information from a MS Outlook .pst file
|
|
|
425 and produces a .ldif file that may be used to import those contacts
|
|
|
426 into an LDAP database. The following ldap attributes are generated:
|
|
|
427 <simplelist>
|
|
|
428 <member>cn </member>
|
|
|
429 <member>givenName </member>
|
|
|
430 <member>sn </member>
|
|
|
431 <member>personalTitle </member>
|
|
|
432 <member>company </member>
|
|
|
433 <member>mail </member>
|
|
|
434 <member>postalAddress </member>
|
|
|
435 <member>l </member>
|
|
|
436 <member>st </member>
|
|
|
437 <member>postalCode </member>
|
|
|
438 <member>c </member>
|
|
|
439 <member>homePhone </member>
|
|
|
440 <member>telephoneNumber </member>
|
|
|
441 <member>facsimileTelephoneNumber </member>
|
|
|
442 <member>mobile </member>
|
|
|
443 <member>description </member>
|
|
|
444 </simplelist>
|
|
|
445 </para>
|
|
|
446 </refsect1>
|
|
|
447
|
|
|
448 <refsect1 id='pst2ldif.copyright.1'>
|
|
|
449 <title>Copyright</title>
|
|
|
450 <para>
|
|
|
451 Copyright (C) 2006 by 510 Software Group <carl@five-ten-sg.com>
|
|
|
452 </para>
|
|
|
453 <para>
|
|
|
454 This program is free software; you can redistribute it and/or modify it
|
|
|
455 under the terms of the GNU General Public License as published by the
|
|
|
456 Free Software Foundation; either version 2, or (at your option) any
|
|
|
457 later version.
|
|
|
458 </para>
|
|
|
459 <para>
|
|
|
460 You should have received a copy of the GNU General Public License along
|
|
|
461 with this program; see the file COPYING. If not, please write to the
|
|
|
462 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
|
463 </para>
|
|
|
464 </refsect1>
|
|
|
465
|
|
|
466 <refsect1 id='pst2ldif.version.1'>
|
|
|
467 <title>CVS Version</title>
|
|
|
468 <para>
|
|
|
469 $Id$
|
|
|
470 </para>
|
|
|
471 </refsect1>
|
|
|
472 </refentry>
|
|
|
473
|
|
|
474
|
|
|
475 <refentry id="pst.5">
|
|
|
476 <refentryinfo>
|
|
|
477 <date>2006-02-20</date>
|
|
|
478 </refentryinfo>
|
|
|
479
|
|
|
480 <refmeta>
|
|
|
481 <refentrytitle>outlook.pst</refentrytitle>
|
|
|
482 <manvolnum>5</manvolnum>
|
|
|
483 </refmeta>
|
|
|
484
|
|
|
485 <refnamediv id='pst.name.1'>
|
|
|
486 <refname>outlook.pst</refname>
|
|
|
487 <refpurpose>format of MS Outlook .pst file</refpurpose>
|
|
|
488 </refnamediv>
|
|
|
489
|
|
|
490 <refsynopsisdiv id='pst.synopsis.1'>
|
|
|
491 <title>Synopsis</title>
|
|
|
492 <cmdsynopsis>
|
|
|
493 <command>outlook.pst</command>
|
|
|
494 </cmdsynopsis>
|
|
|
495 </refsynopsisdiv>
|
|
|
496
|
|
|
497 <refsect1 id='pst.file.overview.5'>
|
|
|
498 <title>Overview</title>
|
|
|
499 <para>
|
|
|
500 Each item in a .pst file is identified by two id values ID1 and ID2.
|
|
|
501 There are two separate b-trees indexed by these ID1 and ID2 values.
|
|
|
502 </para>
|
|
|
503 </refsect1>
|
|
|
504
|
|
|
505 <refsect1 id='pst.file.header.5'>
|
|
|
506 <title>File Header</title>
|
|
|
507 <para>
|
|
|
508 The file header is located at offset 0 in the .pst file.
|
|
|
509 </para>
|
|
|
510 <literallayout class="monospaced"><![CDATA[
|
|
|
511 0000 21 42 44 4e 49 f8 64 d9 53 4d 0e 00 13 00 01 01
|
|
|
512 0010 00 00 00 00 00 00 00 00 50 d6 03 00 bd 1e 02 00
|
|
|
513 0020 08 4c 00 00 00 04 00 00 00 04 00 00 0f 04 00 00
|
|
|
514 0030 0d 40 00 00 99 0a 01 00 18 04 00 00 0d 40 00 00
|
|
|
515 0040 0d 40 00 00 11 80 00 00 02 04 00 00 0a 04 00 00
|
|
|
516 0050 00 04 00 00 00 04 00 00 0f 04 00 00 0f 04 00 00
|
|
|
517 0060 0f 04 00 00 0d 40 00 00 00 04 00 00 00 04 00 00
|
|
|
518 0070 04 40 00 00 00 04 00 00 00 04 00 00 00 04 00 00
|
|
|
519 0080 00 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00
|
|
|
520 0090 00 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00
|
|
|
521 00a0 0c 09 00 00 00 00 00 00 00 04 27 00 00 24 23 00
|
|
|
522 00b0 c0 09 0a 00 00 c8 00 00 bc 1e 02 00 00 7e 0c 00
|
|
|
523 00c0 b4 1e 02 00 00 54 00 00 01 00 00 00 23 55 44 d1
|
|
|
524 00d0 5a 4f ce 6b 80 ff ff ff 00 00 00 00 00 00 00 00
|
|
|
525 00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
526 00f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
527 0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
528 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
529 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
530 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
531 0140 00 00 00 00 00 00 00 00 00 00 00 00 3f ff ff ff
|
|
|
532 0150 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
533 0160 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
534 0170 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
535 0180 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
536 0190 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
537 01a0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
538 01b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
539 01c0 ff ff ff ff ff ff ff ff ff ff ff ff 80 01 00 00
|
|
|
540 01d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
541 01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
542 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
543
|
|
|
544 0000 signature [4 bytes] 0x4e444221 constant
|
|
28
|
545 000a indexType [1 byte] 0x0e constant
|
|
|
546 01cd encryptionType [1 byte] 0x01 constant
|
|
24
|
547 00a8 total file size [4 bytes] 0x270400 in this case
|
|
28
|
548 00c0 backPointer1 [4 bytes] 0x021eb4 in this case
|
|
|
549 00c4 offsetIndex1 [4 bytes] 0x005400 in this case
|
|
|
550 00b8 backPointer2 [4 bytes] 0x021ebc in this case
|
|
|
551 00bc offsetIndex2 [4 bytes] 0x0c7e00 in this case
|
|
24
|
552 ]]></literallayout>
|
|
|
553 <para>
|
|
|
554 We only support index type 0x0E and encryption type 0x01.
|
|
|
555 </para>
|
|
|
556 <para>
|
|
28
|
557 offsetIndex1 is the file offset of the root of the
|
|
24
|
558 index1 b-tree, which contains (ID1, offset, size, unknown) tuples
|
|
28
|
559 for each item in the file. backPointer1 is the value that should
|
|
24
|
560 appear in the parent pointer of that root node.
|
|
|
561 </para>
|
|
|
562 <para>
|
|
28
|
563 offsetIndex2 is the file offset of the root of the
|
|
24
|
564 index2 b-tree, which contains (ID2, DESC-ID1, LIST-ID1, PARENT-ID2)
|
|
28
|
565 tuples for each item in the file. backPointer2 is the value that should
|
|
24
|
566 appear in the parent pointer of that root node.
|
|
|
567 </para>
|
|
|
568 </refsect1>
|
|
|
569
|
|
|
570 <refsect1 id='pst.file.node1.5'>
|
|
|
571 <title>Index 1 Node</title>
|
|
|
572 <para>
|
|
|
573 The index1 b-tree nodes are 516 byte blocks with the following format.
|
|
|
574 </para>
|
|
|
575 <literallayout class="monospaced"><![CDATA[
|
|
|
576 0000 04 00 00 00 8a 1e 02 00 00 1c 0b 00
|
|
|
577 000c 58 27 03 00 b3 1e 02 00 00 52 00 00
|
|
|
578 0018 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
579 0024 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
580 0030 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
581 003c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
582 0048 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
583 0054 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
584 0060 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
585 006c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
586 0078 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
587 0084 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
588 0090 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
589 009c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
590 00a8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
591 00b4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
592 00c0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
593 00cc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
594 00d8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
595 00e4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
596 00f0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
597 00fc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
598 0108 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
599 0114 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
600 0120 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
601 012c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
602 0138 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
603 0144 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
604 0150 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
605 015c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
606 0168 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
607 0174 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
608 0180 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
609 018c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
610 0198 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
611 01a4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
612 01b0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
613 01bc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
614 01c8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
615 01d4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
616 01e0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
617 01ec 00 00 00 00 02 29 0c 02 80 80 b6 4a
|
|
|
618 01f8 b4 1e 02 00 27 9c cc 56 58 27 03 00
|
|
|
619
|
|
28
|
620 01f0 itemCount [1 byte] 0x02 in this case
|
|
|
621 01f1 maxItemCount [1 byte] 0x29 constant
|
|
|
622 01f3 nodeLevel [1 byte] 0x02 in this case
|
|
|
623 01f8 backPointer [4 bytes] 0x021eb4 in this case
|
|
24
|
624 ]]></literallayout>
|
|
|
625 <para>
|
|
28
|
626 The itemCount specifies the number of 12 byte records that
|
|
|
627 are active. The nodeLevel is non-zero for this style of nodes.
|
|
|
628 The leaf nodes have a different format. The backPointer must
|
|
|
629 match the backPointer from the triple that pointed to this node.
|
|
24
|
630 </para>
|
|
|
631 <para>
|
|
28
|
632 Each item in this node is a triple of (ID, backPointer, offset)
|
|
24
|
633 where the offset points to the next deeper node in the tree, the
|
|
28
|
634 backPointer value must match the backPointer in that deeper node,
|
|
24
|
635 and ID is the lowest ID value in the subtree.
|
|
|
636 </para>
|
|
|
637 </refsect1>
|
|
|
638
|
|
|
639 <refsect1 id='pst.file.leaf1.5'>
|
|
|
640 <title>Index 1 Leaf Node</title>
|
|
|
641 <para>
|
|
|
642 The index1 b-tree leaf nodes are 516 byte blocks with the following format.
|
|
|
643 </para>
|
|
|
644 <literallayout class="monospaced"><![CDATA[
|
|
|
645 0000 04 00 00 00 00 58 00 00 64 00 0f 00
|
|
|
646 000c 08 00 00 00 80 58 00 00 ac 00 06 00
|
|
|
647 0018 0c 00 00 00 40 59 00 00 ac 00 06 00
|
|
|
648 0024 10 00 00 00 00 5a 00 00 bc 00 03 00
|
|
|
649 0030 14 00 00 00 00 5b 00 00 a4 00 02 00
|
|
|
650 003c 18 00 00 00 c0 5b 00 00 64 00 02 00
|
|
|
651 0048 1c 00 00 00 40 5c 00 00 5c 00 02 00
|
|
|
652 0054 50 00 00 00 80 62 00 00 60 00 02 00
|
|
|
653 0060 74 00 00 00 00 77 00 00 5e 00 02 00
|
|
|
654 006c 7c 00 00 00 80 77 00 00 66 00 02 00
|
|
|
655 0078 84 00 00 00 00 76 00 00 ca 00 02 00
|
|
|
656 0084 88 00 00 00 00 63 00 00 52 00 02 00
|
|
|
657 0090 90 00 00 00 00 79 00 00 58 00 02 00
|
|
|
658 009c cc 00 00 00 c0 61 00 00 76 00 02 00
|
|
|
659 00a8 e0 00 00 00 00 61 00 00 74 00 02 00
|
|
|
660 00b4 f4 00 00 00 80 65 00 00 6e 00 02 00
|
|
|
661 00c0 8c 01 00 00 40 60 00 00 70 00 02 00
|
|
|
662 00cc ea 01 00 00 80 61 00 00 10 00 02 00
|
|
|
663 00d8 ec 01 00 00 40 8a 00 00 f3 01 02 00
|
|
|
664 00e4 f0 01 00 00 80 93 00 00 f4 1f 02 00
|
|
|
665 00f0 fa 01 00 00 c0 7f 00 00 10 00 02 00
|
|
|
666 00fc 00 02 00 00 00 89 00 00 34 01 02 00
|
|
|
667 0108 1c 02 00 00 40 ec 00 00 12 06 02 00
|
|
|
668 0114 22 02 00 00 00 84 00 00 10 00 02 00
|
|
|
669 0120 24 02 00 00 c0 ea 00 00 3c 01 02 00
|
|
|
670 012c 40 02 00 00 00 f4 00 00 0a 06 02 00
|
|
|
671 0138 46 02 00 00 40 8c 00 00 10 00 02 00
|
|
|
672 0144 48 02 00 00 80 f2 00 00 36 01 02 00
|
|
|
673 0150 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
|
674 015c 6a 02 00 00 80 63 00 00 10 00 02 00
|
|
|
675 0168 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
|
676 0174 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
|
677 0180 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
|
678 018c 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
|
679 0198 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
|
680 01a4 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
|
681 01b0 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
|
682 01bc 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
|
683 01c8 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
|
684 01d4 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
|
685 01e0 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
|
686 01ec 00 00 00 00 1f 29 0c 00 80 80 5b b3
|
|
|
687 01f8 5a 67 01 00 4f ae 70 a7 92 06 00 00
|
|
|
688
|
|
28
|
689 01f0 itemCount [1 byte] 0x1f in this case
|
|
|
690 01f1 maxItemCount [1 byte] 0x29 constant
|
|
|
691 01f3 nodeLevel [1 byte] 0x00 in this case
|
|
|
692 01f8 backPointer [4 bytes] 0x01675a in this case
|
|
24
|
693 ]]></literallayout>
|
|
|
694 <para>
|
|
28
|
695 The itemCount specifies the number of 12 byte records that
|
|
|
696 are active. The nodeLevel is zero for these leaf nodes.
|
|
|
697 The backPointer must match the backPointer from the triple
|
|
24
|
698 that pointed to this node.
|
|
|
699 </para>
|
|
|
700 <para>
|
|
|
701 Each item in this node is a tuple of (ID1, offset, size, unknown)
|
|
|
702 </para>
|
|
|
703 </refsect1>
|
|
|
704
|
|
|
705 <refsect1 id='pst.file.node2.5'>
|
|
|
706 <title>Index 2 Node</title>
|
|
|
707 <para>
|
|
|
708 The index2 b-tree nodes are 516 byte blocks with the following format.
|
|
|
709 </para>
|
|
|
710 <literallayout class="monospaced"><![CDATA[
|
|
|
711 0000 21 00 00 00 bb 1e 02 00 00 e2 0b 00
|
|
|
712 000c 64 78 20 00 8c 1e 02 00 00 dc 0b 00
|
|
|
713 0018 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
714 0024 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
715 0030 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
716 003c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
717 0048 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
718 0054 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
719 0060 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
720 006c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
721 0078 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
722 0084 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
723 0090 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
724 009c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
725 00a8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
726 00b4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
727 00c0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
728 00cc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
729 00d8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
730 00e4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
731 00f0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
732 00fc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
733 0108 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
734 0114 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
735 0120 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
736 012c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
737 0138 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
738 0144 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
739 0150 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
740 015c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
741 0168 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
742 0174 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
743 0180 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
744 018c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
745 0198 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
746 01a4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
747 01b0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
748 01bc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
749 01c8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
750 01d4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
751 01e0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
752 01ec 00 00 00 00 02 29 0c 02 81 81 b2 60
|
|
|
753 01f8 bc 1e 02 00 7e 70 dc e3 21 00 00 00
|
|
|
754
|
|
28
|
755 01f0 itemCount [1 byte] 0x02 in this case
|
|
|
756 01f1 maxItemCount [1 byte] 0x29 constant
|
|
|
757 01f3 nodeLevel [1 byte] 0x02 in this case
|
|
|
758 01f8 backPointer [4 bytes] 0x021ebc in this case
|
|
24
|
759 ]]></literallayout>
|
|
|
760 <para>
|
|
28
|
761 The itemCount specifies the number of 12 byte records that
|
|
|
762 are active. The nodeLevel is non-zero for this style of nodes.
|
|
|
763 The leaf nodes have a different format. The backPointer must
|
|
|
764 match the backPointer from the triple that pointed to this node.
|
|
24
|
765 </para>
|
|
|
766 <para>
|
|
28
|
767 Each item in this node is a triple of (ID2, backPointer, offset)
|
|
24
|
768 where the offset points to the next deeper node in the tree, the
|
|
28
|
769 backPointer value must match the backPointer in that deeper node,
|
|
24
|
770 and ID2 is the lowest ID2 value in the subtree.
|
|
|
771 </para>
|
|
|
772 </refsect1>
|
|
|
773
|
|
|
774 <refsect1 id='pst.file.leaf2.5'>
|
|
|
775 <title>Index 2 Leaf Node</title>
|
|
|
776 <para>
|
|
|
777 The index2 b-tree leaf nodes are 516 byte blocks with the following format.
|
|
|
778 </para>
|
|
|
779 <literallayout class="monospaced"><![CDATA[
|
|
|
780 0000 21 00 00 00 38 e6 00 00 00 00 00 00 00 00 00 00
|
|
|
781 0010 61 00 00 00 2c a8 02 00 36 a8 02 00 00 00 00 00
|
|
|
782 0020 22 01 00 00 20 a2 02 00 00 00 00 00 22 01 00 00
|
|
|
783 0030 2d 01 00 00 88 7b 03 00 00 00 00 00 00 00 00 00
|
|
|
784 0040 2e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00
|
|
|
785 0050 2f 01 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
|
|
|
786 0060 e1 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
787 0070 01 02 00 00 b4 e4 02 00 00 00 00 00 00 00 00 00
|
|
|
788 0080 61 02 00 00 a0 e4 02 00 00 00 00 00 00 00 00 00
|
|
|
789 0090 0d 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00
|
|
|
790 00A0 0e 06 00 00 08 00 00 00 00 00 00 00 00 00 00 00
|
|
|
791 00B0 0f 06 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
|
|
|
792 00C0 10 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00
|
|
|
793 00D0 2b 06 00 00 84 00 00 00 00 00 00 00 00 00 00 00
|
|
|
794 00E0 4c 06 00 00 1c 00 00 00 00 00 00 00 00 00 00 00
|
|
|
795 00F0 71 06 00 00 18 00 00 00 00 00 00 00 00 00 00 00
|
|
|
796 0100 92 06 00 00 14 00 00 00 00 00 00 00 00 00 00 00
|
|
|
797 0110 23 22 00 00 14 a0 02 00 00 00 00 00 22 01 00 00
|
|
|
798 0120 26 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
799 0130 27 22 00 00 1c a0 02 00 00 00 00 00 00 00 00 00
|
|
|
800 0140 22 80 00 00 50 00 00 00 00 00 00 00 22 01 00 00
|
|
|
801 0150 2d 80 00 00 f8 9f 02 00 00 00 00 00 00 00 00 00
|
|
|
802 0160 2e 80 00 00 08 00 00 00 00 00 00 00 00 00 00 00
|
|
|
803 0170 2f 80 00 00 34 e6 00 00 00 00 00 00 00 00 00 00
|
|
|
804 0180 42 80 00 00 3c 6d 02 00 00 00 00 00 22 80 00 00
|
|
|
805 0190 4d 80 00 00 04 00 00 00 00 00 00 00 00 00 00 00
|
|
|
806 01A0 4e 80 00 00 10 6d 02 00 00 00 00 00 00 00 00 00
|
|
|
807 01B0 4f 80 00 00 ec 23 00 00 00 00 00 00 00 00 00 00
|
|
|
808 01C0 62 80 00 00 38 78 02 00 00 00 00 00 22 01 00 00
|
|
|
809 01D0 6d 80 00 00 34 78 02 00 00 00 00 00 00 00 00 00
|
|
|
810 01E0 6e 80 00 00 08 00 00 00 00 00 00 00 00 00 00 00
|
|
|
811 01F0 10 1f 10 00 81 81 a0 9a ae 1e 02 00 89 44 6a 0f
|
|
|
812 0200 b8 b1 03 00
|
|
|
813
|
|
28
|
814 01f0 itemCount [1 byte] 0x10 in this case
|
|
|
815 01f1 maxItemCount [1 byte] 0x1f constant
|
|
|
816 01f3 nodeLevel [1 byte] 0x00 in this case
|
|
|
817 01f8 backPointer [4 bytes] 0x021eae in this case
|
|
24
|
818 ]]></literallayout>
|
|
|
819 <para>
|
|
28
|
820 The itemCount specifies the number of 16 byte records that
|
|
|
821 are active. The nodeLevel is zero for these leaf nodes.
|
|
|
822 The backPointer must match the backPointer from the triple
|
|
24
|
823 that pointed to this node.
|
|
|
824 </para>
|
|
|
825 <para>
|
|
|
826 Each item in this node is a tuple of (ID2, DESC-ID1, LIST-ID1, PARENT-ID2)
|
|
|
827 </para>
|
|
|
828 </refsect1>
|
|
|
829
|
|
|
830 <refsect1 id='pst.file.list.5'>
|
|
|
831 <title>Associated List Item</title>
|
|
|
832 <para>
|
|
|
833 Contains associations between id1 and id2 for the items controlled by the record.
|
|
|
834 In the above leaf node, we have a tuple of (0x61, 0x02a82c, 0x02a836, 0)
|
|
|
835 0x02a836 is the ID1 of the associated list, and we can lookup that ID1 value
|
|
|
836 in the index1 b-tree to find the (offset,size) of the data in the .pst file.
|
|
|
837 </para>
|
|
|
838 <literallayout class="monospaced"><![CDATA[
|
|
|
839 0000 02 00 01 00 9f 81 00 00 30 a8 02 00 00 00 00 00
|
|
|
840
|
|
|
841 0000 unknown [2 bytes] 0x0002 constant
|
|
|
842 0002 count [2 bytes] 0x0001 in this case
|
|
|
843 repeating
|
|
|
844 0004 id2 [4 bytes] 0x00819f in this case
|
|
|
845 0008 id [4 bytes] 0x02a830 in this case
|
|
|
846 000c unknown [4 bytes] 0 in this case
|
|
|
847 ]]></literallayout>
|
|
|
848 </refsect1>
|
|
|
849
|
|
|
850 <refsect1 id='pst.file.desc.5'>
|
|
28
|
851 <title>Associated Descriptor Item 0xbcec</title>
|
|
24
|
852 <para>
|
|
28
|
853 Contains information about the item, which may be email, contact, or
|
|
|
854 other outlook types. In the above leaf node, we have a tuple of (0x21,
|
|
|
855 0x00e638, 0, 0) 0x00e638 is the ID1 of the associated descriptor, and we
|
|
|
856 can lookup that ID1 value in the index1 b-tree to find the (offset,size)
|
|
|
857 of the data in the .pst file.
|
|
24
|
858 </para>
|
|
|
859 <literallayout class="monospaced"><![CDATA[
|
|
|
860 0000 3c 01 ec bc 20 00 00 00 00 00 00 00 b5 02 06 00
|
|
|
861 0010 40 00 00 00 f9 0f 02 01 60 00 00 00 01 30 1e 00
|
|
|
862 0020 80 00 00 00 04 30 1e 00 00 00 00 00 df 35 03 00
|
|
|
863 0030 ff 00 00 00 e0 35 02 01 a0 00 00 00 e2 35 02 01
|
|
|
864 0040 e0 00 00 00 e3 35 02 01 c0 00 00 00 e4 35 02 01
|
|
|
865 0050 00 01 00 00 e5 35 02 01 20 01 00 00 e6 35 02 01
|
|
|
866 0060 40 01 00 00 e7 35 02 01 60 01 00 00 1e 66 0b 00
|
|
|
867 0070 00 00 00 00 ff 67 03 00 00 00 00 00 d2 7f 17 d8
|
|
|
868 0080 64 8c d5 11 83 24 00 50 04 86 95 45 53 74 61 6e
|
|
|
869 0090 6c 65 79 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
|
|
|
870 00A0 24 00 50 04 86 95 45 22 80 00 00 00 00 00 00 d2
|
|
|
871 00B0 7f 17 d8 64 8c d5 11 83 24 00 50 04 86 95 45 42
|
|
|
872 00C0 80 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
|
|
|
873 00D0 24 00 50 04 86 95 45 a2 80 00 00 00 00 00 00 d2
|
|
|
874 00E0 7f 17 d8 64 8c d5 11 83 24 00 50 04 86 95 45 c2
|
|
|
875 00F0 80 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
|
|
|
876 0100 24 00 50 04 86 95 45 e2 80 00 00 00 00 00 00 d2
|
|
|
877 0110 7f 17 d8 64 8c d5 11 83 24 00 50 04 86 95 45 02
|
|
|
878 0120 81 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
|
|
|
879 0130 24 00 50 04 86 95 45 62 80 00 00 00 0b 00 00 00
|
|
|
880 0140 0c 00 14 00 7c 00 8c 00 93 00 ab 00 c3 00 db 00
|
|
|
881 0150 f3 00 0b 01 23 01 3b 01
|
|
|
882
|
|
28
|
883 0000 indexOffset [2 bytes] 0x013c in this case
|
|
24
|
884 0002 signature [2 bytes] 0xbcec constant
|
|
|
885 0004 offset [2 bytes] 0x0020 in this case
|
|
|
886 ]]></literallayout>
|
|
|
887 <para>
|
|
28
|
888 Note the signature of 0xbcec. There are other descriptor block
|
|
|
889 formats with other signatures.
|
|
|
890 Note the indexOffset of 0x013c - starting at that position in the
|
|
24
|
891 descriptor block, we have an array of two byte integers. The first
|
|
28
|
892 integer (0x000b) is a (count-1) of the number of overlapping pairs
|
|
24
|
893 following the count. The first pair is (0, 0xc), the next pair is (0xc, 0x14)
|
|
28
|
894 and the last (12th) pair is (0x123, 0x13b). These pairs are (start,end+1)
|
|
|
895 offsets of items in this block. So we have count+2 integers following
|
|
24
|
896 the count value.
|
|
|
897 </para>
|
|
|
898 <para>
|
|
|
899 Note the offset of 0x0020, which needs to be right shifted by 4 bits
|
|
|
900 to become 0x0002, which is then a byte offset to be added to the above
|
|
28
|
901 indexOffset plus two (to skip the count), so it points to the (0xc, 0x14)
|
|
24
|
902 pair. Finally, we have the offset and size of the "b5" block located at offset 0xc
|
|
|
903 with a size of 8 bytes in this descriptor block. The "b5" block has the
|
|
|
904 following format:
|
|
|
905 </para>
|
|
|
906 <literallayout class="monospaced"><![CDATA[
|
|
|
907 0000 signature [2 bytes] 0x02b5 constant
|
|
|
908 0002 unknown [2 bytes] 0x0006 in this case
|
|
|
909 0004 offset [4 bytes] 0x0040 in this case
|
|
|
910 ]]></literallayout>
|
|
|
911 <para>
|
|
|
912 Note the "b5" offset of 0x0040, which needs to be right shifted by 4 bits
|
|
|
913 to become 0x0004, which is then a byte offset to be added to the above
|
|
28
|
914 indexOffset plus two (to skip the count), so it points to the (0x14, 0x7c)
|
|
24
|
915 pair. We now have the offset 0x14 of the descriptor array, composed of 8 byte
|
|
|
916 entries. Each descriptor entry has the following format:
|
|
|
917 </para>
|
|
|
918 <literallayout class="monospaced"><![CDATA[
|
|
28
|
919 0000 itemType [2 bytes]
|
|
|
920 0002 referenceType [2 bytes]
|
|
24
|
921 0004 value [4 bytes]
|
|
|
922 ]]></literallayout>
|
|
|
923 <para>
|
|
|
924 For some reference types (2, 3, 0xb) the value is used directly. Otherwise,
|
|
|
925 the value is generally a non-zero offset, to be right shifted by 4 bits and used to fetch
|
|
|
926 a pair from the index table to find the offset and size of the item in this
|
|
|
927 descriptor block. However, if (value AND 0xf) == 0xf, then the value is an ID2 index.
|
|
|
928 </para>
|
|
|
929 <para>
|
|
|
930 The following reference types are known, but not all of these
|
|
|
931 are implemented in the code yet.
|
|
|
932 </para>
|
|
|
933 <literallayout class="monospaced"><![CDATA[
|
|
|
934 0x0002 - Signed 16bit value
|
|
|
935 0x0003 - Signed 32bit value
|
|
|
936 0x0004 - 4-byte floating point
|
|
|
937 0x0005 - Floating point double
|
|
|
938 0x0006 - Signed 64-bit int
|
|
|
939 0x0007 - Application Time
|
|
|
940 0x000A - 32-bit error value
|
|
|
941 0x000B - Boolean (non-zero = true)
|
|
|
942 0x000D - Embedded Object
|
|
|
943 0x0014 - 8-byte signed integer (64-bit)
|
|
|
944 0x001E - Null terminated String
|
|
|
945 0x001F - Unicode string
|
|
|
946 0x0040 - Systime - Filetime structure
|
|
|
947 0x0048 - OLE Guid
|
|
|
948 0x0102 - Binary data
|
|
|
949 0x1003 - Array of 32bit values
|
|
|
950 0x1014 - Array of 64bit values
|
|
|
951 0x101E - Array of Strings
|
|
|
952 0x1102 - Array of Binary data
|
|
|
953 ]]></literallayout>
|
|
|
954 <para>
|
|
|
955 The following item types are known, but not all of these
|
|
|
956 are implemented in the code yet.
|
|
|
957 Note: it appears that some types can have a IPOS value or a ID2 value
|
|
|
958 depending on the size of the field in question. It is safer to check
|
|
|
959 every field than for me to say what the "usually" contain. Absolute
|
|
|
960 values though, are generally going to be constant.
|
|
|
961 </para>
|
|
|
962 <literallayout class="monospaced"><![CDATA[
|
|
|
963 0002 AutoForward allowed
|
|
|
964 0003 Extended Attributes Table
|
|
|
965 0017 Importance Level
|
|
|
966 001a IPM Context. What type of message is this
|
|
|
967 0023 Global Delivery Report
|
|
|
968 0026 Priority
|
|
|
969 0029 Read Receipt
|
|
|
970 002b Reassignment Prohibited
|
|
|
971 002e Original Sensitivity
|
|
|
972 0036 Sensitivity
|
|
|
973 0037 Email Subject. The referenced item is of type "Subject Type"
|
|
|
974 0039 Date. This is likely to be the arrival date
|
|
|
975 003b Outlook Address of Sender
|
|
|
976 003f Outlook structure describing the recipient
|
|
|
977 0040 Name of the Outlook recipient structure
|
|
|
978 0041 Outlook structure describing the sender
|
|
|
979 0042 Name of the Outlook sender structure
|
|
|
980 0043 Another structure describing the recipient
|
|
|
981 0044 Name of the second recipient structure
|
|
|
982 004f Reply-To Outlook Structure
|
|
|
983 0050 Name of the Reply-To structure
|
|
|
984 0051 Outlook Name of recipient
|
|
|
985 0052 Second Outlook name of recipient
|
|
|
986 0057 My address in TO field
|
|
|
987 0058 My address in CC field
|
|
|
988 0059 Message addressed to me
|
|
|
989 0063 Response requested
|
|
|
990 0064 Sender's Address access method (SMTP, EX)
|
|
|
991 0065 Sender's Address
|
|
|
992 0070 Processed Subject (with Fwd:, Re, ... removed)
|
|
|
993 0071 Date. Another date
|
|
|
994 0075 Recipient Address Access Method (SMTP, EX)
|
|
|
995 0076 Recipient's Address
|
|
|
996 0077 Second Recipient Access Method (SMTP, EX)
|
|
|
997 0078 Second Recipient Address
|
|
|
998 007d Email Header. This is the header that was attached to the email
|
|
|
999 0c17 Reply Requested
|
|
|
1000 0c19 Second sender struct
|
|
|
1001 0c1a Name of second sender struct
|
|
|
1002 0c1d Second outlook name of sender
|
|
|
1003 0c1e Second sender access method (SMTP, EX)
|
|
|
1004 0c1f Second Sender Address
|
|
|
1005 0e01 Delete after submit
|
|
|
1006 0e03 CC Address?
|
|
|
1007 0e04 SentTo Address
|
|
|
1008 0e06 Date.
|
|
|
1009 0e07 Flag - contains IsSeen value
|
|
|
1010 0e08 Message Size
|
|
|
1011 0e0a Sentmail EntryID
|
|
|
1012 0e1f Compressed RTF in Sync
|
|
|
1013 0e20 Attachment Size
|
|
|
1014 0ff9 binary record header
|
|
|
1015 1000 Plain Text Email Body. Does not exist if the email doesn't have a plain text version
|
|
|
1016 1006 RTF Sync Body CRC
|
|
|
1017 1007 RTF Sync Body character count
|
|
|
1018 1008 RTF Sync body tag
|
|
|
1019 1009 RTF Compressed body
|
|
|
1020 1010 RTF whitespace prefix count
|
|
|
1021 1011 RTF whitespace tailing count
|
|
|
1022 1013 HTML Email Body. Does not exist if the email doesn't have a HTML version
|
|
|
1023 1035 Message ID
|
|
|
1024 1042 In-Reply-To or Parent's Message ID
|
|
|
1025 1046 Return Path
|
|
|
1026 3001 Folder Name? I have seen this value used for the contacts record aswell
|
|
|
1027 3002 Address Type
|
|
|
1028 3003 Contact Address
|
|
|
1029 3004 Comment
|
|
|
1030 3007 Date item creation
|
|
|
1031 3008 Date item modification
|
|
|
1032 300b binary record header
|
|
|
1033 35df Valid Folder Mask
|
|
|
1034 35e0 binary record found in first item. Contains the reference to "Top of Personal Folder" item
|
|
|
1035 35e3 binary record with a reference to "Deleted Items" item
|
|
|
1036 35e7 binary record with a refernece to "Search Root" item
|
|
|
1037 3602 the number of emails stored in a folder
|
|
|
1038 3603 the number of unread emails in a folder
|
|
|
1039 360a Has Subfolders
|
|
|
1040 3613 the folder content description
|
|
|
1041 3617 Associate Content count
|
|
|
1042 3701 Binary Data attachment
|
|
|
1043 3704 Attachment Filename
|
|
|
1044 3705 Attachement method
|
|
|
1045 3707 Attachment Filename long
|
|
|
1046 370b Attachment Position
|
|
|
1047 370e Attachment mime encoding
|
|
|
1048 3710 Attachment Mime Sequence
|
|
|
1049 3a00 Contact's Account name
|
|
|
1050 3a01 Contact Alternate Recipient
|
|
|
1051 3a02 Callback telephone number
|
|
|
1052 3a03 Message Conversion Prohibited
|
|
|
1053 3a05 Contacts Suffix
|
|
|
1054 3a06 Contacts First Name
|
|
|
1055 3a07 Contacts Government ID Number
|
|
|
1056 3a08 Business Telephone Number
|
|
|
1057 3a09 Home Telephone Number
|
|
|
1058 3a0a Contacts Initials
|
|
|
1059 3a0b Keyword
|
|
|
1060 3a0c Contact's Language
|
|
|
1061 3a0d Contact's Location
|
|
|
1062 3a0e Mail Permission
|
|
|
1063 3a0f MHS Common Name
|
|
|
1064 3a10 Organizational ID #
|
|
|
1065 3a11 Contacts Surname
|
|
|
1066 3a12 original entry id
|
|
|
1067 3a13 original display name
|
|
|
1068 3a14 original search key
|
|
|
1069 3a15 Default Postal Address
|
|
|
1070 3a16 Company Name
|
|
|
1071 3a17 Job Title
|
|
|
1072 3a18 Department Name
|
|
|
1073 3a19 Office Location
|
|
|
1074 3a1a Primary Telephone
|
|
|
1075 3a1b Business Phone Number 2
|
|
|
1076 3a1c Mobile Phone Number
|
|
|
1077 3a1d Radio Phone Number
|
|
|
1078 3a1e Car Phone Number
|
|
|
1079 3a1f Other Phone Number
|
|
|
1080 3a20 Transmittable Display Name
|
|
|
1081 3a21 Pager Phone Number
|
|
|
1082 3a22 user certificate
|
|
|
1083 3a23 Primary Fax Number
|
|
|
1084 3a24 Business Fax Number
|
|
|
1085 3a25 Home Fax Number
|
|
|
1086 3a26 Business Address Country
|
|
|
1087 3a27 Business Address City
|
|
|
1088 3a28 Business Address State
|
|
|
1089 3a29 Business Address Street
|
|
|
1090 3a2a Business Postal Code
|
|
|
1091 3a2b Business PO Box
|
|
|
1092 3a2c Telex Number
|
|
|
1093 3a2d ISDN Number
|
|
|
1094 3a2e Assistant Phone Number
|
|
|
1095 3a2f Home Phone 2
|
|
|
1096 3a30 Assistant's Name
|
|
|
1097 3a40 Can receive Rich Text
|
|
|
1098 3a41 Wedding Anniversary
|
|
|
1099 3a42 Birthday
|
|
|
1100 3a43 Hobbies
|
|
|
1101 3a44 Middle Name
|
|
|
1102 3a45 Display Name Prefix (Title)
|
|
|
1103 3a46 Profession
|
|
|
1104 3a47 Preferred By Name
|
|
|
1105 3a48 Spouse's Name
|
|
|
1106 3a49 Computer Network Name
|
|
|
1107 3a4a Customer ID
|
|
|
1108 3a4b TTY/TDD Phone
|
|
|
1109 3a4c Ftp Site
|
|
|
1110 3a4d Gender
|
|
|
1111 3a4e Manager's Name
|
|
|
1112 3a4f Nickname
|
|
|
1113 3a50 Personal Home Page
|
|
|
1114 3a51 Business Home Page
|
|
|
1115 3a57 Company Main Phone
|
|
|
1116 3a58 childrens names
|
|
|
1117 3a59 Home Address City
|
|
|
1118 3a5a Home Address Country
|
|
|
1119 3a5b Home Address Postal Code
|
|
|
1120 3a5c Home Address State or Province
|
|
|
1121 3a5d Home Address Street
|
|
|
1122 3a5e Home Address Post Office Box
|
|
|
1123 3a5f Other Address City
|
|
|
1124 3a60 Other Address Country
|
|
|
1125 3a61 Other Address Postal Code
|
|
|
1126 3a62 Other Address State
|
|
|
1127 3a63 Other Address Street
|
|
|
1128 3a64 Other Address Post Office box
|
|
|
1129 65e3 Entry ID
|
|
|
1130 67f2 Attachment ID2 value
|
|
|
1131 67ff Password checksum [0x67FF]
|
|
|
1132 6f02 Secure HTML Body
|
|
|
1133 6f04 Secure Text Body
|
|
|
1134 7c07 Top of folders RecID [0x7c07]
|
|
|
1135 8000 Contain extra bits of information that have been taken from the email's header. I call them extra lines
|
|
|
1136 8005 Contact Fullname
|
|
|
1137 801a Home Address
|
|
|
1138 801b Business Address
|
|
|
1139 801c Other Address
|
|
|
1140 8082 Email Address 1 Transport
|
|
|
1141 8083 Email Address 1 Address
|
|
|
1142 8084 Email Address 1 Description
|
|
|
1143 8085 Email Address 1 Record
|
|
|
1144 8092 Email Address 2 Transport
|
|
|
1145 8093 Email Address 2 Address
|
|
|
1146 8094 DEBUG_EMAIL (("Email Address 2 Description
|
|
|
1147 8095 Email Address 2 Record
|
|
|
1148 80a2 DEBUG_EMAIL (("Email Address 3 Transport
|
|
|
1149 80a3 Email Address 3 Address
|
|
|
1150 80a4 Email Address 3 Description
|
|
|
1151 80a5 Email Address 3 Record
|
|
|
1152 80d8 Internet Free/Busy
|
|
|
1153 8205 Appointment shows as
|
|
|
1154 8208 Appointment Location
|
|
|
1155 8214 Label for appointment
|
|
|
1156 8234 TimeZone of times
|
|
|
1157 8235 Appointment Start Time
|
|
|
1158 8236 Appointment End Time
|
|
|
1159 8516 Duplicate Time Start
|
|
|
1160 8517 Duplicate Time End
|
|
|
1161 8530 Followup String
|
|
|
1162 8534 Mileage
|
|
|
1163 8535 Billing Information
|
|
|
1164 8554 Outlook Version
|
|
|
1165 8560 Appointment Reminder Time
|
|
|
1166 8700 Journal Entry Type
|
|
|
1167 8706 Start Timestamp
|
|
|
1168 8708 End Timestamp
|
|
|
1169 8712 Journal Entry Type
|
|
|
1170 ]]></literallayout>
|
|
|
1171 </refsect1>
|
|
|
1172
|
|
28
|
1173 <refsect1 id='pst.file.desc2.5'>
|
|
|
1174 <title>Associated Descriptor Item 0x7cec</title>
|
|
|
1175 <para>
|
|
|
1176 This style of descriptor block is similar to the BCEC format.
|
|
|
1177 </para>
|
|
|
1178 <literallayout class="monospaced"><![CDATA[
|
|
|
1179 0000 7a 01 ec 7c 40 00 00 00 00 00 00 00 b5 04 02 00
|
|
|
1180 0010 60 00 00 00 7c 18 60 00 60 00 62 00 65 00 20 00
|
|
|
1181 0020 00 00 80 00 00 00 00 00 00 00 03 00 20 0e 0c 00
|
|
|
1182 0030 04 03 1e 00 01 30 2c 00 04 0b 1e 00 03 37 28 00
|
|
|
1183 0040 04 0a 1e 00 04 37 14 00 04 05 03 00 05 37 10 00
|
|
|
1184 0050 04 04 1e 00 07 37 24 00 04 09 1e 00 08 37 20 00
|
|
|
1185 0060 04 08 02 01 0a 37 18 00 04 06 03 00 0b 37 08 00
|
|
|
1186 0070 04 02 1e 00 0d 37 1c 00 04 07 1e 00 0e 37 40 00
|
|
|
1187 0080 04 10 02 01 0f 37 30 00 04 0c 1e 00 11 37 34 00
|
|
|
1188 0090 04 0d 1e 00 12 37 3c 00 04 0f 1e 00 13 37 38 00
|
|
|
1189 00A0 04 0e 03 00 f2 67 00 00 04 00 03 00 f3 67 04 00
|
|
|
1190 00B0 04 01 03 00 09 69 44 00 04 11 03 00 fa 7f 5c 00
|
|
|
1191 00C0 04 15 40 00 fb 7f 4c 00 08 13 40 00 fc 7f 54 00
|
|
|
1192 00D0 08 14 03 00 fd 7f 48 00 04 12 0b 00 fe 7f 60 00
|
|
|
1193 00E0 01 16 0b 00 ff 7f 61 00 01 17 45 82 00 00 00 00
|
|
|
1194 00F0 45 82 00 00 78 3c 00 00 ff ff ff ff 49 1e 00 00
|
|
|
1195 0100 06 00 00 00 00 00 00 00 a0 00 00 00 00 00 00 00
|
|
|
1196 0110 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00
|
|
|
1197 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
1198 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 40 dd a3
|
|
|
1199 0140 57 45 b3 0c 00 40 dd a3 57 45 b3 0c 02 00 00 00
|
|
|
1200 0150 00 00 fa 10 3e 2a 86 48 86 f7 14 03 0a 03 02 01
|
|
|
1201 0160 4a 2e 20 44 61 76 69 64 20 4b 61 72 61 6d 27 73
|
|
|
1202 0170 20 42 69 72 74 68 64 61 79 00 06 00 00 00 0c 00
|
|
|
1203 0180 14 00 ea 00 f0 00 55 01 60 01 79 01
|
|
|
1204
|
|
|
1205 0000 indexOffset [2 bytes] 0x017a in this case
|
|
|
1206 0002 signature [2 bytes] 0x7cec constant
|
|
|
1207 0004 offset [2 bytes] 0x0040 in this case
|
|
|
1208 ]]></literallayout>
|
|
|
1209 <para>
|
|
|
1210 Note the signature of 0x7cec. There are other descriptor block
|
|
|
1211 formats with other signatures.
|
|
|
1212 Note the indexOffset of 0x017a - starting at that position in the
|
|
|
1213 descriptor block, we have an array of two byte integers. The first
|
|
|
1214 integer (0x0006) is a (count-1) of the number of overlapping pairs
|
|
|
1215 following the count. The first pair is (0, 0xc), the next pair is (0xc, 0x14)
|
|
|
1216 and the last (7th) pair is (0x160, 0x179). These pairs are (start,end+1)
|
|
|
1217 offsets of items in this block. So we have count+2 integers following
|
|
|
1218 the count value.
|
|
|
1219 </para>
|
|
|
1220 <para>
|
|
|
1221 Note the offset of 0x0040, which needs to be right shifted by 4 bits
|
|
|
1222 to become 0x0004, which is then a byte offset to be added to the above
|
|
|
1223 indexOffset plus two (to skip the count), so it points to the (0x14, 0xea)
|
|
|
1224 pair. We have the offset and size of the "7c" block located at offset 0x14
|
|
|
1225 with a size of 214 bytes in this case. The "7c" block starts with
|
|
|
1226 a header with the following format:
|
|
|
1227 </para>
|
|
|
1228 <literallayout class="monospaced"><![CDATA[
|
|
|
1229 0000 signature [1 bytes] 0x7c constant
|
|
|
1230 0001 itemCount [1 bytes] 0x18 in this case
|
|
|
1231 0002 unknown [2 bytes] 0x0060 in this case
|
|
|
1232 0004 unknown [2 bytes] 0x0060 in this case
|
|
|
1233 0006 unknown [2 bytes] 0x0062 in this case
|
|
|
1234 0008 recordSize [2 bytes] 0x0065 in this case
|
|
|
1235 000a b5Offset [2 bytes] 0x0020 in this case
|
|
|
1236 000c unknown [2 bytes] 0x0000 in this case
|
|
|
1237 000e index2Offset [2 bytes] 0x0080 in this case
|
|
|
1238 0010 unknown [2 bytes] 0x0000 in this case
|
|
|
1239 0012 unknown [2 bytes] 0x0000 in this case
|
|
|
1240 0014 unknown [2 bytes] 0x0000 in this case
|
|
|
1241 ]]></literallayout>
|
|
|
1242 <para>
|
|
|
1243 Note the b5Offset of 0x0020, which needs to be right shifted by 4 bits
|
|
|
1244 to become 0x0002, which is then a byte offset to be added to the above
|
|
|
1245 indexOffset plus two (to skip the count), so it points to the (0xc,
|
|
|
1246 0x14) pair. Finally, we have the offset and size of the "b5" block
|
|
|
1247 located at offset 0xc with a size of 8 bytes in this descriptor block.
|
|
|
1248 The "b5" block has the following format:
|
|
|
1249 </para>
|
|
|
1250 <literallayout class="monospaced"><![CDATA[
|
|
|
1251 0000 signature [2 bytes] 0x04b5 constant
|
|
|
1252 0002 unknown [2 bytes] 0x0002 in this case
|
|
|
1253 0004 offset [4 bytes] 0x0060 in this case
|
|
|
1254 ]]></literallayout>
|
|
|
1255 <para>
|
|
|
1256 Note the "b5" offset of 0x0060, which needs to be right shifted by 4
|
|
|
1257 bits to become 0x0006, which is then a byte offset to be added to the
|
|
|
1258 above indexOffset plus two (to skip the count), so it points to the
|
|
|
1259 (0xea, 0xf0) pair. That gives us (0xf0 - 0xea)/6 = 1, so we have a
|
|
|
1260 recordCount of one. The actual data between 0xea and 0xf0 is unknown
|
|
|
1261 and unused here.
|
|
|
1262 </para>
|
|
|
1263 <para>
|
|
|
1264 Note the index2Offset above of 0x0080, which needs to be right shifted
|
|
|
1265 by 4 bits to become 0x0008, which is then a byte offset to be added to
|
|
|
1266 the above indexOffset plus two (to skip the count), so it points to the
|
|
|
1267 (0xf0, 0x155) pair. This is an array of tables of four byte integers.
|
|
|
1268 We will call these the IND2 tables. The size of each of these tables is
|
|
|
1269 specified by the recordSize field of the "7c" header. The number of
|
|
|
1270 these tables is the above recordCount value derived from the "b5" block.
|
|
|
1271 </para>
|
|
|
1272 <para>
|
|
|
1273 Now the remaining data in the "7c" block after the header starts at
|
|
|
1274 offset 0x2a. There should be itemCount 8 byte items here, with the
|
|
|
1275 following format:
|
|
|
1276 </para>
|
|
|
1277 <literallayout class="monospaced"><![CDATA[
|
|
|
1278 0000 referenceType [2 bytes]
|
|
|
1279 0002 itemType [2 bytes]
|
|
|
1280 0004 ind2Offset [2 bytes]
|
|
|
1281 0006 unknown [2 bytes]
|
|
|
1282 ]]></literallayout>
|
|
|
1283 <para>
|
|
|
1284 The ind2Offset is a byte offset into the current IND2 table of a four
|
|
|
1285 byte integer value. Once we fetch that, we have the same triple (item
|
|
|
1286 type, reference type, value) as we find in the 0xbcec style descriptor
|
|
|
1287 blocks. These 8 byte descriptors are processed recordCount times, each
|
|
|
1288 time using the next IND2 table. The item and reference types are as
|
|
|
1289 described above for the 0xbcec format descriptor block.
|
|
|
1290 </para>
|
|
|
1291 </refsect1>
|
|
|
1292
|
|
24
|
1293 </refentry>
|
|
16
|
1294 </reference>
|
