16
|
1 <reference>
|
|
2 <title>@PACKAGE@ Utilities - Version @VERSION@</title>
|
|
3 <partintro>
|
|
4 <title>Packages</title>
|
|
5 <para>The various source and binary packages are available at <ulink
|
|
6 url="http://www.five-ten-sg.com/@PACKAGE@/packages/">http://www.five-ten-sg.com/@PACKAGE@/packages/</ulink>
|
|
7 The most recent documentation is available at <ulink
|
|
8 url="http://www.five-ten-sg.com/@PACKAGE@/">http://www.five-ten-sg.com/@PACKAGE@/</ulink>
|
|
9 </para>
|
24
|
10 </partintro>
|
16
|
11
|
|
12
|
|
13 <refentry id="readpst.1">
|
|
14 <refentryinfo>
|
24
|
15 <date>2006-02-20</date>
|
16
|
16 </refentryinfo>
|
|
17
|
|
18 <refmeta>
|
|
19 <refentrytitle>readpst</refentrytitle>
|
|
20 <manvolnum>1</manvolnum>
|
|
21 <refmiscinfo>readpst @VERSION@</refmiscinfo>
|
|
22 </refmeta>
|
|
23
|
20
|
24 <refnamediv id='readpst.name.1'>
|
16
|
25 <refname>readpst</refname>
|
|
26 <refpurpose>convert PST (MS Outlook Personal Folders) files to mbox format</refpurpose>
|
|
27 </refnamediv>
|
|
28
|
20
|
29 <refsynopsisdiv id='readpst.synopsis.1'>
|
16
|
30 <title>Synopsis</title>
|
|
31 <cmdsynopsis>
|
|
32 <command>readpst</command>
|
|
33 <arg><option>-c <replaceable class="parameter">format</replaceable></option></arg>
|
|
34 <arg><option>-d <replaceable class="parameter">debug-file</replaceable></option></arg>
|
|
35 <arg><option>-h</option></arg>
|
|
36 <arg><option>-k</option></arg>
|
|
37 <arg><option>-o <replaceable class="parameter">output-directory</replaceable></option></arg>
|
|
38 <arg><option>-q</option></arg>
|
|
39 <arg><option>-r</option></arg>
|
|
40 <arg><option>-S</option></arg>
|
25
|
41 <arg><option>-M</option></arg>
|
16
|
42 <arg><option>-V</option></arg>
|
|
43 <arg><option>-w</option></arg>
|
24
|
44 <arg rep='repeat' choice='plain'>files</arg>
|
16
|
45 </cmdsynopsis>
|
|
46 </refsynopsisdiv>
|
|
47
|
20
|
48 <refsect1 id='readpst.description.1'>
|
|
49 <title>Description</title>
|
|
50 <para><command>readpst</command> is a program that can read an Outlook PST (Personal Folders) file
|
|
51 and convert it into an mbox file, a format suitable for KMail, a recursive mbox
|
|
52 structure, or separate emails.
|
|
53 </para>
|
|
54 </refsect1>
|
|
55
|
|
56 <refsect1 id='readpst.options.1'>
|
16
|
57 <title>Options</title>
|
|
58 <variablelist>
|
|
59 <varlistentry>
|
|
60 <term>-c <replaceable class="parameter">format</replaceable></term>
|
|
61 <listitem><para>
|
|
62 Set the Contact output mode. Use -cv for vcard format or -cl for an email list.
|
|
63 </para></listitem>
|
|
64 </varlistentry>
|
|
65 <varlistentry>
|
|
66 <term>-d <replaceable class="parameter">debug-file</replaceable></term>
|
|
67 <listitem><para>
|
21
|
68 Specify name of debug log file. Defaults to "readpst.log". The log
|
|
69 file is not an ascii file, it is a binary file readable by <command>readpstlog</command>.
|
16
|
70 </para></listitem>
|
|
71 </varlistentry>
|
|
72 <varlistentry>
|
|
73 <term>-h</term>
|
|
74 <listitem><para>
|
24
|
75 Show summary of options. Subsequent options are then ignored.
|
16
|
76 </para></listitem>
|
|
77 </varlistentry>
|
|
78 <varlistentry>
|
|
79 <term>-k</term>
|
|
80 <listitem><para>
|
|
81 Changes the output format to KMail.
|
|
82 </para></listitem>
|
|
83 </varlistentry>
|
|
84 <varlistentry>
|
20
|
85 <term>-o <replaceable class="parameter">output-directory</replaceable></term>
|
16
|
86 <listitem><para>
|
|
87 Specifies the output directory. The directory must already exist, and
|
|
88 is entered after the PST file is opened, but before any processing of
|
|
89 files commences.
|
|
90 </para></listitem>
|
|
91 </varlistentry>
|
|
92 <varlistentry>
|
|
93 <term>-q</term>
|
|
94 <listitem><para>
|
|
95 Changes to silent mode. No feedback is printed to the screen, except
|
|
96 for error messages.
|
|
97 </para></listitem>
|
|
98 </varlistentry>
|
|
99 <varlistentry>
|
|
100 <term>-r</term>
|
|
101 <listitem><para>
|
|
102 Changes the output format to Recursive. This will create folders as
|
21
|
103 named in the PST file, and will put all emails in a file called "mbox"
|
16
|
104 inside each folder. These files are then compatible with all
|
|
105 mbox-compatible email clients.
|
|
106 </para></listitem>
|
|
107 </varlistentry>
|
|
108 <varlistentry>
|
|
109 <term>-S</term>
|
|
110 <listitem><para>
|
25
|
111 Output messages into separate files. This will create folders as named
|
|
112 in the PST file, and will put each email in its own file. These files
|
|
113 will be numbered from 000000000 increasing in intervals of 1 (ie
|
|
114 000000000, 000000001, 0000000002). Any attachments are saved alongside
|
16
|
115 each email as 000000000-attach0, or with the name of the attachment if
|
|
116 one is present.
|
|
117 </para></listitem>
|
|
118 </varlistentry>
|
|
119 <varlistentry>
|
25
|
120 <term>-M</term>
|
|
121 <listitem><para>
|
|
122 Output messages in MH format as separate files. This will create
|
|
123 folders as named in the PST file, and will put each email in its own
|
|
124 file. These files will be numbered from 1 to n with no leading zeros.
|
|
125 Any attachments are saved alongside each email as 000000000-attach0, or
|
|
126 with the name of the attachment if one is present.
|
|
127 </para></listitem>
|
|
128 </varlistentry>
|
|
129 <varlistentry>
|
16
|
130 <term>-V</term>
|
|
131 <listitem><para>
|
24
|
132 Show program version. Subsequent options are then ignored.
|
16
|
133 </para></listitem>
|
|
134 </varlistentry>
|
|
135 <varlistentry>
|
|
136 <term>-w</term>
|
|
137 <listitem><para>
|
20
|
138 Overwrite any previous output files. Beware: When used with the -S
|
16
|
139 switch, this will remove all files from the target folder before
|
|
140 writing. This is to keep the count of emails and attachments correct.
|
|
141 </para></listitem>
|
|
142 </varlistentry>
|
|
143 </variablelist>
|
|
144 </refsect1>
|
|
145
|
20
|
146 <refsect1 id='readpst.also.1'>
|
16
|
147 <title>See Also</title>
|
|
148 <para>
|
25
|
149 <citerefentry><refentrytitle>readpstlog</refentrytitle> <manvolnum>1</manvolnum> </citerefentry>
|
16
|
150 </para>
|
|
151 </refsect1>
|
|
152
|
20
|
153 <refsect1 id='readpst.author.1'>
|
16
|
154 <title>Author</title>
|
|
155 <para>
|
|
156 This manual page was originally written by Dave Smith
|
|
157 <dave.s@earthcorp.com>, and updated by Joe Nahmias <joe@nahmias.net>
|
|
158 for the Debian GNU/Linux system (but may be used by others). It was
|
20
|
159 subsequently updated by Brad Hards <bradh@frogmouth.net>, and converted to
|
16
|
160 xml format by Carl Byington <carl@five-ten-sg.com>.
|
|
161 </para>
|
|
162 </refsect1>
|
|
163
|
20
|
164 <refsect1 id='readpst.copyright.1'>
|
16
|
165 <title>Copyright</title>
|
|
166 <para>
|
|
167 Copyright (C) 2002 by David Smith <dave.s@earthcorp.com>.
|
|
168 XML version Copyright (C) 2005 by 510 Software Group <carl@five-ten-sg.com>.
|
|
169 </para>
|
|
170 <para>
|
|
171 This program is free software; you can redistribute it and/or modify it
|
|
172 under the terms of the GNU General Public License as published by the
|
|
173 Free Software Foundation; either version 2, or (at your option) any
|
|
174 later version.
|
|
175 </para>
|
|
176 <para>
|
|
177 You should have received a copy of the GNU General Public License along
|
|
178 with this program; see the file COPYING. If not, please write to the
|
|
179 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
180 </para>
|
|
181 </refsect1>
|
|
182
|
20
|
183 <refsect1 id='readpst.version.1'>
|
16
|
184 <title>CVS Version</title>
|
|
185 <para>
|
|
186 $Id$
|
|
187 </para>
|
|
188 </refsect1>
|
|
189 </refentry>
|
|
190
|
|
191
|
|
192 <refentry id="readpstlog.1">
|
|
193 <refentryinfo>
|
24
|
194 <date>2006-02-20</date>
|
16
|
195 </refentryinfo>
|
|
196
|
|
197 <refmeta>
|
|
198 <refentrytitle>readpstlog</refentrytitle>
|
|
199 <manvolnum>1</manvolnum>
|
|
200 <refmiscinfo>readpstlog @VERSION@</refmiscinfo>
|
|
201 </refmeta>
|
|
202
|
20
|
203 <refnamediv id='readpstlog.name.1'>
|
16
|
204 <refname>readpstlog</refname>
|
24
|
205 <refpurpose>convert a <command>readpst</command> logfile to text format</refpurpose>
|
16
|
206 </refnamediv>
|
|
207
|
20
|
208 <refsynopsisdiv id='readpstlog.synopsis.1'>
|
16
|
209 <title>Synopsis</title>
|
|
210 <cmdsynopsis>
|
24
|
211 <command>readpstlog</command>
|
16
|
212 <arg><option>-f <replaceable class="parameter">format</replaceable></option></arg>
|
|
213 <arg><option>-t <replaceable class="parameter">include-types</replaceable></option></arg>
|
|
214 <arg><option>-x <replaceable class="parameter">exclude-types</replaceable></option></arg>
|
24
|
215 <arg choice='plain'>logfile</arg>
|
16
|
216 </cmdsynopsis>
|
|
217 </refsynopsisdiv>
|
|
218
|
20
|
219 <refsect1 id='readpstlog.description.1'>
|
|
220 <title>Description</title>
|
21
|
221 <para><command>readpstlog</command>
|
24
|
222 is a program that converts the binary logfile generated
|
|
223 by <command>readpst</command> to a more desirable text format.
|
20
|
224 </para>
|
|
225 </refsect1>
|
|
226
|
|
227 <refsect1 id='readpstlog.options.1'>
|
16
|
228 <title>Options</title>
|
|
229 <variablelist>
|
|
230 <varlistentry>
|
|
231 <term>-f <replaceable class="parameter">format</replaceable></term>
|
|
232 <listitem><para>
|
|
233 Sets the format of the text log output. Currently, the only valid output
|
|
234 format is T, for text; anything else gives the default.
|
|
235 </para></listitem>
|
|
236 </varlistentry>
|
|
237 <varlistentry>
|
|
238 <term>-t <replaceable class="parameter">include-types</replaceable></term>
|
|
239 <listitem><para>
|
|
240 Print only the specified types of log messages.
|
|
241 Types are specified in a comma-delimited list (e.g. 3,10,5,6).
|
|
242 </para></listitem>
|
|
243 </varlistentry>
|
|
244 <varlistentry>
|
|
245 <term>-x <replaceable class="parameter">exclude-types</replaceable></term>
|
|
246 <listitem><para>
|
|
247 Exclude the specified types of log messages.
|
|
248 Types are specified in a comma-delimited list (e.g. 3,10,5,6).
|
|
249 </para></listitem>
|
|
250 </varlistentry>
|
|
251 </variablelist>
|
|
252 </refsect1>
|
|
253
|
20
|
254 <refsect1 id='readpstlog.message.types.1'>
|
16
|
255 <title>Message Types</title>
|
24
|
256 <para><command>readpstlog</command> understands the following types of log
|
|
257 messages:
|
16
|
258 </para>
|
|
259 <variablelist>
|
20
|
260 <varlistentry>
|
|
261 <term>1</term>
|
|
262 <listitem><para>
|
|
263 File accesses
|
|
264 </para></listitem>
|
|
265 </varlistentry>
|
|
266 <varlistentry>
|
|
267 <term>2</term>
|
|
268 <listitem><para>
|
|
269 Index accesses
|
|
270 </para></listitem>
|
|
271 </varlistentry>
|
|
272 <varlistentry>
|
|
273 <term>3</term>
|
|
274 <listitem><para>
|
|
275 New email found
|
|
276 </para></listitem>
|
|
277 </varlistentry>
|
|
278 <varlistentry>
|
|
279 <term>4</term>
|
|
280 <listitem><para>
|
|
281 Warnings
|
|
282 </para></listitem>
|
|
283 </varlistentry>
|
|
284 <varlistentry>
|
|
285 <term>5</term>
|
|
286 <listitem><para>
|
|
287 Read accesses
|
|
288 </para></listitem>
|
|
289 </varlistentry>
|
|
290 <varlistentry>
|
|
291 <term>6</term>
|
|
292 <listitem><para>
|
|
293 Informational messages
|
|
294 </para></listitem>
|
|
295 </varlistentry>
|
|
296 <varlistentry>
|
|
297 <term>7</term>
|
|
298 <listitem><para>
|
|
299 Main function calls
|
|
300 </para></listitem>
|
|
301 </varlistentry>
|
|
302 <varlistentry>
|
|
303 <term>8</term>
|
|
304 <listitem><para>
|
|
305 Decrypting calls
|
|
306 </para></listitem>
|
|
307 </varlistentry>
|
|
308 <varlistentry>
|
|
309 <term>10</term>
|
|
310 <listitem><para>
|
|
311 Function calls
|
|
312 </para></listitem>
|
|
313 </varlistentry>
|
|
314 <varlistentry>
|
|
315 <term>11</term>
|
|
316 <listitem><para>
|
|
317 HexDump calls
|
|
318 </para></listitem>
|
|
319 </varlistentry>
|
16
|
320 </variablelist>
|
|
321 </refsect1>
|
|
322
|
20
|
323 <refsect1 id='readpstlog.author.1'>
|
16
|
324 <title>Author</title>
|
|
325 <para>
|
|
326 This manual page was written by Joe Nahmias <joe@nahmias.net>
|
|
327 for the Debian GNU/Linux system (but may be used by others). It was
|
|
328 converted to xml format by Carl Byington <carl@five-ten-sg.com>.
|
|
329 </para>
|
|
330 </refsect1>
|
|
331
|
20
|
332 <refsect1 id='readpstlog.copyright.1'>
|
16
|
333 <title>Copyright</title>
|
|
334 <para>
|
|
335 Copyright (C) 2002 by David Smith <dave.s@earthcorp.com>.
|
|
336 XML version Copyright (C) 2005 by 510 Software Group <carl@five-ten-sg.com>.
|
|
337 </para>
|
|
338 <para>
|
|
339 This program is free software; you can redistribute it and/or modify it
|
|
340 under the terms of the GNU General Public License as published by the
|
|
341 Free Software Foundation; either version 2, or (at your option) any
|
|
342 later version.
|
|
343 </para>
|
|
344 <para>
|
|
345 You should have received a copy of the GNU General Public License along
|
|
346 with this program; see the file COPYING. If not, please write to the
|
|
347 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
348 </para>
|
|
349 </refsect1>
|
|
350
|
20
|
351 <refsect1 id='readpstlog.version.1'>
|
16
|
352 <title>CVS Version</title>
|
|
353 <para>
|
|
354 $Id$
|
|
355 </para>
|
|
356 </refsect1>
|
|
357 </refentry>
|
24
|
358
|
|
359
|
|
360 <refentry id="pst2ldif.1">
|
|
361 <refentryinfo>
|
|
362 <date>2006-02-20</date>
|
|
363 </refentryinfo>
|
|
364
|
|
365 <refmeta>
|
|
366 <refentrytitle>pst2ldif</refentrytitle>
|
|
367 <manvolnum>1</manvolnum>
|
|
368 <refmiscinfo>pst2ldif @VERSION@</refmiscinfo>
|
|
369 </refmeta>
|
|
370
|
|
371 <refnamediv id='pst2ldif.name.1'>
|
|
372 <refname>pst2ldif</refname>
|
|
373 <refpurpose>extract contacts from a MS Outlook .pst file in .ldif format</refpurpose>
|
|
374 </refnamediv>
|
|
375
|
|
376 <refsynopsisdiv id='pst2ldif.synopsis.1'>
|
|
377 <title>Synopsis</title>
|
|
378 <cmdsynopsis>
|
|
379 <command>pst2ldif</command>
|
|
380 <arg><option>-h</option></arg>
|
|
381 <arg><option>-V</option></arg>
|
|
382 <arg><option>-b <replaceable class="parameter">ldap-base</replaceable></option></arg>
|
|
383 <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
|
|
384 <arg choice='plain'>pstfilename</arg>
|
|
385 </cmdsynopsis>
|
|
386 </refsynopsisdiv>
|
|
387
|
|
388 <refsect1 id='pst2ldif.options.1'>
|
|
389 <title>Options</title>
|
|
390 <variablelist>
|
|
391 <varlistentry>
|
|
392 <term>-h</term>
|
|
393 <listitem><para>
|
|
394 Show summary of options. Subsequent options are then ignored.
|
|
395 </para></listitem>
|
|
396 </varlistentry>
|
|
397 <varlistentry>
|
|
398 <term>-V <replaceable class="parameter">include-types</replaceable></term>
|
|
399 <listitem><para>
|
|
400 Show program version. Subsequent options are then ignored.
|
|
401 </para></listitem>
|
|
402 </varlistentry>
|
|
403 <varlistentry>
|
|
404 <term>-b <replaceable class="parameter">ldap-base</replaceable></term>
|
|
405 <listitem><para>
|
|
406 Sets the ldap base value used in the dn records. You probably want to
|
|
407 use something like "o=organization, c=US".
|
|
408 </para></listitem>
|
|
409 </varlistentry>
|
|
410 <varlistentry>
|
|
411 <term>-c <replaceable class="parameter">class</replaceable></term>
|
|
412 <listitem><para>
|
|
413 Sets the objectClass values for the contact items. This class needs to be
|
|
414 defined in the schema used by your LDAP server, and at a minimum it must
|
|
415 contain the ldap attributes given below.
|
|
416 </para></listitem>
|
|
417 </varlistentry>
|
|
418 </variablelist>
|
|
419 </refsect1>
|
|
420
|
|
421 <refsect1 id='pst2ldif.description.1'>
|
|
422 <title>Description</title>
|
|
423 <para><command>pst2ldif</command>
|
|
424 reads the contact information from a MS Outlook .pst file
|
|
425 and produces a .ldif file that may be used to import those contacts
|
|
426 into an LDAP database. The following ldap attributes are generated:
|
|
427 <simplelist>
|
|
428 <member>cn </member>
|
|
429 <member>givenName </member>
|
|
430 <member>sn </member>
|
|
431 <member>personalTitle </member>
|
|
432 <member>company </member>
|
|
433 <member>mail </member>
|
|
434 <member>postalAddress </member>
|
|
435 <member>l </member>
|
|
436 <member>st </member>
|
|
437 <member>postalCode </member>
|
|
438 <member>c </member>
|
|
439 <member>homePhone </member>
|
|
440 <member>telephoneNumber </member>
|
|
441 <member>facsimileTelephoneNumber </member>
|
|
442 <member>mobile </member>
|
|
443 <member>description </member>
|
|
444 </simplelist>
|
|
445 </para>
|
|
446 </refsect1>
|
|
447
|
|
448 <refsect1 id='pst2ldif.copyright.1'>
|
|
449 <title>Copyright</title>
|
|
450 <para>
|
|
451 Copyright (C) 2006 by 510 Software Group <carl@five-ten-sg.com>
|
|
452 </para>
|
|
453 <para>
|
|
454 This program is free software; you can redistribute it and/or modify it
|
|
455 under the terms of the GNU General Public License as published by the
|
|
456 Free Software Foundation; either version 2, or (at your option) any
|
|
457 later version.
|
|
458 </para>
|
|
459 <para>
|
|
460 You should have received a copy of the GNU General Public License along
|
|
461 with this program; see the file COPYING. If not, please write to the
|
|
462 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
463 </para>
|
|
464 </refsect1>
|
|
465
|
|
466 <refsect1 id='pst2ldif.version.1'>
|
|
467 <title>CVS Version</title>
|
|
468 <para>
|
|
469 $Id$
|
|
470 </para>
|
|
471 </refsect1>
|
|
472 </refentry>
|
|
473
|
|
474
|
|
475 <refentry id="pst.5">
|
|
476 <refentryinfo>
|
|
477 <date>2006-02-20</date>
|
|
478 </refentryinfo>
|
|
479
|
|
480 <refmeta>
|
|
481 <refentrytitle>outlook.pst</refentrytitle>
|
|
482 <manvolnum>5</manvolnum>
|
|
483 </refmeta>
|
|
484
|
|
485 <refnamediv id='pst.name.1'>
|
|
486 <refname>outlook.pst</refname>
|
|
487 <refpurpose>format of MS Outlook .pst file</refpurpose>
|
|
488 </refnamediv>
|
|
489
|
|
490 <refsynopsisdiv id='pst.synopsis.1'>
|
|
491 <title>Synopsis</title>
|
|
492 <cmdsynopsis>
|
|
493 <command>outlook.pst</command>
|
|
494 </cmdsynopsis>
|
|
495 </refsynopsisdiv>
|
|
496
|
|
497 <refsect1 id='pst.file.overview.5'>
|
|
498 <title>Overview</title>
|
|
499 <para>
|
|
500 Each item in a .pst file is identified by two id values ID1 and ID2.
|
|
501 There are two separate b-trees indexed by these ID1 and ID2 values.
|
|
502 </para>
|
|
503 </refsect1>
|
|
504
|
|
505 <refsect1 id='pst.file.header.5'>
|
|
506 <title>File Header</title>
|
|
507 <para>
|
|
508 The file header is located at offset 0 in the .pst file.
|
|
509 </para>
|
|
510 <literallayout class="monospaced"><![CDATA[
|
|
511 0000 21 42 44 4e 49 f8 64 d9 53 4d 0e 00 13 00 01 01
|
|
512 0010 00 00 00 00 00 00 00 00 50 d6 03 00 bd 1e 02 00
|
|
513 0020 08 4c 00 00 00 04 00 00 00 04 00 00 0f 04 00 00
|
|
514 0030 0d 40 00 00 99 0a 01 00 18 04 00 00 0d 40 00 00
|
|
515 0040 0d 40 00 00 11 80 00 00 02 04 00 00 0a 04 00 00
|
|
516 0050 00 04 00 00 00 04 00 00 0f 04 00 00 0f 04 00 00
|
|
517 0060 0f 04 00 00 0d 40 00 00 00 04 00 00 00 04 00 00
|
|
518 0070 04 40 00 00 00 04 00 00 00 04 00 00 00 04 00 00
|
|
519 0080 00 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00
|
|
520 0090 00 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00
|
|
521 00a0 0c 09 00 00 00 00 00 00 00 04 27 00 00 24 23 00
|
|
522 00b0 c0 09 0a 00 00 c8 00 00 bc 1e 02 00 00 7e 0c 00
|
|
523 00c0 b4 1e 02 00 00 54 00 00 01 00 00 00 23 55 44 d1
|
|
524 00d0 5a 4f ce 6b 80 ff ff ff 00 00 00 00 00 00 00 00
|
|
525 00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
526 00f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
527 0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
528 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
529 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
530 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
531 0140 00 00 00 00 00 00 00 00 00 00 00 00 3f ff ff ff
|
|
532 0150 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
533 0160 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
534 0170 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
535 0180 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
536 0190 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
537 01a0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
538 01b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
539 01c0 ff ff ff ff ff ff ff ff ff ff ff ff 80 01 00 00
|
|
540 01d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
541 01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
542 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
543
|
|
544 0000 signature [4 bytes] 0x4e444221 constant
|
|
545 000a index type [1 byte] 0x0e constant
|
|
546 01cd encryption type [1 byte] 0x01 constant
|
|
547 00a8 total file size [4 bytes] 0x270400 in this case
|
|
548 00c0 back-pointer-1 [4 bytes] 0x021eb4 in this case
|
|
549 00c4 offset-index-1 [4 bytes] 0x005400 in this case
|
|
550 00b8 back-pointer-2 [4 bytes] 0x021ebc in this case
|
|
551 00bc offset-index-2 [4 bytes] 0x0c7e00 in this case
|
|
552 ]]></literallayout>
|
|
553 <para>
|
|
554 We only support index type 0x0E and encryption type 0x01.
|
|
555 </para>
|
|
556 <para>
|
|
557 offset-index-1 is the file offset of the root of the
|
|
558 index1 b-tree, which contains (ID1, offset, size, unknown) tuples
|
|
559 for each item in the file. back-pointer-1 is the value that should
|
|
560 appear in the parent pointer of that root node.
|
|
561 </para>
|
|
562 <para>
|
|
563 offset-index-2 is the file offset of the root of the
|
|
564 index2 b-tree, which contains (ID2, DESC-ID1, LIST-ID1, PARENT-ID2)
|
|
565 tuples for each item in the file. back-pointer-2 is the value that should
|
|
566 appear in the parent pointer of that root node.
|
|
567 </para>
|
|
568 </refsect1>
|
|
569
|
|
570 <refsect1 id='pst.file.node1.5'>
|
|
571 <title>Index 1 Node</title>
|
|
572 <para>
|
|
573 The index1 b-tree nodes are 516 byte blocks with the following format.
|
|
574 </para>
|
|
575 <literallayout class="monospaced"><![CDATA[
|
|
576 0000 04 00 00 00 8a 1e 02 00 00 1c 0b 00
|
|
577 000c 58 27 03 00 b3 1e 02 00 00 52 00 00
|
|
578 0018 00 00 00 00 00 00 00 00 00 00 00 00
|
|
579 0024 00 00 00 00 00 00 00 00 00 00 00 00
|
|
580 0030 00 00 00 00 00 00 00 00 00 00 00 00
|
|
581 003c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
582 0048 00 00 00 00 00 00 00 00 00 00 00 00
|
|
583 0054 00 00 00 00 00 00 00 00 00 00 00 00
|
|
584 0060 00 00 00 00 00 00 00 00 00 00 00 00
|
|
585 006c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
586 0078 00 00 00 00 00 00 00 00 00 00 00 00
|
|
587 0084 00 00 00 00 00 00 00 00 00 00 00 00
|
|
588 0090 00 00 00 00 00 00 00 00 00 00 00 00
|
|
589 009c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
590 00a8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
591 00b4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
592 00c0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
593 00cc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
594 00d8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
595 00e4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
596 00f0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
597 00fc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
598 0108 00 00 00 00 00 00 00 00 00 00 00 00
|
|
599 0114 00 00 00 00 00 00 00 00 00 00 00 00
|
|
600 0120 00 00 00 00 00 00 00 00 00 00 00 00
|
|
601 012c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
602 0138 00 00 00 00 00 00 00 00 00 00 00 00
|
|
603 0144 00 00 00 00 00 00 00 00 00 00 00 00
|
|
604 0150 00 00 00 00 00 00 00 00 00 00 00 00
|
|
605 015c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
606 0168 00 00 00 00 00 00 00 00 00 00 00 00
|
|
607 0174 00 00 00 00 00 00 00 00 00 00 00 00
|
|
608 0180 00 00 00 00 00 00 00 00 00 00 00 00
|
|
609 018c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
610 0198 00 00 00 00 00 00 00 00 00 00 00 00
|
|
611 01a4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
612 01b0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
613 01bc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
614 01c8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
615 01d4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
616 01e0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
617 01ec 00 00 00 00 02 29 0c 02 80 80 b6 4a
|
|
618 01f8 b4 1e 02 00 27 9c cc 56 58 27 03 00
|
|
619
|
|
620 01f0 item-count [1 byte] 0x02 in this case
|
|
621 01f1 max-item-count [1 byte] 0x29 constant
|
|
622 01f3 node-level [1 byte] 0x02 in this case
|
|
623 01f8 back-pointer [4 bytes] 0x021eb4 in this case
|
|
624 ]]></literallayout>
|
|
625 <para>
|
|
626 The item-count specifies the number of 12 byte records that
|
|
627 are active. The node-level is non-zero for this style of nodes.
|
|
628 The leaf nodes have a different format. The back-pointer must
|
|
629 match the back-pointer from the triple that pointed to this node.
|
|
630 </para>
|
|
631 <para>
|
|
632 Each item in this node is a triple of (ID, back-pointer, offset)
|
|
633 where the offset points to the next deeper node in the tree, the
|
|
634 back-pointer value must match the back-pointer in that deeper node,
|
|
635 and ID is the lowest ID value in the subtree.
|
|
636 </para>
|
|
637 </refsect1>
|
|
638
|
|
639 <refsect1 id='pst.file.leaf1.5'>
|
|
640 <title>Index 1 Leaf Node</title>
|
|
641 <para>
|
|
642 The index1 b-tree leaf nodes are 516 byte blocks with the following format.
|
|
643 </para>
|
|
644 <literallayout class="monospaced"><![CDATA[
|
|
645 0000 04 00 00 00 00 58 00 00 64 00 0f 00
|
|
646 000c 08 00 00 00 80 58 00 00 ac 00 06 00
|
|
647 0018 0c 00 00 00 40 59 00 00 ac 00 06 00
|
|
648 0024 10 00 00 00 00 5a 00 00 bc 00 03 00
|
|
649 0030 14 00 00 00 00 5b 00 00 a4 00 02 00
|
|
650 003c 18 00 00 00 c0 5b 00 00 64 00 02 00
|
|
651 0048 1c 00 00 00 40 5c 00 00 5c 00 02 00
|
|
652 0054 50 00 00 00 80 62 00 00 60 00 02 00
|
|
653 0060 74 00 00 00 00 77 00 00 5e 00 02 00
|
|
654 006c 7c 00 00 00 80 77 00 00 66 00 02 00
|
|
655 0078 84 00 00 00 00 76 00 00 ca 00 02 00
|
|
656 0084 88 00 00 00 00 63 00 00 52 00 02 00
|
|
657 0090 90 00 00 00 00 79 00 00 58 00 02 00
|
|
658 009c cc 00 00 00 c0 61 00 00 76 00 02 00
|
|
659 00a8 e0 00 00 00 00 61 00 00 74 00 02 00
|
|
660 00b4 f4 00 00 00 80 65 00 00 6e 00 02 00
|
|
661 00c0 8c 01 00 00 40 60 00 00 70 00 02 00
|
|
662 00cc ea 01 00 00 80 61 00 00 10 00 02 00
|
|
663 00d8 ec 01 00 00 40 8a 00 00 f3 01 02 00
|
|
664 00e4 f0 01 00 00 80 93 00 00 f4 1f 02 00
|
|
665 00f0 fa 01 00 00 c0 7f 00 00 10 00 02 00
|
|
666 00fc 00 02 00 00 00 89 00 00 34 01 02 00
|
|
667 0108 1c 02 00 00 40 ec 00 00 12 06 02 00
|
|
668 0114 22 02 00 00 00 84 00 00 10 00 02 00
|
|
669 0120 24 02 00 00 c0 ea 00 00 3c 01 02 00
|
|
670 012c 40 02 00 00 00 f4 00 00 0a 06 02 00
|
|
671 0138 46 02 00 00 40 8c 00 00 10 00 02 00
|
|
672 0144 48 02 00 00 80 f2 00 00 36 01 02 00
|
|
673 0150 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
674 015c 6a 02 00 00 80 63 00 00 10 00 02 00
|
|
675 0168 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
676 0174 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
677 0180 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
678 018c 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
679 0198 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
680 01a4 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
681 01b0 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
682 01bc 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
683 01c8 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
684 01d4 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
685 01e0 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
686 01ec 00 00 00 00 1f 29 0c 00 80 80 5b b3
|
|
687 01f8 5a 67 01 00 4f ae 70 a7 92 06 00 00
|
|
688
|
|
689 01f0 item-count [1 byte] 0x1f in this case
|
|
690 01f1 max-item-count [1 byte] 0x29 constant
|
|
691 01f3 node-level [1 byte] 0x00 in this case
|
|
692 01f8 back-pointer [4 bytes] 0x01675a in this case
|
|
693 ]]></literallayout>
|
|
694 <para>
|
|
695 The item-count specifies the number of 12 byte records that
|
|
696 are active. The node-level is zero for these leaf nodes.
|
|
697 The back-pointer must match the back-pointer from the triple
|
|
698 that pointed to this node.
|
|
699 </para>
|
|
700 <para>
|
|
701 Each item in this node is a tuple of (ID1, offset, size, unknown)
|
|
702 </para>
|
|
703 </refsect1>
|
|
704
|
|
705 <refsect1 id='pst.file.node2.5'>
|
|
706 <title>Index 2 Node</title>
|
|
707 <para>
|
|
708 The index2 b-tree nodes are 516 byte blocks with the following format.
|
|
709 </para>
|
|
710 <literallayout class="monospaced"><![CDATA[
|
|
711 0000 21 00 00 00 bb 1e 02 00 00 e2 0b 00
|
|
712 000c 64 78 20 00 8c 1e 02 00 00 dc 0b 00
|
|
713 0018 00 00 00 00 00 00 00 00 00 00 00 00
|
|
714 0024 00 00 00 00 00 00 00 00 00 00 00 00
|
|
715 0030 00 00 00 00 00 00 00 00 00 00 00 00
|
|
716 003c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
717 0048 00 00 00 00 00 00 00 00 00 00 00 00
|
|
718 0054 00 00 00 00 00 00 00 00 00 00 00 00
|
|
719 0060 00 00 00 00 00 00 00 00 00 00 00 00
|
|
720 006c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
721 0078 00 00 00 00 00 00 00 00 00 00 00 00
|
|
722 0084 00 00 00 00 00 00 00 00 00 00 00 00
|
|
723 0090 00 00 00 00 00 00 00 00 00 00 00 00
|
|
724 009c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
725 00a8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
726 00b4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
727 00c0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
728 00cc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
729 00d8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
730 00e4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
731 00f0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
732 00fc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
733 0108 00 00 00 00 00 00 00 00 00 00 00 00
|
|
734 0114 00 00 00 00 00 00 00 00 00 00 00 00
|
|
735 0120 00 00 00 00 00 00 00 00 00 00 00 00
|
|
736 012c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
737 0138 00 00 00 00 00 00 00 00 00 00 00 00
|
|
738 0144 00 00 00 00 00 00 00 00 00 00 00 00
|
|
739 0150 00 00 00 00 00 00 00 00 00 00 00 00
|
|
740 015c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
741 0168 00 00 00 00 00 00 00 00 00 00 00 00
|
|
742 0174 00 00 00 00 00 00 00 00 00 00 00 00
|
|
743 0180 00 00 00 00 00 00 00 00 00 00 00 00
|
|
744 018c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
745 0198 00 00 00 00 00 00 00 00 00 00 00 00
|
|
746 01a4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
747 01b0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
748 01bc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
749 01c8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
750 01d4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
751 01e0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
752 01ec 00 00 00 00 02 29 0c 02 81 81 b2 60
|
|
753 01f8 bc 1e 02 00 7e 70 dc e3 21 00 00 00
|
|
754
|
|
755 01f0 item-count [1 byte] 0x02 in this case
|
|
756 01f1 max-item-count [1 byte] 0x29 constant
|
|
757 01f3 node-level [1 byte] 0x02 in this case
|
|
758 01f8 back-pointer [4 bytes] 0x021ebc in this case
|
|
759 ]]></literallayout>
|
|
760 <para>
|
|
761 The item-count specifies the number of 12 byte records that
|
|
762 are active. The node-level is non-zero for this style of nodes.
|
|
763 The leaf nodes have a different format. The back-pointer must
|
|
764 match the back-pointer from the triple that pointed to this node.
|
|
765 </para>
|
|
766 <para>
|
|
767 Each item in this node is a triple of (ID2, back-pointer, offset)
|
|
768 where the offset points to the next deeper node in the tree, the
|
|
769 back-pointer value must match the back-pointer in that deeper node,
|
|
770 and ID2 is the lowest ID2 value in the subtree.
|
|
771 </para>
|
|
772 </refsect1>
|
|
773
|
|
774 <refsect1 id='pst.file.leaf2.5'>
|
|
775 <title>Index 2 Leaf Node</title>
|
|
776 <para>
|
|
777 The index2 b-tree leaf nodes are 516 byte blocks with the following format.
|
|
778 </para>
|
|
779 <literallayout class="monospaced"><![CDATA[
|
|
780 0000 21 00 00 00 38 e6 00 00 00 00 00 00 00 00 00 00
|
|
781 0010 61 00 00 00 2c a8 02 00 36 a8 02 00 00 00 00 00
|
|
782 0020 22 01 00 00 20 a2 02 00 00 00 00 00 22 01 00 00
|
|
783 0030 2d 01 00 00 88 7b 03 00 00 00 00 00 00 00 00 00
|
|
784 0040 2e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00
|
|
785 0050 2f 01 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
|
|
786 0060 e1 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
787 0070 01 02 00 00 b4 e4 02 00 00 00 00 00 00 00 00 00
|
|
788 0080 61 02 00 00 a0 e4 02 00 00 00 00 00 00 00 00 00
|
|
789 0090 0d 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00
|
|
790 00A0 0e 06 00 00 08 00 00 00 00 00 00 00 00 00 00 00
|
|
791 00B0 0f 06 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
|
|
792 00C0 10 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00
|
|
793 00D0 2b 06 00 00 84 00 00 00 00 00 00 00 00 00 00 00
|
|
794 00E0 4c 06 00 00 1c 00 00 00 00 00 00 00 00 00 00 00
|
|
795 00F0 71 06 00 00 18 00 00 00 00 00 00 00 00 00 00 00
|
|
796 0100 92 06 00 00 14 00 00 00 00 00 00 00 00 00 00 00
|
|
797 0110 23 22 00 00 14 a0 02 00 00 00 00 00 22 01 00 00
|
|
798 0120 26 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
799 0130 27 22 00 00 1c a0 02 00 00 00 00 00 00 00 00 00
|
|
800 0140 22 80 00 00 50 00 00 00 00 00 00 00 22 01 00 00
|
|
801 0150 2d 80 00 00 f8 9f 02 00 00 00 00 00 00 00 00 00
|
|
802 0160 2e 80 00 00 08 00 00 00 00 00 00 00 00 00 00 00
|
|
803 0170 2f 80 00 00 34 e6 00 00 00 00 00 00 00 00 00 00
|
|
804 0180 42 80 00 00 3c 6d 02 00 00 00 00 00 22 80 00 00
|
|
805 0190 4d 80 00 00 04 00 00 00 00 00 00 00 00 00 00 00
|
|
806 01A0 4e 80 00 00 10 6d 02 00 00 00 00 00 00 00 00 00
|
|
807 01B0 4f 80 00 00 ec 23 00 00 00 00 00 00 00 00 00 00
|
|
808 01C0 62 80 00 00 38 78 02 00 00 00 00 00 22 01 00 00
|
|
809 01D0 6d 80 00 00 34 78 02 00 00 00 00 00 00 00 00 00
|
|
810 01E0 6e 80 00 00 08 00 00 00 00 00 00 00 00 00 00 00
|
|
811 01F0 10 1f 10 00 81 81 a0 9a ae 1e 02 00 89 44 6a 0f
|
|
812 0200 b8 b1 03 00
|
|
813
|
|
814 01f0 item-count [1 byte] 0x10 in this case
|
|
815 01f1 max-item-count [1 byte] 0x1f constant
|
|
816 01f3 node-level [1 byte] 0x00 in this case
|
|
817 01f8 back-pointer [4 bytes] 0x021eae in this case
|
|
818 ]]></literallayout>
|
|
819 <para>
|
|
820 The item-count specifies the number of 16 byte records that
|
|
821 are active. The node-level is zero for these leaf nodes.
|
|
822 The back-pointer must match the back-pointer from the triple
|
|
823 that pointed to this node.
|
|
824 </para>
|
|
825 <para>
|
|
826 Each item in this node is a tuple of (ID2, DESC-ID1, LIST-ID1, PARENT-ID2)
|
|
827 </para>
|
|
828 </refsect1>
|
|
829
|
|
830 <refsect1 id='pst.file.list.5'>
|
|
831 <title>Associated List Item</title>
|
|
832 <para>
|
|
833 Contains associations between id1 and id2 for the items controlled by the record.
|
|
834 In the above leaf node, we have a tuple of (0x61, 0x02a82c, 0x02a836, 0)
|
|
835 0x02a836 is the ID1 of the associated list, and we can lookup that ID1 value
|
|
836 in the index1 b-tree to find the (offset,size) of the data in the .pst file.
|
|
837 </para>
|
|
838 <literallayout class="monospaced"><![CDATA[
|
|
839 0000 02 00 01 00 9f 81 00 00 30 a8 02 00 00 00 00 00
|
|
840
|
|
841 0000 unknown [2 bytes] 0x0002 constant
|
|
842 0002 count [2 bytes] 0x0001 in this case
|
|
843 repeating
|
|
844 0004 id2 [4 bytes] 0x00819f in this case
|
|
845 0008 id [4 bytes] 0x02a830 in this case
|
|
846 000c unknown [4 bytes] 0 in this case
|
|
847 ]]></literallayout>
|
|
848 </refsect1>
|
|
849
|
|
850 <refsect1 id='pst.file.desc.5'>
|
|
851 <title>Associated Descriptor Item</title>
|
|
852 <para>
|
|
853 Contains information about the item, which may be email, contact, or other outlook types.
|
|
854 In the above leaf node, we have a tuple of (0x21, 0x00e638, 0, 0)
|
|
855 0x00e638 is the ID1 of the associated descriptor, and we can lookup that ID1 value
|
|
856 in the index1 b-tree to find the (offset,size) of the data in the .pst file.
|
|
857 </para>
|
|
858 <literallayout class="monospaced"><![CDATA[
|
|
859 0000 3c 01 ec bc 20 00 00 00 00 00 00 00 b5 02 06 00
|
|
860 0010 40 00 00 00 f9 0f 02 01 60 00 00 00 01 30 1e 00
|
|
861 0020 80 00 00 00 04 30 1e 00 00 00 00 00 df 35 03 00
|
|
862 0030 ff 00 00 00 e0 35 02 01 a0 00 00 00 e2 35 02 01
|
|
863 0040 e0 00 00 00 e3 35 02 01 c0 00 00 00 e4 35 02 01
|
|
864 0050 00 01 00 00 e5 35 02 01 20 01 00 00 e6 35 02 01
|
|
865 0060 40 01 00 00 e7 35 02 01 60 01 00 00 1e 66 0b 00
|
|
866 0070 00 00 00 00 ff 67 03 00 00 00 00 00 d2 7f 17 d8
|
|
867 0080 64 8c d5 11 83 24 00 50 04 86 95 45 53 74 61 6e
|
|
868 0090 6c 65 79 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
|
|
869 00A0 24 00 50 04 86 95 45 22 80 00 00 00 00 00 00 d2
|
|
870 00B0 7f 17 d8 64 8c d5 11 83 24 00 50 04 86 95 45 42
|
|
871 00C0 80 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
|
|
872 00D0 24 00 50 04 86 95 45 a2 80 00 00 00 00 00 00 d2
|
|
873 00E0 7f 17 d8 64 8c d5 11 83 24 00 50 04 86 95 45 c2
|
|
874 00F0 80 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
|
|
875 0100 24 00 50 04 86 95 45 e2 80 00 00 00 00 00 00 d2
|
|
876 0110 7f 17 d8 64 8c d5 11 83 24 00 50 04 86 95 45 02
|
|
877 0120 81 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
|
|
878 0130 24 00 50 04 86 95 45 62 80 00 00 00 0b 00 00 00
|
|
879 0140 0c 00 14 00 7c 00 8c 00 93 00 ab 00 c3 00 db 00
|
|
880 0150 f3 00 0b 01 23 01 3b 01
|
|
881
|
|
882 0000 index-offset [2 bytes] 0x013c in this case
|
|
883 0002 signature [2 bytes] 0xbcec constant
|
|
884 0004 offset [2 bytes] 0x0020 in this case
|
|
885 ]]></literallayout>
|
|
886 <para>
|
|
887 Note the index-offset of 0x013c - starting at that position in the
|
|
888 descriptor block, we have an array of two byte integers. The first
|
|
889 integer (0x000b) is a count of the number of overlapping pairs
|
|
890 following the count. The first pair is (0, 0xc), the next pair is (0xc, 0x14)
|
|
891 and the last (11th) pair is (0x10b, 0x123). These pairs are (start,end+1)
|
|
892 offsets of items in this block. So we have count+1 integers following
|
|
893 the count value.
|
|
894 </para>
|
|
895 <para>
|
|
896 Note the offset of 0x0020, which needs to be right shifted by 4 bits
|
|
897 to become 0x0002, which is then a byte offset to be added to the above
|
|
898 index-offset plus two (to skip the count), so it points to the (0xc, 0x14)
|
|
899 pair. Finally, we have the offset and size of the "b5" block located at offset 0xc
|
|
900 with a size of 8 bytes in this descriptor block. The "b5" block has the
|
|
901 following format:
|
|
902 </para>
|
|
903 <literallayout class="monospaced"><![CDATA[
|
|
904 0000 signature [2 bytes] 0x02b5 constant
|
|
905 0002 unknown [2 bytes] 0x0006 in this case
|
|
906 0004 offset [4 bytes] 0x0040 in this case
|
|
907 ]]></literallayout>
|
|
908 <para>
|
|
909 Note the "b5" offset of 0x0040, which needs to be right shifted by 4 bits
|
|
910 to become 0x0004, which is then a byte offset to be added to the above
|
|
911 index-offset plus two (to skip the count), so it points to the (0x14, 0x7c)
|
|
912 pair. We now have the offset 0x14 of the descriptor array, composed of 8 byte
|
|
913 entries. Each descriptor entry has the following format:
|
|
914 </para>
|
|
915 <literallayout class="monospaced"><![CDATA[
|
|
916 0000 item-type [2 bytes]
|
|
917 0002 reference-type [2 bytes]
|
|
918 0004 value [4 bytes]
|
|
919 ]]></literallayout>
|
|
920 <para>
|
|
921 For some reference types (2, 3, 0xb) the value is used directly. Otherwise,
|
|
922 the value is generally a non-zero offset, to be right shifted by 4 bits and used to fetch
|
|
923 a pair from the index table to find the offset and size of the item in this
|
|
924 descriptor block. However, if (value AND 0xf) == 0xf, then the value is an ID2 index.
|
|
925 </para>
|
|
926 <para>
|
|
927 The following reference types are known, but not all of these
|
|
928 are implemented in the code yet.
|
|
929 </para>
|
|
930 <literallayout class="monospaced"><![CDATA[
|
|
931 0x0002 - Signed 16bit value
|
|
932 0x0003 - Signed 32bit value
|
|
933 0x0004 - 4-byte floating point
|
|
934 0x0005 - Floating point double
|
|
935 0x0006 - Signed 64-bit int
|
|
936 0x0007 - Application Time
|
|
937 0x000A - 32-bit error value
|
|
938 0x000B - Boolean (non-zero = true)
|
|
939 0x000D - Embedded Object
|
|
940 0x0014 - 8-byte signed integer (64-bit)
|
|
941 0x001E - Null terminated String
|
|
942 0x001F - Unicode string
|
|
943 0x0040 - Systime - Filetime structure
|
|
944 0x0048 - OLE Guid
|
|
945 0x0102 - Binary data
|
|
946 0x1003 - Array of 32bit values
|
|
947 0x1014 - Array of 64bit values
|
|
948 0x101E - Array of Strings
|
|
949 0x1102 - Array of Binary data
|
|
950 ]]></literallayout>
|
|
951 <para>
|
|
952 The following item types are known, but not all of these
|
|
953 are implemented in the code yet.
|
|
954 Note: it appears that some types can have a IPOS value or a ID2 value
|
|
955 depending on the size of the field in question. It is safer to check
|
|
956 every field than for me to say what the "usually" contain. Absolute
|
|
957 values though, are generally going to be constant.
|
|
958 </para>
|
|
959 <literallayout class="monospaced"><![CDATA[
|
|
960 0002 AutoForward allowed
|
|
961 0003 Extended Attributes Table
|
|
962 0017 Importance Level
|
|
963 001a IPM Context. What type of message is this
|
|
964 0023 Global Delivery Report
|
|
965 0026 Priority
|
|
966 0029 Read Receipt
|
|
967 002b Reassignment Prohibited
|
|
968 002e Original Sensitivity
|
|
969 0036 Sensitivity
|
|
970 0037 Email Subject. The referenced item is of type "Subject Type"
|
|
971 0039 Date. This is likely to be the arrival date
|
|
972 003b Outlook Address of Sender
|
|
973 003f Outlook structure describing the recipient
|
|
974 0040 Name of the Outlook recipient structure
|
|
975 0041 Outlook structure describing the sender
|
|
976 0042 Name of the Outlook sender structure
|
|
977 0043 Another structure describing the recipient
|
|
978 0044 Name of the second recipient structure
|
|
979 004f Reply-To Outlook Structure
|
|
980 0050 Name of the Reply-To structure
|
|
981 0051 Outlook Name of recipient
|
|
982 0052 Second Outlook name of recipient
|
|
983 0057 My address in TO field
|
|
984 0058 My address in CC field
|
|
985 0059 Message addressed to me
|
|
986 0063 Response requested
|
|
987 0064 Sender's Address access method (SMTP, EX)
|
|
988 0065 Sender's Address
|
|
989 0070 Processed Subject (with Fwd:, Re, ... removed)
|
|
990 0071 Date. Another date
|
|
991 0075 Recipient Address Access Method (SMTP, EX)
|
|
992 0076 Recipient's Address
|
|
993 0077 Second Recipient Access Method (SMTP, EX)
|
|
994 0078 Second Recipient Address
|
|
995 007d Email Header. This is the header that was attached to the email
|
|
996 0c17 Reply Requested
|
|
997 0c19 Second sender struct
|
|
998 0c1a Name of second sender struct
|
|
999 0c1d Second outlook name of sender
|
|
1000 0c1e Second sender access method (SMTP, EX)
|
|
1001 0c1f Second Sender Address
|
|
1002 0e01 Delete after submit
|
|
1003 0e03 CC Address?
|
|
1004 0e04 SentTo Address
|
|
1005 0e06 Date.
|
|
1006 0e07 Flag - contains IsSeen value
|
|
1007 0e08 Message Size
|
|
1008 0e0a Sentmail EntryID
|
|
1009 0e1f Compressed RTF in Sync
|
|
1010 0e20 Attachment Size
|
|
1011 0ff9 binary record header
|
|
1012 1000 Plain Text Email Body. Does not exist if the email doesn't have a plain text version
|
|
1013 1006 RTF Sync Body CRC
|
|
1014 1007 RTF Sync Body character count
|
|
1015 1008 RTF Sync body tag
|
|
1016 1009 RTF Compressed body
|
|
1017 1010 RTF whitespace prefix count
|
|
1018 1011 RTF whitespace tailing count
|
|
1019 1013 HTML Email Body. Does not exist if the email doesn't have a HTML version
|
|
1020 1035 Message ID
|
|
1021 1042 In-Reply-To or Parent's Message ID
|
|
1022 1046 Return Path
|
|
1023 3001 Folder Name? I have seen this value used for the contacts record aswell
|
|
1024 3002 Address Type
|
|
1025 3003 Contact Address
|
|
1026 3004 Comment
|
|
1027 3007 Date item creation
|
|
1028 3008 Date item modification
|
|
1029 300b binary record header
|
|
1030 35df Valid Folder Mask
|
|
1031 35e0 binary record found in first item. Contains the reference to "Top of Personal Folder" item
|
|
1032 35e3 binary record with a reference to "Deleted Items" item
|
|
1033 35e7 binary record with a refernece to "Search Root" item
|
|
1034 3602 the number of emails stored in a folder
|
|
1035 3603 the number of unread emails in a folder
|
|
1036 360a Has Subfolders
|
|
1037 3613 the folder content description
|
|
1038 3617 Associate Content count
|
|
1039 3701 Binary Data attachment
|
|
1040 3704 Attachment Filename
|
|
1041 3705 Attachement method
|
|
1042 3707 Attachment Filename long
|
|
1043 370b Attachment Position
|
|
1044 370e Attachment mime encoding
|
|
1045 3710 Attachment Mime Sequence
|
|
1046 3a00 Contact's Account name
|
|
1047 3a01 Contact Alternate Recipient
|
|
1048 3a02 Callback telephone number
|
|
1049 3a03 Message Conversion Prohibited
|
|
1050 3a05 Contacts Suffix
|
|
1051 3a06 Contacts First Name
|
|
1052 3a07 Contacts Government ID Number
|
|
1053 3a08 Business Telephone Number
|
|
1054 3a09 Home Telephone Number
|
|
1055 3a0a Contacts Initials
|
|
1056 3a0b Keyword
|
|
1057 3a0c Contact's Language
|
|
1058 3a0d Contact's Location
|
|
1059 3a0e Mail Permission
|
|
1060 3a0f MHS Common Name
|
|
1061 3a10 Organizational ID #
|
|
1062 3a11 Contacts Surname
|
|
1063 3a12 original entry id
|
|
1064 3a13 original display name
|
|
1065 3a14 original search key
|
|
1066 3a15 Default Postal Address
|
|
1067 3a16 Company Name
|
|
1068 3a17 Job Title
|
|
1069 3a18 Department Name
|
|
1070 3a19 Office Location
|
|
1071 3a1a Primary Telephone
|
|
1072 3a1b Business Phone Number 2
|
|
1073 3a1c Mobile Phone Number
|
|
1074 3a1d Radio Phone Number
|
|
1075 3a1e Car Phone Number
|
|
1076 3a1f Other Phone Number
|
|
1077 3a20 Transmittable Display Name
|
|
1078 3a21 Pager Phone Number
|
|
1079 3a22 user certificate
|
|
1080 3a23 Primary Fax Number
|
|
1081 3a24 Business Fax Number
|
|
1082 3a25 Home Fax Number
|
|
1083 3a26 Business Address Country
|
|
1084 3a27 Business Address City
|
|
1085 3a28 Business Address State
|
|
1086 3a29 Business Address Street
|
|
1087 3a2a Business Postal Code
|
|
1088 3a2b Business PO Box
|
|
1089 3a2c Telex Number
|
|
1090 3a2d ISDN Number
|
|
1091 3a2e Assistant Phone Number
|
|
1092 3a2f Home Phone 2
|
|
1093 3a30 Assistant's Name
|
|
1094 3a40 Can receive Rich Text
|
|
1095 3a41 Wedding Anniversary
|
|
1096 3a42 Birthday
|
|
1097 3a43 Hobbies
|
|
1098 3a44 Middle Name
|
|
1099 3a45 Display Name Prefix (Title)
|
|
1100 3a46 Profession
|
|
1101 3a47 Preferred By Name
|
|
1102 3a48 Spouse's Name
|
|
1103 3a49 Computer Network Name
|
|
1104 3a4a Customer ID
|
|
1105 3a4b TTY/TDD Phone
|
|
1106 3a4c Ftp Site
|
|
1107 3a4d Gender
|
|
1108 3a4e Manager's Name
|
|
1109 3a4f Nickname
|
|
1110 3a50 Personal Home Page
|
|
1111 3a51 Business Home Page
|
|
1112 3a57 Company Main Phone
|
|
1113 3a58 childrens names
|
|
1114 3a59 Home Address City
|
|
1115 3a5a Home Address Country
|
|
1116 3a5b Home Address Postal Code
|
|
1117 3a5c Home Address State or Province
|
|
1118 3a5d Home Address Street
|
|
1119 3a5e Home Address Post Office Box
|
|
1120 3a5f Other Address City
|
|
1121 3a60 Other Address Country
|
|
1122 3a61 Other Address Postal Code
|
|
1123 3a62 Other Address State
|
|
1124 3a63 Other Address Street
|
|
1125 3a64 Other Address Post Office box
|
|
1126 65e3 Entry ID
|
|
1127 67f2 Attachment ID2 value
|
|
1128 67ff Password checksum [0x67FF]
|
|
1129 6f02 Secure HTML Body
|
|
1130 6f04 Secure Text Body
|
|
1131 7c07 Top of folders RecID [0x7c07]
|
|
1132 8000 Contain extra bits of information that have been taken from the email's header. I call them extra lines
|
|
1133 8005 Contact Fullname
|
|
1134 801a Home Address
|
|
1135 801b Business Address
|
|
1136 801c Other Address
|
|
1137 8082 Email Address 1 Transport
|
|
1138 8083 Email Address 1 Address
|
|
1139 8084 Email Address 1 Description
|
|
1140 8085 Email Address 1 Record
|
|
1141 8092 Email Address 2 Transport
|
|
1142 8093 Email Address 2 Address
|
|
1143 8094 DEBUG_EMAIL (("Email Address 2 Description
|
|
1144 8095 Email Address 2 Record
|
|
1145 80a2 DEBUG_EMAIL (("Email Address 3 Transport
|
|
1146 80a3 Email Address 3 Address
|
|
1147 80a4 Email Address 3 Description
|
|
1148 80a5 Email Address 3 Record
|
|
1149 80d8 Internet Free/Busy
|
|
1150 8205 Appointment shows as
|
|
1151 8208 Appointment Location
|
|
1152 8214 Label for appointment
|
|
1153 8234 TimeZone of times
|
|
1154 8235 Appointment Start Time
|
|
1155 8236 Appointment End Time
|
|
1156 8516 Duplicate Time Start
|
|
1157 8517 Duplicate Time End
|
|
1158 8530 Followup String
|
|
1159 8534 Mileage
|
|
1160 8535 Billing Information
|
|
1161 8554 Outlook Version
|
|
1162 8560 Appointment Reminder Time
|
|
1163 8700 Journal Entry Type
|
|
1164 8706 Start Timestamp
|
|
1165 8708 End Timestamp
|
|
1166 8712 Journal Entry Type
|
|
1167 ]]></literallayout>
|
|
1168 </refsect1>
|
|
1169
|
|
1170 </refentry>
|
16
|
1171 </reference>
|