|
16
|
1 <reference>
|
|
|
2 <title>@PACKAGE@ Utilities - Version @VERSION@</title>
|
|
|
3 <partintro>
|
|
|
4 <title>Packages</title>
|
|
31
|
5
|
|
|
6 <para>This is a fork of the libpst project at SourceForge. Another fork
|
|
|
7 is located at <ulink
|
|
|
8 url="http://alioth.debian.org/projects/libpst/">http://alioth.debian.org/projects/libpst/</ulink>
|
|
|
9 </para>
|
|
|
10
|
|
|
11 <para>The various source and binary packages are available at <ulink
|
|
|
12 url="http://www.five-ten-sg.com/@PACKAGE@/packages/">http://www.five-ten-sg.com/@PACKAGE@/packages/</ulink>
|
|
|
13 The most recent documentation is available at <ulink
|
|
|
14 url="http://www.five-ten-sg.com/@PACKAGE@/">http://www.five-ten-sg.com/@PACKAGE@/</ulink>
|
|
|
15 </para>
|
|
|
16
|
|
24
|
17 </partintro>
|
|
16
|
18
|
|
|
19
|
|
|
20 <refentry id="readpst.1">
|
|
|
21 <refentryinfo>
|
|
31
|
22 <date>2007-07-10</date>
|
|
16
|
23 </refentryinfo>
|
|
|
24
|
|
|
25 <refmeta>
|
|
|
26 <refentrytitle>readpst</refentrytitle>
|
|
|
27 <manvolnum>1</manvolnum>
|
|
|
28 <refmiscinfo>readpst @VERSION@</refmiscinfo>
|
|
|
29 </refmeta>
|
|
|
30
|
|
20
|
31 <refnamediv id='readpst.name.1'>
|
|
16
|
32 <refname>readpst</refname>
|
|
|
33 <refpurpose>convert PST (MS Outlook Personal Folders) files to mbox format</refpurpose>
|
|
|
34 </refnamediv>
|
|
|
35
|
|
20
|
36 <refsynopsisdiv id='readpst.synopsis.1'>
|
|
16
|
37 <title>Synopsis</title>
|
|
|
38 <cmdsynopsis>
|
|
|
39 <command>readpst</command>
|
|
31
|
40 <arg><option>-b</option></arg>
|
|
16
|
41 <arg><option>-c <replaceable class="parameter">format</replaceable></option></arg>
|
|
|
42 <arg><option>-d <replaceable class="parameter">debug-file</replaceable></option></arg>
|
|
|
43 <arg><option>-h</option></arg>
|
|
|
44 <arg><option>-k</option></arg>
|
|
|
45 <arg><option>-o <replaceable class="parameter">output-directory</replaceable></option></arg>
|
|
|
46 <arg><option>-q</option></arg>
|
|
|
47 <arg><option>-r</option></arg>
|
|
|
48 <arg><option>-S</option></arg>
|
|
25
|
49 <arg><option>-M</option></arg>
|
|
16
|
50 <arg><option>-V</option></arg>
|
|
|
51 <arg><option>-w</option></arg>
|
|
24
|
52 <arg rep='repeat' choice='plain'>files</arg>
|
|
16
|
53 </cmdsynopsis>
|
|
|
54 </refsynopsisdiv>
|
|
|
55
|
|
20
|
56 <refsect1 id='readpst.description.1'>
|
|
|
57 <title>Description</title>
|
|
28
|
58 <para><command>readpst</command> is a program that can read an Outlook
|
|
|
59 PST (Personal Folders) file and convert it into an mbox file, a format
|
|
|
60 suitable for KMail, a recursive mbox structure, or separate emails.
|
|
20
|
61 </para>
|
|
|
62 </refsect1>
|
|
|
63
|
|
|
64 <refsect1 id='readpst.options.1'>
|
|
16
|
65 <title>Options</title>
|
|
|
66 <variablelist>
|
|
|
67 <varlistentry>
|
|
31
|
68 <term>-b</term>
|
|
|
69 <listitem><para>
|
|
|
70 Do not save the attachments for the RTF format of the email body.
|
|
|
71 </para></listitem>
|
|
|
72 </varlistentry>
|
|
|
73 <varlistentry>
|
|
16
|
74 <term>-c <replaceable class="parameter">format</replaceable></term>
|
|
|
75 <listitem><para>
|
|
|
76 Set the Contact output mode. Use -cv for vcard format or -cl for an email list.
|
|
|
77 </para></listitem>
|
|
|
78 </varlistentry>
|
|
|
79 <varlistentry>
|
|
|
80 <term>-d <replaceable class="parameter">debug-file</replaceable></term>
|
|
|
81 <listitem><para>
|
|
28
|
82 Specify name of debug log file. Defaults to "readpst.log". The
|
|
|
83 log file is not an ascii file, it is a binary file readable
|
|
|
84 by <command>readpstlog</command>.
|
|
16
|
85 </para></listitem>
|
|
|
86 </varlistentry>
|
|
|
87 <varlistentry>
|
|
|
88 <term>-h</term>
|
|
|
89 <listitem><para>
|
|
31
|
90 Show summary of options and exit.
|
|
16
|
91 </para></listitem>
|
|
|
92 </varlistentry>
|
|
|
93 <varlistentry>
|
|
|
94 <term>-k</term>
|
|
|
95 <listitem><para>
|
|
|
96 Changes the output format to KMail.
|
|
|
97 </para></listitem>
|
|
|
98 </varlistentry>
|
|
|
99 <varlistentry>
|
|
20
|
100 <term>-o <replaceable class="parameter">output-directory</replaceable></term>
|
|
16
|
101 <listitem><para>
|
|
|
102 Specifies the output directory. The directory must already exist, and
|
|
|
103 is entered after the PST file is opened, but before any processing of
|
|
|
104 files commences.
|
|
|
105 </para></listitem>
|
|
|
106 </varlistentry>
|
|
|
107 <varlistentry>
|
|
|
108 <term>-q</term>
|
|
|
109 <listitem><para>
|
|
|
110 Changes to silent mode. No feedback is printed to the screen, except
|
|
|
111 for error messages.
|
|
|
112 </para></listitem>
|
|
|
113 </varlistentry>
|
|
|
114 <varlistentry>
|
|
|
115 <term>-r</term>
|
|
|
116 <listitem><para>
|
|
|
117 Changes the output format to Recursive. This will create folders as
|
|
21
|
118 named in the PST file, and will put all emails in a file called "mbox"
|
|
16
|
119 inside each folder. These files are then compatible with all
|
|
|
120 mbox-compatible email clients.
|
|
|
121 </para></listitem>
|
|
|
122 </varlistentry>
|
|
|
123 <varlistentry>
|
|
|
124 <term>-S</term>
|
|
|
125 <listitem><para>
|
|
25
|
126 Output messages into separate files. This will create folders as named
|
|
|
127 in the PST file, and will put each email in its own file. These files
|
|
28
|
128 will be numbered from 1 increasing in intervals of 1 (ie 1, 2, 3, ...).
|
|
|
129 Any attachments are saved alongside each email as XXXXXXXXX-attach1,
|
|
|
130 XXXXXXXXX-attach2 and so on, or with the name of the attachment if one
|
|
|
131 is present.
|
|
16
|
132 </para></listitem>
|
|
|
133 </varlistentry>
|
|
|
134 <varlistentry>
|
|
25
|
135 <term>-M</term>
|
|
|
136 <listitem><para>
|
|
|
137 Output messages in MH format as separate files. This will create
|
|
28
|
138 folders as named in the PST file, and will put each email together with
|
|
|
139 any attachments into its own file. These files will be numbered from 1
|
|
|
140 to n with no leading zeros.
|
|
25
|
141 </para></listitem>
|
|
|
142 </varlistentry>
|
|
|
143 <varlistentry>
|
|
16
|
144 <term>-V</term>
|
|
|
145 <listitem><para>
|
|
31
|
146 Show program version and exit.
|
|
16
|
147 </para></listitem>
|
|
|
148 </varlistentry>
|
|
|
149 <varlistentry>
|
|
|
150 <term>-w</term>
|
|
|
151 <listitem><para>
|
|
20
|
152 Overwrite any previous output files. Beware: When used with the -S
|
|
16
|
153 switch, this will remove all files from the target folder before
|
|
|
154 writing. This is to keep the count of emails and attachments correct.
|
|
|
155 </para></listitem>
|
|
|
156 </varlistentry>
|
|
|
157 </variablelist>
|
|
|
158 </refsect1>
|
|
|
159
|
|
20
|
160 <refsect1 id='readpst.also.1'>
|
|
16
|
161 <title>See Also</title>
|
|
|
162 <para>
|
|
25
|
163 <citerefentry><refentrytitle>readpstlog</refentrytitle> <manvolnum>1</manvolnum> </citerefentry>
|
|
16
|
164 </para>
|
|
|
165 </refsect1>
|
|
|
166
|
|
20
|
167 <refsect1 id='readpst.author.1'>
|
|
16
|
168 <title>Author</title>
|
|
|
169 <para>
|
|
|
170 This manual page was originally written by Dave Smith
|
|
|
171 <dave.s@earthcorp.com>, and updated by Joe Nahmias <joe@nahmias.net>
|
|
|
172 for the Debian GNU/Linux system (but may be used by others). It was
|
|
20
|
173 subsequently updated by Brad Hards <bradh@frogmouth.net>, and converted to
|
|
16
|
174 xml format by Carl Byington <carl@five-ten-sg.com>.
|
|
|
175 </para>
|
|
|
176 </refsect1>
|
|
|
177
|
|
20
|
178 <refsect1 id='readpst.copyright.1'>
|
|
16
|
179 <title>Copyright</title>
|
|
|
180 <para>
|
|
|
181 Copyright (C) 2002 by David Smith <dave.s@earthcorp.com>.
|
|
28
|
182 XML version Copyright (C) 2006 by 510 Software Group <carl@five-ten-sg.com>.
|
|
16
|
183 </para>
|
|
|
184 <para>
|
|
|
185 This program is free software; you can redistribute it and/or modify it
|
|
|
186 under the terms of the GNU General Public License as published by the
|
|
|
187 Free Software Foundation; either version 2, or (at your option) any
|
|
|
188 later version.
|
|
|
189 </para>
|
|
|
190 <para>
|
|
|
191 You should have received a copy of the GNU General Public License along
|
|
|
192 with this program; see the file COPYING. If not, please write to the
|
|
|
193 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
|
194 </para>
|
|
|
195 </refsect1>
|
|
|
196
|
|
20
|
197 <refsect1 id='readpst.version.1'>
|
|
16
|
198 <title>CVS Version</title>
|
|
|
199 <para>
|
|
|
200 $Id$
|
|
|
201 </para>
|
|
|
202 </refsect1>
|
|
|
203 </refentry>
|
|
|
204
|
|
|
205
|
|
|
206 <refentry id="readpstlog.1">
|
|
|
207 <refentryinfo>
|
|
31
|
208 <date>2007-07-10</date>
|
|
16
|
209 </refentryinfo>
|
|
|
210
|
|
|
211 <refmeta>
|
|
|
212 <refentrytitle>readpstlog</refentrytitle>
|
|
|
213 <manvolnum>1</manvolnum>
|
|
|
214 <refmiscinfo>readpstlog @VERSION@</refmiscinfo>
|
|
|
215 </refmeta>
|
|
|
216
|
|
20
|
217 <refnamediv id='readpstlog.name.1'>
|
|
16
|
218 <refname>readpstlog</refname>
|
|
24
|
219 <refpurpose>convert a <command>readpst</command> logfile to text format</refpurpose>
|
|
16
|
220 </refnamediv>
|
|
|
221
|
|
20
|
222 <refsynopsisdiv id='readpstlog.synopsis.1'>
|
|
16
|
223 <title>Synopsis</title>
|
|
|
224 <cmdsynopsis>
|
|
24
|
225 <command>readpstlog</command>
|
|
16
|
226 <arg><option>-f <replaceable class="parameter">format</replaceable></option></arg>
|
|
|
227 <arg><option>-t <replaceable class="parameter">include-types</replaceable></option></arg>
|
|
|
228 <arg><option>-x <replaceable class="parameter">exclude-types</replaceable></option></arg>
|
|
24
|
229 <arg choice='plain'>logfile</arg>
|
|
16
|
230 </cmdsynopsis>
|
|
|
231 </refsynopsisdiv>
|
|
|
232
|
|
20
|
233 <refsect1 id='readpstlog.description.1'>
|
|
|
234 <title>Description</title>
|
|
21
|
235 <para><command>readpstlog</command>
|
|
24
|
236 is a program that converts the binary logfile generated
|
|
|
237 by <command>readpst</command> to a more desirable text format.
|
|
20
|
238 </para>
|
|
|
239 </refsect1>
|
|
|
240
|
|
|
241 <refsect1 id='readpstlog.options.1'>
|
|
16
|
242 <title>Options</title>
|
|
|
243 <variablelist>
|
|
|
244 <varlistentry>
|
|
|
245 <term>-f <replaceable class="parameter">format</replaceable></term>
|
|
|
246 <listitem><para>
|
|
|
247 Sets the format of the text log output. Currently, the only valid output
|
|
|
248 format is T, for text; anything else gives the default.
|
|
|
249 </para></listitem>
|
|
|
250 </varlistentry>
|
|
|
251 <varlistentry>
|
|
|
252 <term>-t <replaceable class="parameter">include-types</replaceable></term>
|
|
|
253 <listitem><para>
|
|
|
254 Print only the specified types of log messages.
|
|
|
255 Types are specified in a comma-delimited list (e.g. 3,10,5,6).
|
|
|
256 </para></listitem>
|
|
|
257 </varlistentry>
|
|
|
258 <varlistentry>
|
|
|
259 <term>-x <replaceable class="parameter">exclude-types</replaceable></term>
|
|
|
260 <listitem><para>
|
|
|
261 Exclude the specified types of log messages.
|
|
|
262 Types are specified in a comma-delimited list (e.g. 3,10,5,6).
|
|
|
263 </para></listitem>
|
|
|
264 </varlistentry>
|
|
|
265 </variablelist>
|
|
|
266 </refsect1>
|
|
|
267
|
|
20
|
268 <refsect1 id='readpstlog.message.types.1'>
|
|
16
|
269 <title>Message Types</title>
|
|
24
|
270 <para><command>readpstlog</command> understands the following types of log
|
|
|
271 messages:
|
|
16
|
272 </para>
|
|
|
273 <variablelist>
|
|
20
|
274 <varlistentry>
|
|
|
275 <term>1</term>
|
|
|
276 <listitem><para>
|
|
|
277 File accesses
|
|
|
278 </para></listitem>
|
|
|
279 </varlistentry>
|
|
|
280 <varlistentry>
|
|
|
281 <term>2</term>
|
|
|
282 <listitem><para>
|
|
|
283 Index accesses
|
|
|
284 </para></listitem>
|
|
|
285 </varlistentry>
|
|
|
286 <varlistentry>
|
|
|
287 <term>3</term>
|
|
|
288 <listitem><para>
|
|
|
289 New email found
|
|
|
290 </para></listitem>
|
|
|
291 </varlistentry>
|
|
|
292 <varlistentry>
|
|
|
293 <term>4</term>
|
|
|
294 <listitem><para>
|
|
|
295 Warnings
|
|
|
296 </para></listitem>
|
|
|
297 </varlistentry>
|
|
|
298 <varlistentry>
|
|
|
299 <term>5</term>
|
|
|
300 <listitem><para>
|
|
|
301 Read accesses
|
|
|
302 </para></listitem>
|
|
|
303 </varlistentry>
|
|
|
304 <varlistentry>
|
|
|
305 <term>6</term>
|
|
|
306 <listitem><para>
|
|
|
307 Informational messages
|
|
|
308 </para></listitem>
|
|
|
309 </varlistentry>
|
|
|
310 <varlistentry>
|
|
|
311 <term>7</term>
|
|
|
312 <listitem><para>
|
|
|
313 Main function calls
|
|
|
314 </para></listitem>
|
|
|
315 </varlistentry>
|
|
|
316 <varlistentry>
|
|
|
317 <term>8</term>
|
|
|
318 <listitem><para>
|
|
|
319 Decrypting calls
|
|
|
320 </para></listitem>
|
|
|
321 </varlistentry>
|
|
|
322 <varlistentry>
|
|
|
323 <term>10</term>
|
|
|
324 <listitem><para>
|
|
|
325 Function calls
|
|
|
326 </para></listitem>
|
|
|
327 </varlistentry>
|
|
|
328 <varlistentry>
|
|
|
329 <term>11</term>
|
|
|
330 <listitem><para>
|
|
|
331 HexDump calls
|
|
|
332 </para></listitem>
|
|
|
333 </varlistentry>
|
|
16
|
334 </variablelist>
|
|
|
335 </refsect1>
|
|
|
336
|
|
20
|
337 <refsect1 id='readpstlog.author.1'>
|
|
16
|
338 <title>Author</title>
|
|
|
339 <para>
|
|
|
340 This manual page was written by Joe Nahmias <joe@nahmias.net>
|
|
|
341 for the Debian GNU/Linux system (but may be used by others). It was
|
|
|
342 converted to xml format by Carl Byington <carl@five-ten-sg.com>.
|
|
|
343 </para>
|
|
|
344 </refsect1>
|
|
|
345
|
|
20
|
346 <refsect1 id='readpstlog.copyright.1'>
|
|
16
|
347 <title>Copyright</title>
|
|
|
348 <para>
|
|
|
349 Copyright (C) 2002 by David Smith <dave.s@earthcorp.com>.
|
|
|
350 XML version Copyright (C) 2005 by 510 Software Group <carl@five-ten-sg.com>.
|
|
|
351 </para>
|
|
|
352 <para>
|
|
|
353 This program is free software; you can redistribute it and/or modify it
|
|
|
354 under the terms of the GNU General Public License as published by the
|
|
|
355 Free Software Foundation; either version 2, or (at your option) any
|
|
|
356 later version.
|
|
|
357 </para>
|
|
|
358 <para>
|
|
|
359 You should have received a copy of the GNU General Public License along
|
|
|
360 with this program; see the file COPYING. If not, please write to the
|
|
|
361 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
|
362 </para>
|
|
|
363 </refsect1>
|
|
|
364
|
|
20
|
365 <refsect1 id='readpstlog.version.1'>
|
|
16
|
366 <title>CVS Version</title>
|
|
|
367 <para>
|
|
|
368 $Id$
|
|
|
369 </para>
|
|
|
370 </refsect1>
|
|
|
371 </refentry>
|
|
24
|
372
|
|
|
373
|
|
|
374 <refentry id="pst2ldif.1">
|
|
|
375 <refentryinfo>
|
|
31
|
376 <date>2007-07-10</date>
|
|
24
|
377 </refentryinfo>
|
|
|
378
|
|
|
379 <refmeta>
|
|
|
380 <refentrytitle>pst2ldif</refentrytitle>
|
|
|
381 <manvolnum>1</manvolnum>
|
|
|
382 <refmiscinfo>pst2ldif @VERSION@</refmiscinfo>
|
|
|
383 </refmeta>
|
|
|
384
|
|
|
385 <refnamediv id='pst2ldif.name.1'>
|
|
|
386 <refname>pst2ldif</refname>
|
|
|
387 <refpurpose>extract contacts from a MS Outlook .pst file in .ldif format</refpurpose>
|
|
|
388 </refnamediv>
|
|
|
389
|
|
|
390 <refsynopsisdiv id='pst2ldif.synopsis.1'>
|
|
|
391 <title>Synopsis</title>
|
|
|
392 <cmdsynopsis>
|
|
|
393 <command>pst2ldif</command>
|
|
|
394 <arg><option>-h</option></arg>
|
|
|
395 <arg><option>-V</option></arg>
|
|
|
396 <arg><option>-b <replaceable class="parameter">ldap-base</replaceable></option></arg>
|
|
|
397 <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
|
|
|
398 <arg choice='plain'>pstfilename</arg>
|
|
|
399 </cmdsynopsis>
|
|
|
400 </refsynopsisdiv>
|
|
|
401
|
|
|
402 <refsect1 id='pst2ldif.options.1'>
|
|
|
403 <title>Options</title>
|
|
|
404 <variablelist>
|
|
|
405 <varlistentry>
|
|
|
406 <term>-h</term>
|
|
|
407 <listitem><para>
|
|
|
408 Show summary of options. Subsequent options are then ignored.
|
|
|
409 </para></listitem>
|
|
|
410 </varlistentry>
|
|
|
411 <varlistentry>
|
|
|
412 <term>-V <replaceable class="parameter">include-types</replaceable></term>
|
|
|
413 <listitem><para>
|
|
|
414 Show program version. Subsequent options are then ignored.
|
|
|
415 </para></listitem>
|
|
|
416 </varlistentry>
|
|
|
417 <varlistentry>
|
|
|
418 <term>-b <replaceable class="parameter">ldap-base</replaceable></term>
|
|
|
419 <listitem><para>
|
|
|
420 Sets the ldap base value used in the dn records. You probably want to
|
|
|
421 use something like "o=organization, c=US".
|
|
|
422 </para></listitem>
|
|
|
423 </varlistentry>
|
|
|
424 <varlistentry>
|
|
|
425 <term>-c <replaceable class="parameter">class</replaceable></term>
|
|
|
426 <listitem><para>
|
|
|
427 Sets the objectClass values for the contact items. This class needs to be
|
|
|
428 defined in the schema used by your LDAP server, and at a minimum it must
|
|
|
429 contain the ldap attributes given below.
|
|
|
430 </para></listitem>
|
|
|
431 </varlistentry>
|
|
|
432 </variablelist>
|
|
|
433 </refsect1>
|
|
|
434
|
|
|
435 <refsect1 id='pst2ldif.description.1'>
|
|
|
436 <title>Description</title>
|
|
|
437 <para><command>pst2ldif</command>
|
|
|
438 reads the contact information from a MS Outlook .pst file
|
|
|
439 and produces a .ldif file that may be used to import those contacts
|
|
|
440 into an LDAP database. The following ldap attributes are generated:
|
|
|
441 <simplelist>
|
|
|
442 <member>cn </member>
|
|
|
443 <member>givenName </member>
|
|
|
444 <member>sn </member>
|
|
|
445 <member>personalTitle </member>
|
|
|
446 <member>company </member>
|
|
|
447 <member>mail </member>
|
|
|
448 <member>postalAddress </member>
|
|
|
449 <member>l </member>
|
|
|
450 <member>st </member>
|
|
|
451 <member>postalCode </member>
|
|
|
452 <member>c </member>
|
|
|
453 <member>homePhone </member>
|
|
|
454 <member>telephoneNumber </member>
|
|
|
455 <member>facsimileTelephoneNumber </member>
|
|
|
456 <member>mobile </member>
|
|
|
457 <member>description </member>
|
|
|
458 </simplelist>
|
|
|
459 </para>
|
|
|
460 </refsect1>
|
|
|
461
|
|
|
462 <refsect1 id='pst2ldif.copyright.1'>
|
|
|
463 <title>Copyright</title>
|
|
|
464 <para>
|
|
|
465 Copyright (C) 2006 by 510 Software Group <carl@five-ten-sg.com>
|
|
|
466 </para>
|
|
|
467 <para>
|
|
|
468 This program is free software; you can redistribute it and/or modify it
|
|
|
469 under the terms of the GNU General Public License as published by the
|
|
|
470 Free Software Foundation; either version 2, or (at your option) any
|
|
|
471 later version.
|
|
|
472 </para>
|
|
|
473 <para>
|
|
|
474 You should have received a copy of the GNU General Public License along
|
|
|
475 with this program; see the file COPYING. If not, please write to the
|
|
|
476 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
|
477 </para>
|
|
|
478 </refsect1>
|
|
|
479
|
|
|
480 <refsect1 id='pst2ldif.version.1'>
|
|
|
481 <title>CVS Version</title>
|
|
|
482 <para>
|
|
|
483 $Id$
|
|
|
484 </para>
|
|
|
485 </refsect1>
|
|
|
486 </refentry>
|
|
|
487
|
|
|
488
|
|
|
489 <refentry id="pst.5">
|
|
|
490 <refentryinfo>
|
|
31
|
491 <date>2007-07-10</date>
|
|
24
|
492 </refentryinfo>
|
|
|
493
|
|
|
494 <refmeta>
|
|
|
495 <refentrytitle>outlook.pst</refentrytitle>
|
|
|
496 <manvolnum>5</manvolnum>
|
|
|
497 </refmeta>
|
|
|
498
|
|
|
499 <refnamediv id='pst.name.1'>
|
|
|
500 <refname>outlook.pst</refname>
|
|
|
501 <refpurpose>format of MS Outlook .pst file</refpurpose>
|
|
|
502 </refnamediv>
|
|
|
503
|
|
|
504 <refsynopsisdiv id='pst.synopsis.1'>
|
|
|
505 <title>Synopsis</title>
|
|
|
506 <cmdsynopsis>
|
|
|
507 <command>outlook.pst</command>
|
|
|
508 </cmdsynopsis>
|
|
|
509 </refsynopsisdiv>
|
|
|
510
|
|
|
511 <refsect1 id='pst.file.overview.5'>
|
|
|
512 <title>Overview</title>
|
|
|
513 <para>
|
|
|
514 Each item in a .pst file is identified by two id values ID1 and ID2.
|
|
|
515 There are two separate b-trees indexed by these ID1 and ID2 values.
|
|
|
516 </para>
|
|
|
517 </refsect1>
|
|
|
518
|
|
|
519 <refsect1 id='pst.file.header.5'>
|
|
|
520 <title>File Header</title>
|
|
|
521 <para>
|
|
|
522 The file header is located at offset 0 in the .pst file.
|
|
|
523 </para>
|
|
|
524 <literallayout class="monospaced"><![CDATA[
|
|
|
525 0000 21 42 44 4e 49 f8 64 d9 53 4d 0e 00 13 00 01 01
|
|
|
526 0010 00 00 00 00 00 00 00 00 50 d6 03 00 bd 1e 02 00
|
|
|
527 0020 08 4c 00 00 00 04 00 00 00 04 00 00 0f 04 00 00
|
|
|
528 0030 0d 40 00 00 99 0a 01 00 18 04 00 00 0d 40 00 00
|
|
|
529 0040 0d 40 00 00 11 80 00 00 02 04 00 00 0a 04 00 00
|
|
|
530 0050 00 04 00 00 00 04 00 00 0f 04 00 00 0f 04 00 00
|
|
|
531 0060 0f 04 00 00 0d 40 00 00 00 04 00 00 00 04 00 00
|
|
|
532 0070 04 40 00 00 00 04 00 00 00 04 00 00 00 04 00 00
|
|
|
533 0080 00 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00
|
|
|
534 0090 00 04 00 00 00 04 00 00 00 04 00 00 00 04 00 00
|
|
|
535 00a0 0c 09 00 00 00 00 00 00 00 04 27 00 00 24 23 00
|
|
|
536 00b0 c0 09 0a 00 00 c8 00 00 bc 1e 02 00 00 7e 0c 00
|
|
|
537 00c0 b4 1e 02 00 00 54 00 00 01 00 00 00 23 55 44 d1
|
|
|
538 00d0 5a 4f ce 6b 80 ff ff ff 00 00 00 00 00 00 00 00
|
|
|
539 00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
540 00f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
541 0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
542 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
543 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
544 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
545 0140 00 00 00 00 00 00 00 00 00 00 00 00 3f ff ff ff
|
|
|
546 0150 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
547 0160 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
548 0170 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
549 0180 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
550 0190 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
551 01a0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
552 01b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
|
|
|
553 01c0 ff ff ff ff ff ff ff ff ff ff ff ff 80 01 00 00
|
|
|
554 01d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
555 01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
556 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
557
|
|
|
558 0000 signature [4 bytes] 0x4e444221 constant
|
|
28
|
559 000a indexType [1 byte] 0x0e constant
|
|
|
560 01cd encryptionType [1 byte] 0x01 constant
|
|
24
|
561 00a8 total file size [4 bytes] 0x270400 in this case
|
|
28
|
562 00c0 backPointer1 [4 bytes] 0x021eb4 in this case
|
|
|
563 00c4 offsetIndex1 [4 bytes] 0x005400 in this case
|
|
|
564 00b8 backPointer2 [4 bytes] 0x021ebc in this case
|
|
|
565 00bc offsetIndex2 [4 bytes] 0x0c7e00 in this case
|
|
24
|
566 ]]></literallayout>
|
|
|
567 <para>
|
|
|
568 We only support index type 0x0E and encryption type 0x01.
|
|
|
569 </para>
|
|
|
570 <para>
|
|
28
|
571 offsetIndex1 is the file offset of the root of the
|
|
24
|
572 index1 b-tree, which contains (ID1, offset, size, unknown) tuples
|
|
28
|
573 for each item in the file. backPointer1 is the value that should
|
|
24
|
574 appear in the parent pointer of that root node.
|
|
|
575 </para>
|
|
|
576 <para>
|
|
28
|
577 offsetIndex2 is the file offset of the root of the
|
|
24
|
578 index2 b-tree, which contains (ID2, DESC-ID1, LIST-ID1, PARENT-ID2)
|
|
28
|
579 tuples for each item in the file. backPointer2 is the value that should
|
|
24
|
580 appear in the parent pointer of that root node.
|
|
|
581 </para>
|
|
|
582 </refsect1>
|
|
|
583
|
|
|
584 <refsect1 id='pst.file.node1.5'>
|
|
|
585 <title>Index 1 Node</title>
|
|
|
586 <para>
|
|
|
587 The index1 b-tree nodes are 516 byte blocks with the following format.
|
|
|
588 </para>
|
|
|
589 <literallayout class="monospaced"><![CDATA[
|
|
|
590 0000 04 00 00 00 8a 1e 02 00 00 1c 0b 00
|
|
|
591 000c 58 27 03 00 b3 1e 02 00 00 52 00 00
|
|
|
592 0018 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
593 0024 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
594 0030 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
595 003c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
596 0048 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
597 0054 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
598 0060 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
599 006c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
600 0078 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
601 0084 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
602 0090 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
603 009c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
604 00a8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
605 00b4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
606 00c0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
607 00cc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
608 00d8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
609 00e4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
610 00f0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
611 00fc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
612 0108 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
613 0114 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
614 0120 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
615 012c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
616 0138 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
617 0144 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
618 0150 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
619 015c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
620 0168 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
621 0174 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
622 0180 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
623 018c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
624 0198 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
625 01a4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
626 01b0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
627 01bc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
628 01c8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
629 01d4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
630 01e0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
631 01ec 00 00 00 00 02 29 0c 02 80 80 b6 4a
|
|
|
632 01f8 b4 1e 02 00 27 9c cc 56 58 27 03 00
|
|
|
633
|
|
28
|
634 01f0 itemCount [1 byte] 0x02 in this case
|
|
|
635 01f1 maxItemCount [1 byte] 0x29 constant
|
|
|
636 01f3 nodeLevel [1 byte] 0x02 in this case
|
|
|
637 01f8 backPointer [4 bytes] 0x021eb4 in this case
|
|
24
|
638 ]]></literallayout>
|
|
|
639 <para>
|
|
28
|
640 The itemCount specifies the number of 12 byte records that
|
|
|
641 are active. The nodeLevel is non-zero for this style of nodes.
|
|
|
642 The leaf nodes have a different format. The backPointer must
|
|
|
643 match the backPointer from the triple that pointed to this node.
|
|
24
|
644 </para>
|
|
|
645 <para>
|
|
28
|
646 Each item in this node is a triple of (ID, backPointer, offset)
|
|
24
|
647 where the offset points to the next deeper node in the tree, the
|
|
28
|
648 backPointer value must match the backPointer in that deeper node,
|
|
24
|
649 and ID is the lowest ID value in the subtree.
|
|
|
650 </para>
|
|
|
651 </refsect1>
|
|
|
652
|
|
|
653 <refsect1 id='pst.file.leaf1.5'>
|
|
|
654 <title>Index 1 Leaf Node</title>
|
|
|
655 <para>
|
|
|
656 The index1 b-tree leaf nodes are 516 byte blocks with the following format.
|
|
|
657 </para>
|
|
|
658 <literallayout class="monospaced"><![CDATA[
|
|
|
659 0000 04 00 00 00 00 58 00 00 64 00 0f 00
|
|
|
660 000c 08 00 00 00 80 58 00 00 ac 00 06 00
|
|
|
661 0018 0c 00 00 00 40 59 00 00 ac 00 06 00
|
|
|
662 0024 10 00 00 00 00 5a 00 00 bc 00 03 00
|
|
|
663 0030 14 00 00 00 00 5b 00 00 a4 00 02 00
|
|
|
664 003c 18 00 00 00 c0 5b 00 00 64 00 02 00
|
|
|
665 0048 1c 00 00 00 40 5c 00 00 5c 00 02 00
|
|
|
666 0054 50 00 00 00 80 62 00 00 60 00 02 00
|
|
|
667 0060 74 00 00 00 00 77 00 00 5e 00 02 00
|
|
|
668 006c 7c 00 00 00 80 77 00 00 66 00 02 00
|
|
|
669 0078 84 00 00 00 00 76 00 00 ca 00 02 00
|
|
|
670 0084 88 00 00 00 00 63 00 00 52 00 02 00
|
|
|
671 0090 90 00 00 00 00 79 00 00 58 00 02 00
|
|
|
672 009c cc 00 00 00 c0 61 00 00 76 00 02 00
|
|
|
673 00a8 e0 00 00 00 00 61 00 00 74 00 02 00
|
|
|
674 00b4 f4 00 00 00 80 65 00 00 6e 00 02 00
|
|
|
675 00c0 8c 01 00 00 40 60 00 00 70 00 02 00
|
|
|
676 00cc ea 01 00 00 80 61 00 00 10 00 02 00
|
|
|
677 00d8 ec 01 00 00 40 8a 00 00 f3 01 02 00
|
|
|
678 00e4 f0 01 00 00 80 93 00 00 f4 1f 02 00
|
|
|
679 00f0 fa 01 00 00 c0 7f 00 00 10 00 02 00
|
|
|
680 00fc 00 02 00 00 00 89 00 00 34 01 02 00
|
|
|
681 0108 1c 02 00 00 40 ec 00 00 12 06 02 00
|
|
|
682 0114 22 02 00 00 00 84 00 00 10 00 02 00
|
|
|
683 0120 24 02 00 00 c0 ea 00 00 3c 01 02 00
|
|
|
684 012c 40 02 00 00 00 f4 00 00 0a 06 02 00
|
|
|
685 0138 46 02 00 00 40 8c 00 00 10 00 02 00
|
|
|
686 0144 48 02 00 00 80 f2 00 00 36 01 02 00
|
|
|
687 0150 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
|
688 015c 6a 02 00 00 80 63 00 00 10 00 02 00
|
|
|
689 0168 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
|
690 0174 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
|
691 0180 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
|
692 018c 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
|
693 0198 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
|
694 01a4 6c 02 00 00 40 fa 00 00 2a 01 02 00
|
|
|
695 01b0 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
|
696 01bc 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
|
697 01c8 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
|
698 01d4 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
|
699 01e0 64 02 00 00 80 fb 00 00 bf 07 02 00
|
|
|
700 01ec 00 00 00 00 1f 29 0c 00 80 80 5b b3
|
|
|
701 01f8 5a 67 01 00 4f ae 70 a7 92 06 00 00
|
|
|
702
|
|
28
|
703 01f0 itemCount [1 byte] 0x1f in this case
|
|
|
704 01f1 maxItemCount [1 byte] 0x29 constant
|
|
|
705 01f3 nodeLevel [1 byte] 0x00 in this case
|
|
|
706 01f8 backPointer [4 bytes] 0x01675a in this case
|
|
24
|
707 ]]></literallayout>
|
|
|
708 <para>
|
|
28
|
709 The itemCount specifies the number of 12 byte records that
|
|
|
710 are active. The nodeLevel is zero for these leaf nodes.
|
|
|
711 The backPointer must match the backPointer from the triple
|
|
24
|
712 that pointed to this node.
|
|
|
713 </para>
|
|
|
714 <para>
|
|
|
715 Each item in this node is a tuple of (ID1, offset, size, unknown)
|
|
|
716 </para>
|
|
|
717 </refsect1>
|
|
|
718
|
|
|
719 <refsect1 id='pst.file.node2.5'>
|
|
|
720 <title>Index 2 Node</title>
|
|
|
721 <para>
|
|
|
722 The index2 b-tree nodes are 516 byte blocks with the following format.
|
|
|
723 </para>
|
|
|
724 <literallayout class="monospaced"><![CDATA[
|
|
|
725 0000 21 00 00 00 bb 1e 02 00 00 e2 0b 00
|
|
|
726 000c 64 78 20 00 8c 1e 02 00 00 dc 0b 00
|
|
|
727 0018 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
728 0024 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
729 0030 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
730 003c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
731 0048 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
732 0054 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
733 0060 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
734 006c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
735 0078 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
736 0084 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
737 0090 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
738 009c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
739 00a8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
740 00b4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
741 00c0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
742 00cc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
743 00d8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
744 00e4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
745 00f0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
746 00fc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
747 0108 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
748 0114 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
749 0120 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
750 012c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
751 0138 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
752 0144 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
753 0150 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
754 015c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
755 0168 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
756 0174 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
757 0180 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
758 018c 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
759 0198 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
760 01a4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
761 01b0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
762 01bc 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
763 01c8 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
764 01d4 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
765 01e0 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
766 01ec 00 00 00 00 02 29 0c 02 81 81 b2 60
|
|
|
767 01f8 bc 1e 02 00 7e 70 dc e3 21 00 00 00
|
|
|
768
|
|
28
|
769 01f0 itemCount [1 byte] 0x02 in this case
|
|
|
770 01f1 maxItemCount [1 byte] 0x29 constant
|
|
|
771 01f3 nodeLevel [1 byte] 0x02 in this case
|
|
|
772 01f8 backPointer [4 bytes] 0x021ebc in this case
|
|
24
|
773 ]]></literallayout>
|
|
|
774 <para>
|
|
28
|
775 The itemCount specifies the number of 12 byte records that
|
|
|
776 are active. The nodeLevel is non-zero for this style of nodes.
|
|
|
777 The leaf nodes have a different format. The backPointer must
|
|
|
778 match the backPointer from the triple that pointed to this node.
|
|
24
|
779 </para>
|
|
|
780 <para>
|
|
28
|
781 Each item in this node is a triple of (ID2, backPointer, offset)
|
|
24
|
782 where the offset points to the next deeper node in the tree, the
|
|
28
|
783 backPointer value must match the backPointer in that deeper node,
|
|
24
|
784 and ID2 is the lowest ID2 value in the subtree.
|
|
|
785 </para>
|
|
|
786 </refsect1>
|
|
|
787
|
|
|
788 <refsect1 id='pst.file.leaf2.5'>
|
|
|
789 <title>Index 2 Leaf Node</title>
|
|
|
790 <para>
|
|
|
791 The index2 b-tree leaf nodes are 516 byte blocks with the following format.
|
|
|
792 </para>
|
|
|
793 <literallayout class="monospaced"><![CDATA[
|
|
|
794 0000 21 00 00 00 38 e6 00 00 00 00 00 00 00 00 00 00
|
|
|
795 0010 61 00 00 00 2c a8 02 00 36 a8 02 00 00 00 00 00
|
|
|
796 0020 22 01 00 00 20 a2 02 00 00 00 00 00 22 01 00 00
|
|
|
797 0030 2d 01 00 00 88 7b 03 00 00 00 00 00 00 00 00 00
|
|
|
798 0040 2e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00
|
|
|
799 0050 2f 01 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
|
|
|
800 0060 e1 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
801 0070 01 02 00 00 b4 e4 02 00 00 00 00 00 00 00 00 00
|
|
|
802 0080 61 02 00 00 a0 e4 02 00 00 00 00 00 00 00 00 00
|
|
|
803 0090 0d 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00
|
|
|
804 00A0 0e 06 00 00 08 00 00 00 00 00 00 00 00 00 00 00
|
|
|
805 00B0 0f 06 00 00 0c 00 00 00 00 00 00 00 00 00 00 00
|
|
|
806 00C0 10 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00
|
|
|
807 00D0 2b 06 00 00 84 00 00 00 00 00 00 00 00 00 00 00
|
|
|
808 00E0 4c 06 00 00 1c 00 00 00 00 00 00 00 00 00 00 00
|
|
|
809 00F0 71 06 00 00 18 00 00 00 00 00 00 00 00 00 00 00
|
|
|
810 0100 92 06 00 00 14 00 00 00 00 00 00 00 00 00 00 00
|
|
|
811 0110 23 22 00 00 14 a0 02 00 00 00 00 00 22 01 00 00
|
|
|
812 0120 26 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
813 0130 27 22 00 00 1c a0 02 00 00 00 00 00 00 00 00 00
|
|
|
814 0140 22 80 00 00 50 00 00 00 00 00 00 00 22 01 00 00
|
|
|
815 0150 2d 80 00 00 f8 9f 02 00 00 00 00 00 00 00 00 00
|
|
|
816 0160 2e 80 00 00 08 00 00 00 00 00 00 00 00 00 00 00
|
|
|
817 0170 2f 80 00 00 34 e6 00 00 00 00 00 00 00 00 00 00
|
|
|
818 0180 42 80 00 00 3c 6d 02 00 00 00 00 00 22 80 00 00
|
|
|
819 0190 4d 80 00 00 04 00 00 00 00 00 00 00 00 00 00 00
|
|
|
820 01A0 4e 80 00 00 10 6d 02 00 00 00 00 00 00 00 00 00
|
|
|
821 01B0 4f 80 00 00 ec 23 00 00 00 00 00 00 00 00 00 00
|
|
|
822 01C0 62 80 00 00 38 78 02 00 00 00 00 00 22 01 00 00
|
|
|
823 01D0 6d 80 00 00 34 78 02 00 00 00 00 00 00 00 00 00
|
|
|
824 01E0 6e 80 00 00 08 00 00 00 00 00 00 00 00 00 00 00
|
|
|
825 01F0 10 1f 10 00 81 81 a0 9a ae 1e 02 00 89 44 6a 0f
|
|
|
826 0200 b8 b1 03 00
|
|
|
827
|
|
28
|
828 01f0 itemCount [1 byte] 0x10 in this case
|
|
|
829 01f1 maxItemCount [1 byte] 0x1f constant
|
|
|
830 01f3 nodeLevel [1 byte] 0x00 in this case
|
|
|
831 01f8 backPointer [4 bytes] 0x021eae in this case
|
|
24
|
832 ]]></literallayout>
|
|
|
833 <para>
|
|
28
|
834 The itemCount specifies the number of 16 byte records that
|
|
|
835 are active. The nodeLevel is zero for these leaf nodes.
|
|
|
836 The backPointer must match the backPointer from the triple
|
|
24
|
837 that pointed to this node.
|
|
|
838 </para>
|
|
|
839 <para>
|
|
|
840 Each item in this node is a tuple of (ID2, DESC-ID1, LIST-ID1, PARENT-ID2)
|
|
|
841 </para>
|
|
|
842 </refsect1>
|
|
|
843
|
|
|
844 <refsect1 id='pst.file.list.5'>
|
|
|
845 <title>Associated List Item</title>
|
|
|
846 <para>
|
|
|
847 Contains associations between id1 and id2 for the items controlled by the record.
|
|
|
848 In the above leaf node, we have a tuple of (0x61, 0x02a82c, 0x02a836, 0)
|
|
|
849 0x02a836 is the ID1 of the associated list, and we can lookup that ID1 value
|
|
|
850 in the index1 b-tree to find the (offset,size) of the data in the .pst file.
|
|
|
851 </para>
|
|
|
852 <literallayout class="monospaced"><![CDATA[
|
|
|
853 0000 02 00 01 00 9f 81 00 00 30 a8 02 00 00 00 00 00
|
|
|
854
|
|
|
855 0000 unknown [2 bytes] 0x0002 constant
|
|
|
856 0002 count [2 bytes] 0x0001 in this case
|
|
|
857 repeating
|
|
|
858 0004 id2 [4 bytes] 0x00819f in this case
|
|
|
859 0008 id [4 bytes] 0x02a830 in this case
|
|
|
860 000c unknown [4 bytes] 0 in this case
|
|
|
861 ]]></literallayout>
|
|
|
862 </refsect1>
|
|
|
863
|
|
|
864 <refsect1 id='pst.file.desc.5'>
|
|
28
|
865 <title>Associated Descriptor Item 0xbcec</title>
|
|
24
|
866 <para>
|
|
28
|
867 Contains information about the item, which may be email, contact, or
|
|
|
868 other outlook types. In the above leaf node, we have a tuple of (0x21,
|
|
|
869 0x00e638, 0, 0) 0x00e638 is the ID1 of the associated descriptor, and we
|
|
|
870 can lookup that ID1 value in the index1 b-tree to find the (offset,size)
|
|
|
871 of the data in the .pst file.
|
|
24
|
872 </para>
|
|
|
873 <literallayout class="monospaced"><![CDATA[
|
|
|
874 0000 3c 01 ec bc 20 00 00 00 00 00 00 00 b5 02 06 00
|
|
|
875 0010 40 00 00 00 f9 0f 02 01 60 00 00 00 01 30 1e 00
|
|
|
876 0020 80 00 00 00 04 30 1e 00 00 00 00 00 df 35 03 00
|
|
|
877 0030 ff 00 00 00 e0 35 02 01 a0 00 00 00 e2 35 02 01
|
|
|
878 0040 e0 00 00 00 e3 35 02 01 c0 00 00 00 e4 35 02 01
|
|
|
879 0050 00 01 00 00 e5 35 02 01 20 01 00 00 e6 35 02 01
|
|
|
880 0060 40 01 00 00 e7 35 02 01 60 01 00 00 1e 66 0b 00
|
|
|
881 0070 00 00 00 00 ff 67 03 00 00 00 00 00 d2 7f 17 d8
|
|
|
882 0080 64 8c d5 11 83 24 00 50 04 86 95 45 53 74 61 6e
|
|
|
883 0090 6c 65 79 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
|
|
|
884 00A0 24 00 50 04 86 95 45 22 80 00 00 00 00 00 00 d2
|
|
|
885 00B0 7f 17 d8 64 8c d5 11 83 24 00 50 04 86 95 45 42
|
|
|
886 00C0 80 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
|
|
|
887 00D0 24 00 50 04 86 95 45 a2 80 00 00 00 00 00 00 d2
|
|
|
888 00E0 7f 17 d8 64 8c d5 11 83 24 00 50 04 86 95 45 c2
|
|
|
889 00F0 80 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
|
|
|
890 0100 24 00 50 04 86 95 45 e2 80 00 00 00 00 00 00 d2
|
|
|
891 0110 7f 17 d8 64 8c d5 11 83 24 00 50 04 86 95 45 02
|
|
|
892 0120 81 00 00 00 00 00 00 d2 7f 17 d8 64 8c d5 11 83
|
|
|
893 0130 24 00 50 04 86 95 45 62 80 00 00 00 0b 00 00 00
|
|
|
894 0140 0c 00 14 00 7c 00 8c 00 93 00 ab 00 c3 00 db 00
|
|
|
895 0150 f3 00 0b 01 23 01 3b 01
|
|
|
896
|
|
28
|
897 0000 indexOffset [2 bytes] 0x013c in this case
|
|
24
|
898 0002 signature [2 bytes] 0xbcec constant
|
|
|
899 0004 offset [2 bytes] 0x0020 in this case
|
|
|
900 ]]></literallayout>
|
|
|
901 <para>
|
|
28
|
902 Note the signature of 0xbcec. There are other descriptor block
|
|
|
903 formats with other signatures.
|
|
|
904 Note the indexOffset of 0x013c - starting at that position in the
|
|
24
|
905 descriptor block, we have an array of two byte integers. The first
|
|
28
|
906 integer (0x000b) is a (count-1) of the number of overlapping pairs
|
|
24
|
907 following the count. The first pair is (0, 0xc), the next pair is (0xc, 0x14)
|
|
28
|
908 and the last (12th) pair is (0x123, 0x13b). These pairs are (start,end+1)
|
|
|
909 offsets of items in this block. So we have count+2 integers following
|
|
24
|
910 the count value.
|
|
|
911 </para>
|
|
|
912 <para>
|
|
|
913 Note the offset of 0x0020, which needs to be right shifted by 4 bits
|
|
|
914 to become 0x0002, which is then a byte offset to be added to the above
|
|
28
|
915 indexOffset plus two (to skip the count), so it points to the (0xc, 0x14)
|
|
24
|
916 pair. Finally, we have the offset and size of the "b5" block located at offset 0xc
|
|
|
917 with a size of 8 bytes in this descriptor block. The "b5" block has the
|
|
|
918 following format:
|
|
|
919 </para>
|
|
|
920 <literallayout class="monospaced"><![CDATA[
|
|
|
921 0000 signature [2 bytes] 0x02b5 constant
|
|
|
922 0002 unknown [2 bytes] 0x0006 in this case
|
|
|
923 0004 offset [4 bytes] 0x0040 in this case
|
|
|
924 ]]></literallayout>
|
|
|
925 <para>
|
|
|
926 Note the "b5" offset of 0x0040, which needs to be right shifted by 4 bits
|
|
|
927 to become 0x0004, which is then a byte offset to be added to the above
|
|
28
|
928 indexOffset plus two (to skip the count), so it points to the (0x14, 0x7c)
|
|
24
|
929 pair. We now have the offset 0x14 of the descriptor array, composed of 8 byte
|
|
|
930 entries. Each descriptor entry has the following format:
|
|
|
931 </para>
|
|
|
932 <literallayout class="monospaced"><![CDATA[
|
|
28
|
933 0000 itemType [2 bytes]
|
|
|
934 0002 referenceType [2 bytes]
|
|
24
|
935 0004 value [4 bytes]
|
|
|
936 ]]></literallayout>
|
|
|
937 <para>
|
|
|
938 For some reference types (2, 3, 0xb) the value is used directly. Otherwise,
|
|
|
939 the value is generally a non-zero offset, to be right shifted by 4 bits and used to fetch
|
|
|
940 a pair from the index table to find the offset and size of the item in this
|
|
|
941 descriptor block. However, if (value AND 0xf) == 0xf, then the value is an ID2 index.
|
|
|
942 </para>
|
|
|
943 <para>
|
|
|
944 The following reference types are known, but not all of these
|
|
|
945 are implemented in the code yet.
|
|
|
946 </para>
|
|
|
947 <literallayout class="monospaced"><![CDATA[
|
|
|
948 0x0002 - Signed 16bit value
|
|
|
949 0x0003 - Signed 32bit value
|
|
|
950 0x0004 - 4-byte floating point
|
|
|
951 0x0005 - Floating point double
|
|
|
952 0x0006 - Signed 64-bit int
|
|
|
953 0x0007 - Application Time
|
|
|
954 0x000A - 32-bit error value
|
|
|
955 0x000B - Boolean (non-zero = true)
|
|
|
956 0x000D - Embedded Object
|
|
|
957 0x0014 - 8-byte signed integer (64-bit)
|
|
|
958 0x001E - Null terminated String
|
|
|
959 0x001F - Unicode string
|
|
|
960 0x0040 - Systime - Filetime structure
|
|
|
961 0x0048 - OLE Guid
|
|
|
962 0x0102 - Binary data
|
|
|
963 0x1003 - Array of 32bit values
|
|
|
964 0x1014 - Array of 64bit values
|
|
|
965 0x101E - Array of Strings
|
|
|
966 0x1102 - Array of Binary data
|
|
|
967 ]]></literallayout>
|
|
|
968 <para>
|
|
|
969 The following item types are known, but not all of these
|
|
|
970 are implemented in the code yet.
|
|
|
971 Note: it appears that some types can have a IPOS value or a ID2 value
|
|
|
972 depending on the size of the field in question. It is safer to check
|
|
|
973 every field than for me to say what the "usually" contain. Absolute
|
|
|
974 values though, are generally going to be constant.
|
|
|
975 </para>
|
|
|
976 <literallayout class="monospaced"><![CDATA[
|
|
|
977 0002 AutoForward allowed
|
|
|
978 0003 Extended Attributes Table
|
|
|
979 0017 Importance Level
|
|
|
980 001a IPM Context. What type of message is this
|
|
|
981 0023 Global Delivery Report
|
|
|
982 0026 Priority
|
|
|
983 0029 Read Receipt
|
|
|
984 002b Reassignment Prohibited
|
|
|
985 002e Original Sensitivity
|
|
|
986 0036 Sensitivity
|
|
|
987 0037 Email Subject. The referenced item is of type "Subject Type"
|
|
|
988 0039 Date. This is likely to be the arrival date
|
|
|
989 003b Outlook Address of Sender
|
|
|
990 003f Outlook structure describing the recipient
|
|
|
991 0040 Name of the Outlook recipient structure
|
|
|
992 0041 Outlook structure describing the sender
|
|
|
993 0042 Name of the Outlook sender structure
|
|
|
994 0043 Another structure describing the recipient
|
|
|
995 0044 Name of the second recipient structure
|
|
|
996 004f Reply-To Outlook Structure
|
|
|
997 0050 Name of the Reply-To structure
|
|
|
998 0051 Outlook Name of recipient
|
|
|
999 0052 Second Outlook name of recipient
|
|
|
1000 0057 My address in TO field
|
|
|
1001 0058 My address in CC field
|
|
|
1002 0059 Message addressed to me
|
|
|
1003 0063 Response requested
|
|
|
1004 0064 Sender's Address access method (SMTP, EX)
|
|
|
1005 0065 Sender's Address
|
|
|
1006 0070 Processed Subject (with Fwd:, Re, ... removed)
|
|
|
1007 0071 Date. Another date
|
|
|
1008 0075 Recipient Address Access Method (SMTP, EX)
|
|
|
1009 0076 Recipient's Address
|
|
|
1010 0077 Second Recipient Access Method (SMTP, EX)
|
|
|
1011 0078 Second Recipient Address
|
|
|
1012 007d Email Header. This is the header that was attached to the email
|
|
|
1013 0c17 Reply Requested
|
|
|
1014 0c19 Second sender struct
|
|
|
1015 0c1a Name of second sender struct
|
|
|
1016 0c1d Second outlook name of sender
|
|
|
1017 0c1e Second sender access method (SMTP, EX)
|
|
|
1018 0c1f Second Sender Address
|
|
|
1019 0e01 Delete after submit
|
|
|
1020 0e03 CC Address?
|
|
|
1021 0e04 SentTo Address
|
|
|
1022 0e06 Date.
|
|
|
1023 0e07 Flag - contains IsSeen value
|
|
|
1024 0e08 Message Size
|
|
|
1025 0e0a Sentmail EntryID
|
|
|
1026 0e1f Compressed RTF in Sync
|
|
|
1027 0e20 Attachment Size
|
|
|
1028 0ff9 binary record header
|
|
|
1029 1000 Plain Text Email Body. Does not exist if the email doesn't have a plain text version
|
|
|
1030 1006 RTF Sync Body CRC
|
|
|
1031 1007 RTF Sync Body character count
|
|
|
1032 1008 RTF Sync body tag
|
|
|
1033 1009 RTF Compressed body
|
|
|
1034 1010 RTF whitespace prefix count
|
|
|
1035 1011 RTF whitespace tailing count
|
|
|
1036 1013 HTML Email Body. Does not exist if the email doesn't have a HTML version
|
|
|
1037 1035 Message ID
|
|
|
1038 1042 In-Reply-To or Parent's Message ID
|
|
|
1039 1046 Return Path
|
|
|
1040 3001 Folder Name? I have seen this value used for the contacts record aswell
|
|
|
1041 3002 Address Type
|
|
|
1042 3003 Contact Address
|
|
|
1043 3004 Comment
|
|
|
1044 3007 Date item creation
|
|
|
1045 3008 Date item modification
|
|
|
1046 300b binary record header
|
|
|
1047 35df Valid Folder Mask
|
|
|
1048 35e0 binary record found in first item. Contains the reference to "Top of Personal Folder" item
|
|
|
1049 35e3 binary record with a reference to "Deleted Items" item
|
|
|
1050 35e7 binary record with a refernece to "Search Root" item
|
|
|
1051 3602 the number of emails stored in a folder
|
|
|
1052 3603 the number of unread emails in a folder
|
|
|
1053 360a Has Subfolders
|
|
|
1054 3613 the folder content description
|
|
|
1055 3617 Associate Content count
|
|
|
1056 3701 Binary Data attachment
|
|
|
1057 3704 Attachment Filename
|
|
|
1058 3705 Attachement method
|
|
|
1059 3707 Attachment Filename long
|
|
|
1060 370b Attachment Position
|
|
|
1061 370e Attachment mime encoding
|
|
|
1062 3710 Attachment Mime Sequence
|
|
|
1063 3a00 Contact's Account name
|
|
|
1064 3a01 Contact Alternate Recipient
|
|
|
1065 3a02 Callback telephone number
|
|
|
1066 3a03 Message Conversion Prohibited
|
|
|
1067 3a05 Contacts Suffix
|
|
|
1068 3a06 Contacts First Name
|
|
|
1069 3a07 Contacts Government ID Number
|
|
|
1070 3a08 Business Telephone Number
|
|
|
1071 3a09 Home Telephone Number
|
|
|
1072 3a0a Contacts Initials
|
|
|
1073 3a0b Keyword
|
|
|
1074 3a0c Contact's Language
|
|
|
1075 3a0d Contact's Location
|
|
|
1076 3a0e Mail Permission
|
|
|
1077 3a0f MHS Common Name
|
|
|
1078 3a10 Organizational ID #
|
|
|
1079 3a11 Contacts Surname
|
|
|
1080 3a12 original entry id
|
|
|
1081 3a13 original display name
|
|
|
1082 3a14 original search key
|
|
|
1083 3a15 Default Postal Address
|
|
|
1084 3a16 Company Name
|
|
|
1085 3a17 Job Title
|
|
|
1086 3a18 Department Name
|
|
|
1087 3a19 Office Location
|
|
|
1088 3a1a Primary Telephone
|
|
|
1089 3a1b Business Phone Number 2
|
|
|
1090 3a1c Mobile Phone Number
|
|
|
1091 3a1d Radio Phone Number
|
|
|
1092 3a1e Car Phone Number
|
|
|
1093 3a1f Other Phone Number
|
|
|
1094 3a20 Transmittable Display Name
|
|
|
1095 3a21 Pager Phone Number
|
|
|
1096 3a22 user certificate
|
|
|
1097 3a23 Primary Fax Number
|
|
|
1098 3a24 Business Fax Number
|
|
|
1099 3a25 Home Fax Number
|
|
|
1100 3a26 Business Address Country
|
|
|
1101 3a27 Business Address City
|
|
|
1102 3a28 Business Address State
|
|
|
1103 3a29 Business Address Street
|
|
|
1104 3a2a Business Postal Code
|
|
|
1105 3a2b Business PO Box
|
|
|
1106 3a2c Telex Number
|
|
|
1107 3a2d ISDN Number
|
|
|
1108 3a2e Assistant Phone Number
|
|
|
1109 3a2f Home Phone 2
|
|
|
1110 3a30 Assistant's Name
|
|
|
1111 3a40 Can receive Rich Text
|
|
|
1112 3a41 Wedding Anniversary
|
|
|
1113 3a42 Birthday
|
|
|
1114 3a43 Hobbies
|
|
|
1115 3a44 Middle Name
|
|
|
1116 3a45 Display Name Prefix (Title)
|
|
|
1117 3a46 Profession
|
|
|
1118 3a47 Preferred By Name
|
|
|
1119 3a48 Spouse's Name
|
|
|
1120 3a49 Computer Network Name
|
|
|
1121 3a4a Customer ID
|
|
|
1122 3a4b TTY/TDD Phone
|
|
|
1123 3a4c Ftp Site
|
|
|
1124 3a4d Gender
|
|
|
1125 3a4e Manager's Name
|
|
|
1126 3a4f Nickname
|
|
|
1127 3a50 Personal Home Page
|
|
|
1128 3a51 Business Home Page
|
|
|
1129 3a57 Company Main Phone
|
|
|
1130 3a58 childrens names
|
|
|
1131 3a59 Home Address City
|
|
|
1132 3a5a Home Address Country
|
|
|
1133 3a5b Home Address Postal Code
|
|
|
1134 3a5c Home Address State or Province
|
|
|
1135 3a5d Home Address Street
|
|
|
1136 3a5e Home Address Post Office Box
|
|
|
1137 3a5f Other Address City
|
|
|
1138 3a60 Other Address Country
|
|
|
1139 3a61 Other Address Postal Code
|
|
|
1140 3a62 Other Address State
|
|
|
1141 3a63 Other Address Street
|
|
|
1142 3a64 Other Address Post Office box
|
|
|
1143 65e3 Entry ID
|
|
|
1144 67f2 Attachment ID2 value
|
|
|
1145 67ff Password checksum [0x67FF]
|
|
|
1146 6f02 Secure HTML Body
|
|
|
1147 6f04 Secure Text Body
|
|
|
1148 7c07 Top of folders RecID [0x7c07]
|
|
|
1149 8000 Contain extra bits of information that have been taken from the email's header. I call them extra lines
|
|
|
1150 8005 Contact Fullname
|
|
|
1151 801a Home Address
|
|
|
1152 801b Business Address
|
|
|
1153 801c Other Address
|
|
|
1154 8082 Email Address 1 Transport
|
|
|
1155 8083 Email Address 1 Address
|
|
|
1156 8084 Email Address 1 Description
|
|
|
1157 8085 Email Address 1 Record
|
|
|
1158 8092 Email Address 2 Transport
|
|
|
1159 8093 Email Address 2 Address
|
|
|
1160 8094 DEBUG_EMAIL (("Email Address 2 Description
|
|
|
1161 8095 Email Address 2 Record
|
|
|
1162 80a2 DEBUG_EMAIL (("Email Address 3 Transport
|
|
|
1163 80a3 Email Address 3 Address
|
|
|
1164 80a4 Email Address 3 Description
|
|
|
1165 80a5 Email Address 3 Record
|
|
|
1166 80d8 Internet Free/Busy
|
|
|
1167 8205 Appointment shows as
|
|
|
1168 8208 Appointment Location
|
|
|
1169 8214 Label for appointment
|
|
32
|
1170 8215 All day appointment flag
|
|
24
|
1171 8234 TimeZone of times
|
|
|
1172 8235 Appointment Start Time
|
|
|
1173 8236 Appointment End Time
|
|
|
1174 8516 Duplicate Time Start
|
|
|
1175 8517 Duplicate Time End
|
|
|
1176 8530 Followup String
|
|
|
1177 8534 Mileage
|
|
|
1178 8535 Billing Information
|
|
|
1179 8554 Outlook Version
|
|
|
1180 8560 Appointment Reminder Time
|
|
|
1181 8700 Journal Entry Type
|
|
|
1182 8706 Start Timestamp
|
|
|
1183 8708 End Timestamp
|
|
|
1184 8712 Journal Entry Type
|
|
|
1185 ]]></literallayout>
|
|
|
1186 </refsect1>
|
|
|
1187
|
|
28
|
1188 <refsect1 id='pst.file.desc2.5'>
|
|
|
1189 <title>Associated Descriptor Item 0x7cec</title>
|
|
|
1190 <para>
|
|
|
1191 This style of descriptor block is similar to the BCEC format.
|
|
|
1192 </para>
|
|
|
1193 <literallayout class="monospaced"><![CDATA[
|
|
|
1194 0000 7a 01 ec 7c 40 00 00 00 00 00 00 00 b5 04 02 00
|
|
|
1195 0010 60 00 00 00 7c 18 60 00 60 00 62 00 65 00 20 00
|
|
|
1196 0020 00 00 80 00 00 00 00 00 00 00 03 00 20 0e 0c 00
|
|
|
1197 0030 04 03 1e 00 01 30 2c 00 04 0b 1e 00 03 37 28 00
|
|
|
1198 0040 04 0a 1e 00 04 37 14 00 04 05 03 00 05 37 10 00
|
|
|
1199 0050 04 04 1e 00 07 37 24 00 04 09 1e 00 08 37 20 00
|
|
|
1200 0060 04 08 02 01 0a 37 18 00 04 06 03 00 0b 37 08 00
|
|
|
1201 0070 04 02 1e 00 0d 37 1c 00 04 07 1e 00 0e 37 40 00
|
|
|
1202 0080 04 10 02 01 0f 37 30 00 04 0c 1e 00 11 37 34 00
|
|
|
1203 0090 04 0d 1e 00 12 37 3c 00 04 0f 1e 00 13 37 38 00
|
|
|
1204 00A0 04 0e 03 00 f2 67 00 00 04 00 03 00 f3 67 04 00
|
|
|
1205 00B0 04 01 03 00 09 69 44 00 04 11 03 00 fa 7f 5c 00
|
|
|
1206 00C0 04 15 40 00 fb 7f 4c 00 08 13 40 00 fc 7f 54 00
|
|
|
1207 00D0 08 14 03 00 fd 7f 48 00 04 12 0b 00 fe 7f 60 00
|
|
|
1208 00E0 01 16 0b 00 ff 7f 61 00 01 17 45 82 00 00 00 00
|
|
|
1209 00F0 45 82 00 00 78 3c 00 00 ff ff ff ff 49 1e 00 00
|
|
|
1210 0100 06 00 00 00 00 00 00 00 a0 00 00 00 00 00 00 00
|
|
|
1211 0110 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00
|
|
|
1212 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
1213 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 40 dd a3
|
|
|
1214 0140 57 45 b3 0c 00 40 dd a3 57 45 b3 0c 02 00 00 00
|
|
|
1215 0150 00 00 fa 10 3e 2a 86 48 86 f7 14 03 0a 03 02 01
|
|
|
1216 0160 4a 2e 20 44 61 76 69 64 20 4b 61 72 61 6d 27 73
|
|
|
1217 0170 20 42 69 72 74 68 64 61 79 00 06 00 00 00 0c 00
|
|
|
1218 0180 14 00 ea 00 f0 00 55 01 60 01 79 01
|
|
|
1219
|
|
|
1220 0000 indexOffset [2 bytes] 0x017a in this case
|
|
|
1221 0002 signature [2 bytes] 0x7cec constant
|
|
|
1222 0004 offset [2 bytes] 0x0040 in this case
|
|
|
1223 ]]></literallayout>
|
|
|
1224 <para>
|
|
|
1225 Note the signature of 0x7cec. There are other descriptor block
|
|
|
1226 formats with other signatures.
|
|
|
1227 Note the indexOffset of 0x017a - starting at that position in the
|
|
|
1228 descriptor block, we have an array of two byte integers. The first
|
|
|
1229 integer (0x0006) is a (count-1) of the number of overlapping pairs
|
|
|
1230 following the count. The first pair is (0, 0xc), the next pair is (0xc, 0x14)
|
|
|
1231 and the last (7th) pair is (0x160, 0x179). These pairs are (start,end+1)
|
|
|
1232 offsets of items in this block. So we have count+2 integers following
|
|
|
1233 the count value.
|
|
|
1234 </para>
|
|
|
1235 <para>
|
|
|
1236 Note the offset of 0x0040, which needs to be right shifted by 4 bits
|
|
|
1237 to become 0x0004, which is then a byte offset to be added to the above
|
|
|
1238 indexOffset plus two (to skip the count), so it points to the (0x14, 0xea)
|
|
|
1239 pair. We have the offset and size of the "7c" block located at offset 0x14
|
|
|
1240 with a size of 214 bytes in this case. The "7c" block starts with
|
|
|
1241 a header with the following format:
|
|
|
1242 </para>
|
|
|
1243 <literallayout class="monospaced"><![CDATA[
|
|
|
1244 0000 signature [1 bytes] 0x7c constant
|
|
|
1245 0001 itemCount [1 bytes] 0x18 in this case
|
|
|
1246 0002 unknown [2 bytes] 0x0060 in this case
|
|
|
1247 0004 unknown [2 bytes] 0x0060 in this case
|
|
|
1248 0006 unknown [2 bytes] 0x0062 in this case
|
|
|
1249 0008 recordSize [2 bytes] 0x0065 in this case
|
|
|
1250 000a b5Offset [2 bytes] 0x0020 in this case
|
|
|
1251 000c unknown [2 bytes] 0x0000 in this case
|
|
|
1252 000e index2Offset [2 bytes] 0x0080 in this case
|
|
|
1253 0010 unknown [2 bytes] 0x0000 in this case
|
|
|
1254 0012 unknown [2 bytes] 0x0000 in this case
|
|
|
1255 0014 unknown [2 bytes] 0x0000 in this case
|
|
|
1256 ]]></literallayout>
|
|
|
1257 <para>
|
|
|
1258 Note the b5Offset of 0x0020, which needs to be right shifted by 4 bits
|
|
|
1259 to become 0x0002, which is then a byte offset to be added to the above
|
|
|
1260 indexOffset plus two (to skip the count), so it points to the (0xc,
|
|
|
1261 0x14) pair. Finally, we have the offset and size of the "b5" block
|
|
|
1262 located at offset 0xc with a size of 8 bytes in this descriptor block.
|
|
|
1263 The "b5" block has the following format:
|
|
|
1264 </para>
|
|
|
1265 <literallayout class="monospaced"><![CDATA[
|
|
|
1266 0000 signature [2 bytes] 0x04b5 constant
|
|
|
1267 0002 unknown [2 bytes] 0x0002 in this case
|
|
|
1268 0004 offset [4 bytes] 0x0060 in this case
|
|
|
1269 ]]></literallayout>
|
|
|
1270 <para>
|
|
|
1271 Note the "b5" offset of 0x0060, which needs to be right shifted by 4
|
|
|
1272 bits to become 0x0006, which is then a byte offset to be added to the
|
|
|
1273 above indexOffset plus two (to skip the count), so it points to the
|
|
|
1274 (0xea, 0xf0) pair. That gives us (0xf0 - 0xea)/6 = 1, so we have a
|
|
|
1275 recordCount of one. The actual data between 0xea and 0xf0 is unknown
|
|
|
1276 and unused here.
|
|
|
1277 </para>
|
|
|
1278 <para>
|
|
|
1279 Note the index2Offset above of 0x0080, which needs to be right shifted
|
|
|
1280 by 4 bits to become 0x0008, which is then a byte offset to be added to
|
|
|
1281 the above indexOffset plus two (to skip the count), so it points to the
|
|
|
1282 (0xf0, 0x155) pair. This is an array of tables of four byte integers.
|
|
|
1283 We will call these the IND2 tables. The size of each of these tables is
|
|
|
1284 specified by the recordSize field of the "7c" header. The number of
|
|
|
1285 these tables is the above recordCount value derived from the "b5" block.
|
|
|
1286 </para>
|
|
|
1287 <para>
|
|
|
1288 Now the remaining data in the "7c" block after the header starts at
|
|
|
1289 offset 0x2a. There should be itemCount 8 byte items here, with the
|
|
|
1290 following format:
|
|
|
1291 </para>
|
|
|
1292 <literallayout class="monospaced"><![CDATA[
|
|
|
1293 0000 referenceType [2 bytes]
|
|
|
1294 0002 itemType [2 bytes]
|
|
|
1295 0004 ind2Offset [2 bytes]
|
|
|
1296 0006 unknown [2 bytes]
|
|
|
1297 ]]></literallayout>
|
|
|
1298 <para>
|
|
|
1299 The ind2Offset is a byte offset into the current IND2 table of a four
|
|
|
1300 byte integer value. Once we fetch that, we have the same triple (item
|
|
|
1301 type, reference type, value) as we find in the 0xbcec style descriptor
|
|
|
1302 blocks. These 8 byte descriptors are processed recordCount times, each
|
|
|
1303 time using the next IND2 table. The item and reference types are as
|
|
|
1304 described above for the 0xbcec format descriptor block.
|
|
|
1305 </para>
|
|
|
1306 </refsect1>
|
|
|
1307
|
|
24
|
1308 </refentry>
|
|
16
|
1309 </reference>
|
