File format for Outlook Express 5.0 DBX files Header: These are the values we use to see what type the file is. 0x0 Signature [16/32 bytes] = 4A4D4636 03001000 /* OE4 SIGNATURE */ = CFAD12FE C5FD746F 66E3D111 9A4E00C0 /*OE5 Email DBX*/ = CFAD12FE C6FD746F 66E3D111 9A4E00C0 /*OE5 Folder DBX*/ As I said, we use these values to identify it, but we don't know what these values mean 0x5C Highest Email ID [4 bytes] This is the current highest. The next email will have a number one higher than this. 0x7C File Size [4 bytes] Total size of file 0xC4 Item Count [4 bytes] Number of items stored in this DBX file. Appears to be accurate. We use it as a second check that we haven't gone wrong whilst reading the indexes. 0xE4 Index Pointer [4 bytes] File offset pointing to a page of Data Indexes. This page can even be a page of Indexes pointing to pages of indexes. This area needs to be explored a little more Indexes: (pointed to by the pointer in 0xE4) This area is a little blurry, but it appears to work 0x0 Self [4 bytes] - Current Offset 0x4 Unknown [4 bytes] 0x8 Table Pointer [4 bytes] - Pointer to another of these tables 0xC Parent [4 bytes] - If this is a table of indexes which is referenced by another table above it, this will point to the parent's table 0x10 Unknown [1 byte] 0x11 Pointer Count [1 byte] - Number of pointers in this table 0x12 Unknown [2 bytes] 0x14 index Count [4 bytes] - I'm not sure Size = 0x18 Straight after this comes [Pointer Count] entries like this 0x0 Index Pointer [4 bytes] - Pointer to a data block 0x4 Table Pointer [4 bytes] - Pointer to another Table of indexes 0x8 Index Count [4 bytes] - Not sure. If non-zero [Table Pointer] has more indexes? Size = 0x0C These [Index Pointer] items point to offsets in the file which are data items. At present Emails and Folders have been worked on. Item Header: 0x0 Self [4 bytes] - current offset 0x4 Size [4 bytes] - size of block that follows 0x8 Unknown [2 bytes] 0xA Count [1 byte] - number of items in the block before the data starts 0xB Unknown [1 byte] Size = 0x0C Then comes [Count] number of items: 0x0 type [1 byte] - specifies what the data is 0x1 value [3 bytes] - actual data The following types have been found for Emails Type - Value 0x02 - 0x04 - buffer pointer to file offset of email data 0x05 - buffer pointer to asciiz string containing the subject of email 0x06 - 0x07 - buffer pointer to asciiz message id of email 0x08 - buffer pointer to asciiz another string containing the subject of email 0x09 - 0x0B - 0x0A - buffer pointer to asciiz message ids of parent emails 0x0C - 0x0D - buffer pointer to asciiz Name of sender 0x0E - buffer pointer to asciiz Email address of sender 0x11 - 0x12 - 0x13 - buffer pointer to asciiz Name of recipient 0x14 - buffer pointer to asciiz Email address of recipient 0x1A - 0x1B - 0x1C - 0x80 - Numeric ID (numeric) 0x81 - 0x84 - file offset to email data 0x90 - 0x91 - The following have been discovered for Folder Items Type - Value 0x01 - 0x02 - Buffer Pointer to Descriptive name of Folder 0x03 - Buffer Pointer to Filename of Folder 0x05 - 0x06 - 0x80 - Folder's ID (numeric) 0x81 - Folder ID of parent (numeric) 0x86 - 0x87 - 0x8A - When handling blocks of data (as in Emails) the offset pointer will point to the following structure: 0x0 Self [4 bytes] - current offset 0x4 Size [4 bytes] - size of block 0x8 Data Size [2 bytes] - size of data inside block 0xA Item Count [1 byte] - number of int size objects before data 0xB Unknown [1 byte] 0xC Next address [4 bytes] - File offset of next data block Size = 0X10