Subject: IDX Outlook Express (IE4) Index File Format (1998/11/26) From : "Jeff Evans" Corrected and filled up : "Arne Schloh" Notes on file formats : - Character strings are represented by the following notation : "ABCD" - Hexadecimal values are represented by the following notation : 0x0123ABCD They are stored in normal PC format of least significant byte to most significant byte. For example, hexadecimal 0x0123ABCD would be stored in a 4 byte field as 'CD AB 23 01'. Idx header : Index Size Description -------- ------- ---------------- 1- 4 4 bytes File ID (0x39464D4A = "JMF9") 5- 8 4 bytes Sub-ID (0x00010004) 9-12 4 bytes Number of items in the index file 13-16 4 bytes File size in bytes 17-20 4 bytes ? (seems to contain the hex value 0x00000001) 21-24 4 bytes ? (seems to contain the hex value 0x00010010) 25-80 56 bytes String composed of 0x00's Idx item : The idx items immediately follow the header. Each item has the following format. Index Size Description -------- ------- ---------------- 1- 4 4 bytes Flags. Only the first byte is used. Bit Contents --- ------------------- 1 message is deleted 2 message is not read 3 ? (usage was unclear) 4 message is not send 5 received eMail 6 received news 7 ? (seems to be unused) 8 ? (seems to be unused) 5- 8 4 bytes ? (seems to contain the hex value 0x00000000) 9- 12 4 bytes Entry number (unique for each index item) 13- 16 4 bytes Start address of this idx item 17- 20 4 bytes Size of this index item, including the end buffer 21- 24 4 bytes Start address of the corresponding mbx item 25- 28 4 bytes Size of the corresponding mbx item 29-194 166 bytes ? Usage was unclear. Contains the size of the message (Header / Body / Attachments) three times. 195- n * 92 bytes ? Usage was unclear. Several blocks of 92 bytes. Used for attachments, vCards, HTML text, ...? 8 bytes Date message received (a Win32 FILETIME structure) 8 bytes Date message send (a Win32 FILETIME structure) 2 bytes Priority : high=0x0001, normal=0x0003, low=0x0005 | 4 bytes Size of the following string | x bytes The 0x00 terminated string | -----------> This two fields are repeated 9 times. Not used strings have the form '01 00 00 00 00'. String Contents ------ -------------------------------------- 1 Subject 2 To 3 From 4 POP3 Server 5 ? (seems to be unused) 6 User Name used to log into POP3 Server 7 Name of the used OE account 8 ? (seems to be unused) 9 ? (seems to be unused) 0-3 bytes Padding field which is used to make the length of the entry an even multiple of 4 Arne Schloh.