-
Notifications
You must be signed in to change notification settings - Fork 4
Changes to handle OST 2013 files
James McLeod edited this page Jul 22, 2020
·
18 revisions
With Outlook 2013, Microsoft changed the format used for OST (and NST) files to account for larger file sizes.
My starting point was this blog entry called "OST 2013 File Format - The Missing Documentation".
- In the file header, the value of wVer is 0x24. (084c968)
- The number of entries in the BTPage structure is increased to 4056, requiring the following changes (2c239ac):
- The size of the rgEntries field is increased to 4056
- The cEnt and cEntMax fields widened to two bytes since they now have to have a higher range.
- BBTEntry has a new field to indicate the expanded size of a block for compressed blocks. (If the expanded size and the actual size are the same, the block is not expanded). (ab166ae)
- The block size is increased to 65512 bytes (efada4c)
- Blocks can be zip-compressed (c483635)
- Block trailer size has increased to 24 bytes (9b954a0)
- HID has three new 1-bit fields which cannibalizes part of the hidBlockIndex field. (The meanings of these flags is not documented.) (336b799)
- Blocks are aligned on 512-byte boundaries instead of 64-byte boundaries (17a13ae)
In addition to the changes listed there, I found the following differences:
- It is possible for a folder to have a non-zero content count but not have an associated Contents Table. This was observed with the "Reminders", "To-Do Search", and "Contact Search" folders under the "Finder" folder. (3f199b8)
- The Message Store for OST files does not include the IpmSubTreeEntryId, so the root folder needs to be found using a different mechanism - by searching for the NBTEntry which has itself as its parent. (2423d0d)
- A new IPM type, "IPM.ApchPerson", has been introduced. This appears used for the entries in the /Root-Mailbox/IPM_SUBTREE/PersonMetadata folder. It is otherwise undocumented. (2615fed)