.MSG File Format – Binary property structures

Folder, message and global identifiers

EntryIDs

An EntryID is a byte array whose length is given outside the structure. Every kind begins with Flags (4 bytes, zero for a long-term EntryID, which is the only kind stored in a property) and a 16-byte ProviderUID that routes it to its provider; the rest is ProviderData.

Messaging-object EntryIDs begin their ProviderData with a 2-byte object type: 0001 private folder, 0003 public folder, 0005 mapped public folder, 0007 private message, 0009 public message, 000B mapped public message, 000C public newsgroup folder.

Layouts

Lists of EntryIDs

• EntryList (search folder criteria): EntryCount (4), a 4-byte pad that is ignored, then EntryCount pairs of an entry length (4) and an ignored 4-byte pad, then the EntryIDs one after another.
• FlatEntry: Size (4) then that many bytes of EntryID. FlatEntryList: Count (4), Size (4, the total size of all the entries including padding), then the FlatEntry structures, each starting at a multiple of 4 bytes (the next offset is the previous entry's size rounded up to 4).
• FlatUID: a GUID in little-endian byte order, 16 bytes.

PropertyName and PropertyProblem

• PropertyName: Kind (1: 00 identified by LID, 01 identified by name, FF no name follows), GUID (16, as a FlatUID), then for kind 0 the LID (4), or for kind 1 NameSize (1, the byte count of the name) and Name (UTF-16 with a 2-byte terminator). The PropertyName_r form of [MS-NSPI] is GUID, 4 reserved zero bytes and LID, with no string names.
• PropertyProblem: Index (2, into the array of property tags), PropertyTag (4), ErrorCode (4).

Property tags and values

• PropertyTag: PropertyType (2) then PropertyId (2); in a stored 32-bit tag the ID is the high half, so 0037001F is written as the little-endian bytes 1F 00 37 00. PropertyTagArray: Count (2) then that many 4-byte tags (PropertyTagArray_r: the same, with a larger permitted count).
• PropertyValue: only the value, its size and layout given by the type known from the context. Numbers are little-endian; a multi-value value starts with a count; strings include their terminating null characters. TypedPropertyValue: PropertyType (2) then the value. TaggedPropertyValue: PropertyTag (4) then the value.
• FlaggedPropertyValue: Flag (1) then, unless the flag is 1, the value: flag 00 a value of the context's type, 01 no value, 0A an unsigned 32-bit error code (below) instead. FlaggedPropertyValueWithType: PropertyType (2), Flag (1), the value.
• COUNT: a length field that is 2 or 4 bytes wide depending on context; in ROP buffers byte counts of binary values are 16 bits and value counts of multi-value properties are 32 bits, but in extended rules ([MS-OXORULE]) both are 32 bits. Within one buffer the width never mixes.
• Strings. Unicode strings are UTF-16LE with type 001F (101F multiple); 8-bit strings use type 001E (101E) in a code page set by the connection. In a message store protected with Windows Information Protection an encrypted string looks like binary with the 4-byte prefix 12 34 56 78.
• Multi-value instance. In table operations the flag 0x2000 (MultivalueInstance) on a column type, only together with 0x1000, treats a multi-value column as one row per value.
• PtypServerId: a folder ID (8 bytes) followed by a message ID (8 bytes).
• TypedString: StringType (1: 00 no string, 01 empty string, 02 null-terminated 8-bit, 03 null-terminated reduced Unicode with a 1-byte terminator, 04 null-terminated Unicode with a 2-byte terminator) then the string for types 2 to 4. A reduced Unicode string is a Unicode string in which every character is below 0x100, written without the zero high bytes (half the size); to read it, insert a zero byte after every byte.

Property rows and recipient rows

• StandardPropertyRow: Flag (1, 00: all values present and without error), then an array of PropertyValue (or TypedPropertyValue where the requested type was 0000 unspecified). FlaggedPropertyRow: Flag 01 (some values missing or in error, or the request used the unspecified type), then FlaggedPropertyValue (or FlaggedPropertyValueWithType) elements. The first byte tells the two apart. No tags are stored in a row: the context (the requested tags, or the columns set before) says which value is which. PropertyRow_r ([MS-NSPI]) is: 4 reserved zero bytes, ValueCount (4, at most 100,000), then the standard row's value array.
• PropertyRowSet: RowCount (2) then that many rows. In table results a binary or string value of 255 bytes or characters may have been cut; a value of exactly that length is probably longer in the real object.
• RecipientRow, in order:
  1. RecipientFlags (2): bits 0x0007 address type (0 none, 1 X500DN, 2 MsMail, 3 SMTP, 4 Fax, 5 professional office system, 6 and 7 personal distribution list); 0x0008 E: email address field present; 0x0010 D: display name present; 0x0020 T: transmittable display name present; 0x0040 S: transmittable display name equals display name; 0x0080 R: another transport delivers to this recipient; 0x0100 N: the recipient cannot receive rich text; 0x0200 U: strings are Unicode (2-byte terminators), else 8-bit in the connection's code page; 0x0400 I: simple display name present; 0x7800 reserved (0); 0x8000 O: a non-standard address type, whose name is present.
  2. If the type is X500DN: AddressPrefixUsed (1), DisplayType (1: 0 messaging user, 1 distribution list, 2 forum such as a bulletin board or public folder, 3 automated agent, 4 large-group address book object, 5 private distribution list, 6 foreign or remote user) and X500DN (null-terminated ASCII).
  3. If the type is a personal distribution list (6 or 7): EntryIdSize (2) and the address book EntryID of the list, then SearchKeySize (2) and the search key (may be empty).
  4. If the type is none (0) and flag O is set: AddressType (null-terminated ASCII). Then, each present only if its flag is set: EmailAddress, DisplayName, SimpleDisplayName, TransmittableDisplayName (null-terminated, Unicode if U is set).
  5. RecipientColumnCount (2), the number of columns used from the column list of the request, and RecipientProperties, a PropertyRow of those columns.
• AddressEntry: PropertyCount (4) then that many TaggedPropertyValue. AddressList: AddressCount (4) then that many AddressEntry (used in saved search folder criteria).

Restrictions and sort orders

A restriction is a Boolean filter over a table; the first byte is RestrictType. In ROP buffers counts are 16 bits; in extended rules and search folder definition messages they are 32 bits.

SortOrder: PropertyType (2), PropertyId (2), Order (1: 00 ascending, 01 descending, 04 maximum category, an aggregated column in a categorised sort whose maximum value orders the groups). A multi-value column must carry both 0x1000 and 0x2000 in its type: one row is made per value. SortOrderSet: SortOrderCount (2), CategorizedCount (2), ExpandedCount (2), then the SortOrder structures.

Error codes

The property error codes of section 2.4.2 of [MS-OXCDATA], stored as the 32-bit value of a FlaggedPropertyValue with flag 0A (type 000A, ErrorCode) or in a PropertyProblem:

The general error and warning codes of sections 2.4 and 2.4.3 of [MS-OXCDATA] (several hundred values) are not reproduced on this site.