A node’s data (see header and node database) is usually a heap holding a property context or a table context. This page follows [MS-PST] sections 2.3 and 2.4, read 2026-11-12. Property tags and types are those of MAPI, as in MSG files.
Heap-on-node
The first block of a heap starts with HNHDR; later blocks start with a short
HNPAGEHDR (2 bytes, ibHnpm), except block 8 (counting from 0) and
every 128th block after it, which start with HNBITMAPHDR: ibHnpm and
64 bytes of fill levels for the next 128 blocks.
| HNHDR field | Size | Meaning |
|---|---|---|
ibHnpm | 2 | Offset of the page map in this block. |
bSig | 1 | EC. |
bClientSig | 1 | What the heap holds: 7C table context, B5 B-tree-on-heap, BC property context; other values (6C, 8C, 9C, A5, AC, CC) are reserved. |
hidUserRoot | 4 | HID of the client’s root structure. |
rgbFillLevel | 4 | Fill levels of the first 8 blocks, 4 bits each: 0 at least 3,584 bytes free, down to F less than 8 bytes free. |
The page map (HNPAGEMAP): cAlloc (2), cFree (2), then
cAlloc + 1 offsets of the allocations. A HID is 32
bits: hidType (5 bits, 0), hidIndex (11 bits, from 1) and
hidBlockIndex (16 bits). An HNID is either a HID or,
when its low 5 bits are not 0, the NID of a subnode holding larger data.
B-tree-on-heap
| BTHHEADER field | Size | Meaning |
|---|---|---|
bType | 1 | B5. |
cbKey | 1 | Key size: 2, 4, 8 or 16. |
cbEnt | 1 | Data size, 1 to 32. |
bIdxLevels | 1 | Levels above the leaves. |
hidRoot | 4 | HID of the root records, 0 when empty. |
Leaf records are key and data; intermediate records are key and the HID of the next level.
Property context
A heap with bClientSig BC whose root is a B-tree with
2-byte keys (the property ID) and 6-byte data: wPropType (2) and
dwValueHnid (4). Values of 4 bytes or less are stored in
dwValueHnid itself; larger ones are at that HID (up to 3,580 bytes) or
in that subnode. Multi-valued properties of fixed-size types are just the values
one after another (the count is the size divided by the item size); those of
variable-size types start with a 4-byte count and an offset for each value.
Table context
| TCINFO field | Size (U / A) | Meaning |
|---|---|---|
bType | 1 | 7C. |
cCols | 1 | Number of columns. |
rgib | 4 × 2 | Offsets in each row: end of the 4- and 8-byte columns, end of the 2-byte columns, end of the 1-byte columns, end of the cell existence bitmap (the row size). |
hidRowIndex | 4 | B-tree from row ID (4 bytes) to row number (4 bytes Unicode, 2 ANSI). |
hnidRows | 4 | The row matrix: a HID, or a subnode when large. |
hidIndex | 4 | Deprecated, 0. |
rgTCOLDESC | 8 each | Columns: tag (4), ibData (2, offset in the row), cbData (1), iBit (1, bit in the cell existence bitmap). |
Each row starts with its 4-byte row ID, then holds the 4- and 8-byte columns, then
2-byte, then 1-byte, then a bitmap of ceil(cCols / 8) bytes saying
which cells hold a value (bit 0 is the most significant bit of the first byte).
Variable-size values, and fixed-size ones over 8 bytes, hold an HNID. In a subnode
row matrix, rows do not cross block boundaries; each block starts with a new
row.
Messaging objects
| Object | Made of |
|---|---|
| Message store | The property context at NID 21: display name, record key, entry IDs of the root of the folder tree (IPM subtree), deleted items and search root, and PidTagPstPassword (67FF0003, a CRC of the password, not encryption). |
| Named property map | The property context at NID 61: a GUID stream, an entry stream and a string stream, each stored as a property of that context (such as PidTagNameidStreamGuid), much as in MSG files, plus a hash table for searching. |
| Folder | Four nodes with the same index: a property context (type 02), its hierarchy table (0D, the subfolders), contents table (0E, the messages) and associated contents table (0F, folder associated information: messages usually hidden from view that hold settings such as forms, views and category lists). The root folder is NID 122. |
| Message | A property context (type 04) whose subnodes hold its recipient table (type 12, required), its attachment table (type 11, at most one), each attachment’s property context (type 05) and large property values. The column sets come from template tables at NIDs 692 and 671. |
| Attachment | A property context with PidTagAttachMethod and the data in PidTagAttachDataBinary (37010102), or for an embedded message PidTagAttachDataObject (3701000D), naming a subnode that holds the message. |
[MS-PST] also describes search folders, the search update queue and the consistency rules a writer must keep; those are not covered here.