Difference between revisions of "Outlook Express Database (DBX)"
From Forensics Wiki
Joachim Metz (Talk | contribs) (→File signature) |
Joachim Metz (Talk | contribs) |
||
| Line 1: | Line 1: | ||
| − | [[Outlook Express]] uses the '''Outlook Express Database (DBX)''' database to store emails, folders, etc. | + | [[Outlook Express]] (OE) uses the '''Outlook Express Database (DBX)''' database to store emails, folders, etc. The DBX was introduces in version 5. Earlier versions of OE use different file formats. |
== MIME types == | == MIME types == | ||
== File signature == | == File signature == | ||
| − | DBX files | + | OE5 DBX files start with hexadecimal: 0xcf 0xad 0x12 0xfe. |
For now it is assumed that this is the file signature. | For now it is assumed that this is the file signature. | ||
| + | It is followed by a content class identifier (CLSID), which is unique for the type of DBX file. | ||
== File types == | == File types == | ||
| − | + | Although DBX probably contains a minor/major version (offset: 20 and 24) until now it is unknown how it affects the file type. | |
== Contents == | == Contents == | ||
| + | The contents of a DBX file is dependent on the content CLSID. | ||
| + | * Message Database (CLSID: 6F74FDC5-E366-11d1-9A4E-00C04FA309D4) | ||
| + | * Folder Database (CLSID: 6F74FDC6-E366-11d1-9A4E-00C04FA309D4) | ||
== Encryption == | == Encryption == | ||
| Line 16: | Line 20: | ||
== See also== | == See also== | ||
| + | * [http://en.wikipedia.org/wiki/Outlook_Express Outlook Express Wikipedia] | ||
* [http://oedbx.aroh.de/ Outlook Express dbx file format by Arne Schloh] | * [http://oedbx.aroh.de/ Outlook Express dbx file format by Arne Schloh] | ||
* [http://www.fpns.net/willy/DBX-FMT.HTM Outlook Express Version 5.0 file format] | * [http://www.fpns.net/willy/DBX-FMT.HTM Outlook Express Version 5.0 file format] | ||
Revision as of 03:01, 13 October 2010
Outlook Express (OE) uses the Outlook Express Database (DBX) database to store emails, folders, etc. The DBX was introduces in version 5. Earlier versions of OE use different file formats.
Contents |
MIME types
File signature
OE5 DBX files start with hexadecimal: 0xcf 0xad 0x12 0xfe. For now it is assumed that this is the file signature. It is followed by a content class identifier (CLSID), which is unique for the type of DBX file.
File types
Although DBX probably contains a minor/major version (offset: 20 and 24) until now it is unknown how it affects the file type.
Contents
The contents of a DBX file is dependent on the content CLSID.
- Message Database (CLSID: 6F74FDC5-E366-11d1-9A4E-00C04FA309D4)
- Folder Database (CLSID: 6F74FDC6-E366-11d1-9A4E-00C04FA309D4)
Encryption
See also
- Outlook Express Wikipedia
- Outlook Express dbx file format by Arne Schloh
- Outlook Express Version 5.0 file format
- libdbx, see FILE-FORMAT in the package.
