File format for Outlook Express 5.0 DBX files

Header:

These are the values we use to see what type the file is.

0x0  Signature [16/32 bytes] 
	= 4A4D4636 03001000 /* OE4 SIGNATURE */
	= CFAD12FE C5FD746F 66E3D111 9A4E00C0 /*OE5 Email DBX*/
	= CFAD12FE C6FD746F 66E3D111 9A4E00C0 /*OE5 Folder DBX*/

As I said, we use these values to identify it, but we don't know 
what these values mean

0x5C Highest Email ID [4 bytes]
     This is the current highest. The next email will have a number
     one higher than this.     

0x7C File Size [4 bytes]
     Total size of file

0xC4 Item Count [4 bytes]
     Number of items stored in this DBX file. Appears to be
     accurate. We use it as a second check that we haven't gone wrong
     whilst reading the indexes.

0xE4 Index Pointer [4 bytes]
     File offset pointing to a page of Data Indexes. This page can
     even be a page of Indexes pointing to pages of indexes. This area
     needs to be explored a little more


Indexes: (pointed to by the pointer in 0xE4)

This area is a little blurry, but it appears to work

0x0  Self [4 bytes]	      - Current Offset
0x4  Unknown [4 bytes]
0x8  Table Pointer [4 bytes]  - Pointer to another of these tables
0xC  Parent [4 bytes]	      - If this is a table of indexes which is
				referenced by another table above it,
				this will point to the parent's table
0x10 Unknown [1 byte]
0x11 Pointer Count [1 byte]   - Number of pointers in this table
0x12 Unknown [2 bytes]
0x14 index Count [4 bytes]    - I'm not sure
Size = 0x18

Straight after this comes [Pointer Count] entries like this

0x0  Index Pointer [4 bytes]  - Pointer to a data block
0x4  Table Pointer [4 bytes]  - Pointer to another Table of indexes
0x8  Index Count [4 bytes]    - Not sure. If non-zero [Table Pointer]
				has more indexes?
Size = 0x0C


These [Index Pointer] items point to offsets in the file which are
data items. At present Emails and Folders have been worked on.

Item Header:
0x0  Self [4 bytes] - current offset
0x4  Size [4 bytes] - size of block that follows
0x8  Unknown [2 bytes]
0xA  Count [1 byte] - number of items in the block before the data
		      starts
0xB  Unknown [1 byte]
Size = 0x0C

Then comes [Count] number of items:
0x0  type [1 byte] - specifies what the data is
0x1  value [3 bytes] - actual data

The following types have been found for Emails
   Type - Value
   0x01 - buffer pointer to flag
   0x02 - 
   0x04 - buffer pointer to file offset of email data
   0x05 - buffer pointer to asciiz string containing the tidy subject of email (without RE: or FWD:, etc)
   0x06 -
   0x07 - buffer pointer to asciiz message id of email
   0x08 - buffer pointer to asciiz string containing the subject of email (with RE:...)
   0x09 -
   0x0B -
   0x0A - buffer pointer to asciiz message ids of parent emails
   0x0C - buffer pointer to asciiz name of server where email was fetched from
   0x0D - buffer pointer to asciiz Name of sender
   0x0E - buffer pointer to asciiz Email address of sender
   0x11 -
   0x12 - date in win32 FILETIME structure. Use Wine's FileTimeToUnix() function
   0x13 - buffer pointer to asciiz Name of recipient
   0x14 - buffer pointer to asciiz Email address of recipient
   0x1A - buffer pointer to asciiz name of account used to fetch email
   0x1B - buffer pointer to asciiz number of account used to fetch email (eg "00000001")
   0x1C - 
   0x80 - Numeric ID (numeric)
   0x81 - email's flag
   0x84 - file offset to email data
   0x90 -
   0x91 -

The following have been discovered for Folder Items
   Type - Value
   0x01 -
   0x02 - Buffer Pointer to Descriptive name of Folder
   0x03 - Buffer Pointer to Filename of Folder
   0x05 - 
   0x06 - 
   0x80 - Folder's ID (numeric)
   0x81 - Folder ID of parent (numeric)
   0x86 -
   0x87 -
   0x8A -

When handling blocks of data (as in Emails) the offset pointer will
point to the following structure:

0x0  Self [4 bytes] - current offset
0x4  Size [4 bytes] - size of block
0x8  Data Size [2 bytes] - size of data inside block
0xA  Item Count [1 byte] - number of int size objects before data
0xB  Unknown [1 byte]
0xC  Next address [4 bytes] - File offset of next data block
Size = 0X10