FILE Header
PositionBytetypedScription (0) 0x0000 "CF AD 12 Fe" Equal for All DBX Files (1) 0x0004 m: "C5 FD 74 6F" CLSID_MESSAGEDATABASEF: "C6 FD 74 6F" CLSID_FolderDatabase (POP3UIDL = "C7 FD 74 6F" / offline = " 30 9D Fe 26 ") (2) 0x0008" 66 E3 D1 11 9A 4E 00 C0 4F A3 09 D4 05 00 00 00 00 00 00 "(7) 0x001cint4 the length of the file info object (9) 0x0024INT4 POIISTER TO THE last variable segment (a) 0x0028int4 length of a variable segment (0xc000) (b) 0x002cint4 used space of the last variable segment (c) 0x0030int4 pointer to the last tree segment (d) 0x0034int4 length of a tree segment (0x3e1c) (e ) 0x0038int4 used space of the last tree segment (f) 0x003cint4 m: pointer to the last message segment (10) 0x0040int4 m: length of a message segment (0xf780) (11) 0x0044int4 m: used space of the last message segment (12 0x0048INT4 m: root Pointer to the deleted message list (13) 0x004cint4 root pointer to the deleted Tree List (15) 0x0054INT4 Used Space in The Middle Sector of the File (16) 0x0058int4 Reusabel SP Ace in the middle sector of the file (17) 0x005cint4 index of the last entry in the Tree (19) 0x0064 "01 00 00" (1A) 0x0068 f: "01 00 00" (1B) 0x006C f: Pointer To THE FIRST Folder List Node (1C) 0x0070 f: PoinTer to the last folder list node (1D) 0x0074 f: "03 00 00" (1E) 0x0078 f: "02 00 00" (1F) 0x007CINT4 Used Space of To (Length of the first and the middle sector) (20) 0x0080 m: "02 00 00" f: "03 00 00"
(22) 0x0088int4 m: pointer to the message conditions object (23) 0x008cint4 f: pointer to the folder conditions object (31) 0x00c4int4 entries in tree (39) (32) 0x00c8int4 entries in tree (3a) (33) 0x00ccint4 f: entries in tree (3b) (39) 0x00e4int4 pointer to the root node of a tree all entries are sorted by there indexm: points to all message info objectsf: points to all folder info objects (3a) 0x00e8int4 pointer to the root node of a treem: points to all watched or ignored message info objectsf: points to the same folder info objects like (39) sorted by there parent folders index followed by there name (3b) 0x00ecint4 f: pointer to the root node of a tree points to. All Activ Subfolders of "Outlook Express". This is the folders you can see in Oe on the folders Pane. Sorted Like The Tree In (3A) (42) 0x0108 "01 00 00" (43) 0x010c f: "0200 00 00 "(9F) 0x027CINT4USED SPACE for Indexed Info Objectsm: Message Infof: Folder Info (A0) 0x0280INT4USED SPACE for CONDitions Objectsm: 0x50 Message Con ditionsf: 0x2c folder conditions (a2) 0x0288int4f: used space for folder list objects (a3) 0x028cint4used space for tree objects (a4) 0x0290int4m: used space for message objects => (15) - (16) = (9f) (a0 (A2) (A3) (A4) (A7) ... 0x029c ... from 0x29c Follows a segment with a longth of 0x2000 bytes. Each Int4 Value Points to a single Linked List of Deleted Objects from the variable SEGMENTS. The Objects in Each List Have The Same Size: Address of The Pointer - 0x29c and at the end i found Some VALUES 0X22BC "01 00 00" 0x22ec "00 00 00 00 00" 0x22f0 m: "07 00 00" f : "01 00 00 00 00 02 05" 0x2320 f: "02 00 01 00 .. .. ... 02 05 00 00" 0x244c "
