diff --git a/AUTHORS b/AUTHORS index e28a39b..df4cf52 100644 --- a/AUTHORS +++ b/AUTHORS @@ -1,50 +1,51 @@ Original version by: Dave Smith Dave Smith Current maintainer: Carl Byington With contributions by: Joseph Nahmias -- bounces Joseph Nahmias Arne Ahrend Nigel Horne Chris Halls Stevens Miller Brad Hards Alexander Grau Antonio Palama Sean Loaring James Woodcock Joachim Metz Robert Simpson Justin Greer Bharath Acharya Robert Harris David Cuadrado Chris Eagle Fridrich Strba Emmanuel Andry hggdh bharder Chris White Roberto Polli Lee Ayres Hugo DesRosiers Kenneth Berland Leo 'costela' Antunes Svante Signell Dominique Leuenberger a.k.a. Dimstar Daniel Gryniewicz AJ Shankar Jeffrey Morlan Hans Liss Igor Stroh Zachary Travis Vitaliy Didik + Alfredo Esteban Testing team: Mac OSX - Michael Watson Cygwin/Mingw - Fridrich Strba Cygwin - Chris Eagle diff --git a/ChangeLog b/ChangeLog index 2099a3f..833d2d3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,931 +1,935 @@ +LibPST 0.6.72 (2017-12-07) +=============================== + * Alfredo Esteban - add -l and -f options to lspst. + LibPST 0.6.71 (2017-07-21) =============================== * Zachary Travis - Add support for the OST 2013 format, and Content-Disposition filename key fix for outlook compatibility LibPST 0.6.70 (2017-02-08) =============================== * Jeffrey Morlan - pst_getID2 must not recurse into children LibPST 0.6.69 (2016-10-29) =============================== * fix bugs in code allowing folders containing multiple item types LibPST 0.6.68 (2016-08-29) =============================== * allow folders containing multiple item types, e.g. email and calendar * better detection of valid internet headers LibPST 0.6.67 (2016-07-06) =============================== * Jeffrey Morlan - multiple bug fixes and an optimization see 'hg log -v' for details LibPST 0.6.66 (2015-12-21) =============================== * Igor Stroh - Added Content-ID header support LibPST 0.6.65 (2015-09-11) =============================== * Jeffrey Morlan - fix multiple Content-Type headers * Hans Liss - debug level output LibPST 0.6.64 (2015-03-09) =============================== * AJ Shankar fixes for attachment processing and body encodings that contain embedded null chars LibPST 0.6.63 (2013-12-27) =============================== * Daniel Gryniewicz found buffer overrun in LIST_COPY_TIME LibPST 0.6.62 (2013-09-22) =============================== * 983596 - Old dependency filter breaks file coloring LibPST 0.6.61 (2013-08-06) =============================== * move documentation to unversioned directory LibPST 0.6.60 (2013-06-12) =============================== * patch from Dominique Leuenberger to add AC_USE_SYSTEM_EXTENSIONS * add readpst -a option for attachment stripping LibPST 0.6.59 (2013-05-17) =============================== * add autoconf checking for libgsf LibPST 0.6.58 (2012-12-28) =============================== * fix From quoting on embedded rfc/822 messages LibPST 0.6.57 (2012-12-27) =============================== * remove useless dependencies LibPST 0.6.56 (2012-12-24) =============================== * merge -m .msg files code into main branch LibPST 0.6.55 (2012-05-08) =============================== * preserve bcc headers * document -C switch to set default character set * space after colon is not required in header fields LibPST 0.6.54 (2011-11-04) =============================== * embedded rfc822 messages might contain rtf encoded bodies LibPST 0.6.53 (2011-07-10) =============================== * add Status: header in output * allow fork for parallel processing of individual email folders in separate mode * proper handling of --with-boost-python option LibPST 0.6.52 (2011-05-22) =============================== * fix dangling freed pointer in embedded rfc822 message processing * allow broken outlook internet header field - it sometimes contains fragments of the message body rather than headers LibPST 0.6.51 (2011-04-17) =============================== * fix for buffer overrun; attachment size from the secondary list of mapi elements overwrote proper size from the primary list of mapi elements. fedora bugzilla 696263 LibPST 0.6.50 (2010-12-24) =============================== * rfc2047 and rfc2231 encoding for non-ascii headers and attachment filenames LibPST 0.6.49 (2010-09-13) =============================== * fix to ignore embedded objects that are not email messages LibPST 0.6.48 (2010-09-02) =============================== * fix for broken internet headers from Outlook. * fix ax_python.m4 to look for python2.7 * Subpackage Licensing, add COPYING to -libs. * use mboxrd from quoting for output formats with multiple messages per file * use no from quoting for output formats with single message per file LibPST 0.6.47 (2010-05-07) =============================== * patches from Kenneth Berland for solaris. * fix output file name numbering to start at 1 rather than 2. LibPST 0.6.46 (2010-02-13) =============================== * prefer libpthread over librt for finding sem_init function. * rebuild for fedora 13 change in implicit dso linking semantics. LibPST 0.6.45 (2009-11-18) =============================== * patch from Hugo DesRosiers to export categories and notes into vcards. * extend that patch to export categories into vcalendar appointments also. LibPST 0.6.44 (2009-09-20) =============================== * fix --help usage; readpstlog is gone, debug files are now ascii text. * patch from Lee Ayres to add file name extensions in separate mode. * allow mixed items types in a folder in separate mode. LibPST 0.6.43 (2009-09-12) =============================== * patches from Justin Greer. add code pages 1200 and 1201 to the list for iconv add support for 0x0201 indirect blocks that point to 0x0101 blocks add readpst -t option to select output item types fix (remove) extra new line inside headers * cleanup base64 encoding to remove duplicate code. * patch from Chris White to avoid segfault with embedded appointments. * patch from Roberto Polli to add creation of some Thunderbird specific meta files. * patch from Justin Greer to ignore b5 tables at offset zero. * output type filtering can now be used to handle folders with multiple item types. * better decoding of rfc822 embedded message attachments. * better detection of dsn delivery reports LibPST 0.6.42 (2009-09-03) =============================== * patch from Fridrich Strba to build with DJGPP DOS cross-compiler. LibPST 0.6.41 (2009-06-23) =============================== * fix ax_python detection - should not use locate command * checking for fedora versions is not needed LibPST 0.6.40 (2009-06-23) =============================== * fedora 11 has python2.6 * remove pdf version of the man pages LibPST 0.6.39 (2009-06-21) =============================== * fedora > 10 moved to boost-python-devel LibPST 0.6.38 (2009-06-21) =============================== * add python module interface to the shared library for easy scripting. * the shared library must never write to stdout or stderr. * fix pst_attach_to_mem so the caller does not need to initialize the buffer pointer. * remove readpst -C switch, obsolete debugging code. * update version to 4:0:0 since we made many changes to the interface. * removed contact->access_method since we don't have a mapi element for it. * changed pst_attach_to_mem to return pst_binary structure. * decode more recurrence mapi elements. * readpst changes for parallel operation on multi processor machines. * remove readpstlog - the debug log files are now plain ascii. Add locking if needed so parallel jobs can produce debug logs. * more cleanup of the shared library interface, but still not fully thread safe. * make nested mime multipart/alternative to hold the text/html parts so the topmost level is almost always multipart/mixed. * the shared library interface should now be thread safe. * patch from Fridrich Strba to build on win32. * remove unreferenced code. LibPST 0.6.37 (2009-04-17) =============================== * add pst_attach_to_mem() back into the shared library interface. * improve developer documentation. * fix memory leak caught by valgrind. LibPST 0.6.36 (2009-04-14) =============================== * spec file cleanup with multiple sub packages. * add doxygen devel-doc documentation for the shared library. * switch back to fully versioned subpackage dependencies. * more cleanup on external names in the shared object file. LibPST 0.6.35 (2009-04-08) =============================== * fix bug where we failed to pickup the last extended attribute. * patch from Emmanuel Andry to fix potential security bug in pst2dii with printf(err). * properly add trailing mime boundary in all modes. * move version-info into main configure.in, and set it properly * prefix all external symbols in the shared library with pst_ to avoid symbol clashes with other shared libraries. * new debianization from hggdh. * build separate libpst, libpst-libs, libpst-devel rpms. * remove many functions from the interface by making them static. LibPST 0.6.34 (2009-03-19) =============================== * improve consistency checking when fetching items from the pst file. * avoid putting mixed item types into the same output folder. LibPST 0.6.33 (2009-03-17) =============================== * fix fedora 11 type mismatch warning (actually an error in this case). * fix large file support, some sytems require config.h to be included earlier in the compilation. * compensate for iconv conversion to utf-7 that produces strings that are not null terminated. * don't produce empty attachment files in separate mode. LibPST 0.6.32 (2009-03-14) =============================== * fix ppc64 compile error. LibPST 0.6.31 (2009-03-14) =============================== * bump version for fedora cvs tagging mistake. LibPST 0.6.30 (2009-03-14) =============================== * improve documentation of .pst format. * remove decrypt option from getidblock - we always decrypt. * rename some structure fields to reflect our better understanding of the pst format. * track character set individually for each mapi element, since some could be unicode (therefore utf8) and others sbcs with character set specified by the mapi object. remove charset option from pst2ldif since we get that from each object now. * more code cleanup. * use AM_ICONV for better portability of the library location. * structure renaming to be more specific. * improve internal doxygen documentation. * avoid emitting bogus empty email messages into contacts and calendar files. LibPST 0.6.29 (2009-02-24) =============================== * fix for 64bit on Fedora 11 LibPST 0.6.28 (2009-02-24) =============================== * add X-libpst-forensic-* headers to capture items of interest that are not used by normal mail clients. * improve decoding of multipart/report and message/rfc822 mime types. * improve character set handling - don't try to convert utf-8 to single byte for fields that were not originally unicode. if the conversion fails, leave the data in utf-8. * fix embedded rfc822 messages with attachments. LibPST 0.6.27 (2009-02-07) =============================== * fix for const correctness on Fedora 11 LibPST 0.6.26 (2009-02-07) =============================== * patch from Fridrich Strba for building on mingw and general cleanup of autoconf files * add processing for pst files of type 0x0f * start adding support for properly building and installing libpst.so and the header files required to use it. * remove version.h since the version number is now in config.h * more const correctness issues regarding getopt() * consistent ordering of our include files. all system includes protected by ifdef HAVE_ from autoconf. * strip and regenerate all MIME headers to avoid duplicates. problem found by Michael Watson on Mac OSX. * do a better job of making unique MIME boundaries. * only use base64 coding when strictly necessary. * more cleanup of #include files. common.h is the only file allowed to include system .h files unprotected by autoconf HAVE_ symbols. define.h is the only other file allowed to include system .h files. define.h is never installed; common.h is installed if we are building the shared library. * recover dropped pragma pack line, use int64_t rather than off_t to avoid forcing users of the shared library to enable large file support. * add pragma packing support for sun compilers. * fix initial from header in mbox format. * start moving to PST_LE_GET* rather than LE*_CPU macros so we can eventually remove the pragma packing. * patch from Fridrich Strba, some systems need extra library for regex. LibPST 0.6.25 (2009-01-16) =============================== * improve handling of content-type charset values in mime parts LibPST 0.6.24 (2008-12-11) =============================== * patch from Chris Eagle to build on cygwin LibPST 0.6.23 (2008-12-04) =============================== * bump version to avoid cvs tagging mistake in fedora LibPST 0.6.22 (2008-11-28) =============================== * patch from David Cuadrado to process emails with type PST_TYPE_OTHER * base64_encode_multiple() may insert newline, needs larger malloc * subject lines shorter than 2 bytes could segfault LibPST 0.6.21 (2008-10-21) =============================== * fix title bug with old schema in pst2ldif. * also escape commas in distinguished names per rfc4514. LibPST 0.6.20 (2008-10-09) =============================== * add configure option --enable-dii=no to remove dependency on libgd. * many fixes in pst2ldif by Robert Harris. * add -D option to include deleted items, from Justin Greer * fix from Justin Greer to add missing email headers * fix from Justin Greer for my_stristr() * fix for orphan children when building descriptor tree * avoid writing uninitialized data to debug log file * remove unreachable code * create dummy top-of-folder descriptor if needed for corrupt pst files LibPST 0.6.19 (2008-09-14) =============================== * Fix base64 encoding that could create long lines * Initial work on a .so shared library from Bharath Acharya. LibPST 0.6.18 (2008-08-28) =============================== * Fixes for iconv on Mac from Justin Greer. LibPST 0.6.17 (2008-08-05) =============================== * More fixes for 32/64 bit portability on big endian ppc. LibPST 0.6.16 (2008-08-05) =============================== * Use inttypes.h for portable printing of 64 bit items. LibPST 0.6.15 (2008-07-30) =============================== * Patch from Robert Simpson for file handle leak in error case. * Fix for missing length on lz decompression, bug found by Chris White. LibPST 0.6.14 (2008-06-15) =============================== * Fix my mistake in debian packaging. LibPST 0.6.13 (2008-06-13) =============================== * Patch from Robert Simpson for encryption type 2. * Fix the order of testing item types to avoid claiming there are multiple message stores. LibPST 0.6.12 (2008-06-10) =============================== * Patch from Joachim Metz for debian packaging, and fix for incorrect length on lz decompression. LibPST 0.6.11 (2008-06-03) =============================== * Use ftello/fseeko to properly handle large files. * Document and properly use datasize field in b5 blocks. * Fix some MSVC compile issues and collect MSVC dependencies into one place. LibPST 0.6.10 (2008-05-29) =============================== * Patch from Robert Simpson fix doubly-linked list in the cache_ptr code, and allow arrays of unicode strings (without converting them). * More changes for Fedora packaging (#434727) * Fixes for const correctness. LibPST 0.6.9 (2008-05-16) =============================== * Patch from Joachim Metz for 64 bit compile. * Signed/unsigned cleanup from 'CFLAGS=-Wextra ./configure'. * Reindent vbuf.c to make it readable. * Fix pst format documentation for 8 byte backpointers. LibPST 0.6.8 (2008-03-05) =============================== * Initial version of pst2dii to convert to Summation dii load file format. * Changes for Fedora packaging (#434727) LibPST 0.6.7 (2008-02-16) =============================== * Work around bogus 7c.b5 blocks in some messages that have been read. They appear to have attachments, but of some unknown format. Before the message was read, it did not have any attachments. * Use autoscan to cleanup our autoconf system. * Use autoconf to detect when we need to use our XGetopt files and other header files. * More fields, including BCC. * Fix missing LE32_CPU byte swapping for FILETIME types. LibPST 0.6.6 (2008-01-31) =============================== * More code cleanup, removing unnecessary null terminations on binary buffers. All pst file reads now go thru one function. Logging all pst reads to detect cases where we read the same data multiple times - discovers node sizes are actually 512 bytes. * Switch from cvs to mercurial source control. LibPST 0.6.5 (2008-01-22) =============================== * More code cleanup, removing obsolete code. All the boolean flags of type 0xb have length 4, so these are all 32 bits in the file. Libpst treats them all as 16 bits, but at least we are consistent. * More fields decoded - for example, see We should be able to use that data for much more complete decoding. * Move the rpm group to Applications/Productivity consistent with Evolution. LibPST 0.6.4 (2008-01-19) =============================== * More fixes for Outlook 2003 64 bit parsing. We observed cases of compressed RTF bodies (type 0x1009) with zero length. * Document type 0x0101 descriptor blocks and process them. * Fix large file support - we need to include config.h before any standard headers. * Merge following changes from svn snapshot from Alioth: * Add new fields to appointment for recurring events (SourceForge #304198) * Map IPM.Task items to PST_TYPE_TASK. * Applied patch to remove compiler warnings, thanks! (SourceForge #304314) * Fix crash with unknown reference type * Fix more memory issues detected by valgrind * lspst - add usage mesage and option parsing using getopt (SourceForge #304199) * Fix crash caused by invalid free calls * Fix crash when email subject is empty * Fix memory and information leak in hex debug dump LibPST 0.6.3 (2008-01-13) =============================== * More type consistency issues found by splint. LibPST 0.6.2 (2008-01-12) =============================== * More fixes for Outlook 2003 64 bit parsing. * All buffer sizes changed to size_t, all file offsets changed to off_t, all function names start with pst_, many other type consistency issues found by splint. Many changes to #llx in debug printing for 64 bit items. All id values are now uint64_t. LibPST 0.6.1 (2008-01-06) =============================== * Outlook 2003 64 bit parsing. Some documentation from Alexander Grau and patches from Sean Loaring . * fix from Antonio Palama for email items that happen to have item->contact non null, and were being processed as contacts. * Add large file support so we can read .pst files larger than 2gb. * Change lspst to be similar to readpst, properly using recursion to walk the tree, and testing item types. Add a man page for lspst. LibPST 0.5.12 (2007-10-02) =============================== * security fix from Brad Hards for buffer overruns in liv-zemple decoding for corrupted or malicious pst files. LibPST 0.5.11 (2007-08-24) =============================== * fix from Stevens Miller for unitialized variable. LibPST 0.5.10 (2007-08-20) =============================== * fix yet more valgrind errors - finally have a clean memory check. * restructure readpst.c for proper recursive tree walk. * buffer overrun test was backwards, introduced at 0.5.6 * fix broken email attachments, introduced at 0.5.6 LibPST 0.5.9 (2007-08-12) =============================== * fix more valgrind errors. LibPST 0.5.8 (2007-08-10) =============================== * fix more valgrind errors. lzfu_decompress needs to return the actual buffer size, since the lz header overestimates the size. This caused base64_encode to encode undefined bytes into the email attachment. LibPST 0.5.7 (2007-08-09) =============================== * fix valgrind errors, using uninitialized data. * improve debug logging and readpstlog for indented listings. * cleanup documentation. LibPST 0.5.6 (2007-07-15) =============================== * Fix to allow very small pst files with only one node in the tree. We were mixing signed/unsigned types in comparisons. * More progress decoding the basic structure 7c blocks. Many four byte values may be ID2 indices with data outside the buffer. * Start using doxygen to generate internal documentation. LibPST 0.5.5 (2007-07-10) =============================== * merge the following changes from Joe Nahmias version: * Lots of memory fixes. Thanks to Nigel Horne for his assistance tracking these down! * Fixed creation of vCards from contacts, thanks to Nigel Horne for his help with this! * fix for MIME multipart/alternative attachments. * added -c options to readpst manpage. * use 8.3 attachment filename if long filename isn't available. * new -b option to skip rtf-body.rtf attachments. * fix format of From header lines in mbox files. * Add more appointment fields, thanks to Chris Halls for tracking them down! LibPST 0.5.4 (2006-02-25) =============================== * patches from Arne, adding MH mode, remove leading zeros from the generated numbered filenames starting with one rather than zero. Miscellaneous code cleanup. * document the "7c" descriptor block format. LibPST 0.5.3 (2006-02-20) =============================== * switch to gnu autoconf/automake. This breaks the MS VC++ projects since the source code is now in the src subdirectory. * documentation switched to xml, building man pages and html from the master xml copy. * include rpm .spec file for building src and binary rpms. LibPST 0.5.2 (2006-02-18) =============================== * Added pst2ldif to convert the contacts to ldif format for import into ldap databases. * Major changes to libpst.c to properly use the node depth values from the b-tree nodes. We also use the item count values in the nodes rather than trying to guess how many items are active. * Cleanup whitespace - using tabs for every four columns. LibPST 0.5.1 (17 November 2004) =============================== Well, alot has happened since the last release of libpst. Release / Management: * The project has forked! The new maintainer is Joseph Nahmias. * We have changed hosting sites, thanks to sourceforge for hosting to this point. From this point forward we will be using alioth.debian.org. * The project is now using SubVersioN for source control. You can get the latest code by running: svn co svn://svn.debian.org/svn/libpst/trunk . * See for more information. Code Changes: * Added lspst program to list items in a PST. Still incomplete. * Added vim folding markers to readpst.c * avoid the pseudo-prologue that MS prepends to the email headers * fix build on msvc, since it doesn't have sys/param.h * Re-vamped Makefile: * Only define CFLAGS in Makefileif missing * fixed {un,}install targets in Makefile * Fixed up build process in Makefile * Added mozilla conversion script from David Binard * Fixed bogus creation of readpst.log on every invocation * escaped dashes and apostrophe in manpages * Updated TODO * added manpages from debian pkg * fix escaped-string length count to consider '\n', thanks to Paul Bakker . * ensure there's a blank line between header and body patch from (SourceForge #890745). * Apply accumulated endian-related patches * Removed unused files, upstream's debian/ dir -- Joe Nahmias LibPST v0.5 =========== It is with GREAT relief that I bring you version 0.5 of the LibPST tools! Through great difficulties, this tool has survived and expanded to become even better. The changes are as follows: * RTF support. We can now decompress RTF bodies in emails, and are saved as attachments * Better support in reading the indexes. Fixed many bugs with them * Improved reliability. "Now we are getting somewhere!" * Improved compiling. Hopefully we won't be hitting too many compile errors now. * vCard handling. Contacts are now exported as vCard entries. * vEvent handling. Support has begun on exporting Calendar entries as events * Support for Journal entries has also begun If you have any problems with this release, don't hesitate to contact me. These changes come to you, as always, free under the GPL license!! What a wonderful thing it is. It does mean that you can write your own program off of this library and distribute it also for free. However, anyone with commercial interests for developing applications they will be charging for are encouraged to get in touch with me, as I am sure we can come to some arrangement. Dave Smith LibPST v0.4.3 ============= Bug fix release. No extra functionality Dave Smith LibPST v0.4.2 ============= The debug system has had an overhaul. The debug messages are no longer printed to the screen when they are enabled. They are dumped to a binary file. There is another utility called "readlog" that I have written to handle these log files. It should make it easier to selectively view bits of a log file. It also shows the position that the log message was printed from. There is a new switch in readpst. It is -d. It enables the user to specify the log file which the binary log is written to. If the switch isn't used, the default file of "readpst.log" is used. The code is now Visual C++ compatible. It has compiled on Visual C++ .net Standard edition, and produces the readpst.exe file. Use the project file included in this distribution. There have been minor improvements elsewhere too. LibPST v0.4.1 ============= Fixed a couple more bugs. Is it me or do bugs just insert themselves in random, hard to find places! Cured a few problems with regard to emails with multiple embeded items. They are not fully re-created using Mime-types, but are accessible with the -S switch (which saves everything as seperate items) Fixed a problem reading the first index. Back sliders are now detected. (ie when the value following the current one is smaller, not bigger!) Added some error messages when we try and read outside of the PST file, this was causing a few problems before, cause the return value wasn't always checked, so it was possible to be reading random data, and trying to make sense of it! Anyway, if you find any problems, don't hesitate to mail me Dave Smith LibPST v0.4 =========== Fixed a nasty bug that occasionally corrupted attachments. Another bug with regard to reading of indexes (also occasional). Another output method has been added which is called "Seperate". It is activated with the -S switch. It operates in the following manor: |--Inbox-->000000 | 000001 | 000002 |--Sentmail-->0000000 | 0000001 | 0000002 All the emails are stored in seperate files counting from 0 upwards, in a folder named as the PST folder. When an email has an attachment, it is saved as a seperate file. The filename for the attachment is made up of 2 parts, the first is the email number to which it belongs, the second is its filename. The should now be runnable on big-endian machines, if the define.h file is first modified. The #define LITTLE_ENDIAN must be commented out, and the #define BIG_ENDIAN must be uncommented. More verbose error messages have been added. Apparently people got confused when the program stopped for no visible reason. This has now been resolved. Thanks for the continued support of all people involved. Dave Smith Libpst v0.3.4 ============= Several more fixes. An Infinite loop and incorrect interpreting of item index attributes. Work has started on making the code executable on big endian CPUs. At present it should work with Linux on these CPUs, but I would appreciate it if you could provide feedback with regard to it's performance. I am also working with some other people at make it operate on Solaris. A whole load more items are now recognized by the Item records. With more items in Emails and Folders. I haven't got to the Contacts yet. Anyway, this is what I would call a minor feature enhancment and bugfix release. Dave Smith LibPST v0.3.3 ============= Fixed several items. Mainly memory leaks. Loads of them! oops.. I have added a new program, mainly of debugging, which when passed an ID value and a pst file, will extract and decrypt that ID from the pst file. I don't see it being a huge attraction, or of much use to most people, but it is another example of writing an application to use the libpst interface. Another fix was in the reading of the item index. This has hopefully now been corrected. The result of this bug was that not all the emails in a folder were converted. Hopefully you should have more luck now. Dave Smith LibPST v0.3.2 ============= Quick bugfix release. There was a bug in the decryption of the basic encryption that outlook uses. One byte, 0x6c, was incorrectly decrypted to 0x6c instead of 0xcd. This release fixes this bug. Sorry... LibPST v0.3.1 ============= Minor improvements. Fixed bug when linking multiple blocks together, so now the linking blocks are not "encrypted" when trying to read them. LibPST v0.3 =========== A lot of bug fixing has been done for this release. Testing has been done on the creation of the files by readpst. Better handling of large binaries being extracted from the PST file has been implemented. Quite a few reports have come in about not being able to compile on Darwin. This could be down to using macros with variable parameter lists. This has now been changed to use C functions with variable parameters. I hope this fixes a lot of problems. Added support for recreating the folder structure into normal directories. For Instance: Personal Folders |-Inbox | |-Jokes | |-Meetings |-Send Items each folder containing an mbox file with the correct emails for that folder. Dave Smith LibPST v0.3 beta1 ================= Again, a shed load of enhancements. More work has been done on the mime creation. A bug has been fixed that was letting part of the attachments that were created disappear. A major enhancement is that "compressible encryption" support has been added. This was an incredibly simple method to use. It is basically a ceasar cipher. It has been noted by several users already that the PST password that Outlook uses, serves *no purpose*. It is not used to encrypt the PST, it is mearly stored there. This means that the readpst application is able to convert PST files without knowing the password. Microsoft have some explaning to do! Output files are now not overwritten if they already exist. This means that if you have two folders in your PST file named "fred", the first one encountered will be named "fred" and the second one will be named "fred00000001". As you can see, there is enough room there for many duplicate names! Output filenames are now restricted. Any "/" or "\" characters in the name are replaced with "_". If you find that there are any other characters that need to be changed, could you please make me aware! Thanks to Berry Wizard for help with supporting the encryption. Thanks to Auke Kok, Carolus Walraven and Yogesh Kumar Guatam for providing debugging information and testing. Dave Smith LibPST v0.2 beta1 ================= Hello once more... Attachments are now re-created in mime format. The method is very crude and could be prone to over generalisation. Please test this version, and if attachments are not recreated correctly, please send me the email (complete message source) of the original and converted. Cheers. I hope this will work for everyone who uses this program, but reality can be very different! Let us see how it goes... Dave Smith LibPST v0.2 alpha1 =========== Hello! Some improvements. The internal code has been changed so that attachments are now processed and loaded into the structures. The readpst program is not finished yet. It needs to convert these binary structs into mime data. At present it just saves them to the current directory, overwriting any previous files with the attachment name. Improvements over previous version: * KMail output is supported - if the "-k" flag is specified, all the directory hierarchy is created using the KMail standard * Lots of bugs and memory leaks fixed Usage: ReadPST v0.2alpha1 implementing LibPST v0.2alpha1 Usage: ./readpst [OPTIONS] {PST FILENAME} OPTIONS: -h - Help. This screen -k - KMail. Output in kmail format -o - Output Dir. Directory to write files to. CWD is changed *after* opening pst file -V - Version. Display program version If you want to view lots of debug output, modify a line in "define.h" from "//#define DEBUG_ALL" to "#define DEBUG_ALL". It would then be advisable to pipe all output to a log file: ./readpst -o out pst_file &> logfile Dave Smith LibPST v0.1 =========== Hi Folks! This has been a long, hard slog, but I now feel that I have got somewhere useful. The included program "main" is able to read an Outlook PST file and dump the emails into mbox files, separating each folder into a different mbox file. All the mbox files are stored in the current directory and no attempt is yet made to organise these files into a directory hierarchy. This would not be too difficult to achieve though. Email attachments are not yet handled, neither are Contacts. There is no pretty interface yet, but you can convert a PST file in the following manner ./main {path to PST file} This is very much a work in progress, but I thought I should release this code so that people can lose their conception that outlook files will never be converted to Linux. I am intending that the code I am writing will be developed into greater applications to provide USEFUL tools for accessing and converting PST files into a variety of formats. One point I feel I should make is that Outlook, by default, creates "Compressible Encryption" PST files. I have not, as yet, attempted to write any decryption routines, so you will not be able to convert these files. However, if you create a new PST file and choose not to make an encrypted one, you can copy all your emails into this new one and then convert the unencrypted one. I hope you enjoy, Dave Smith diff --git a/configure.in b/configure.in index 67f0b76..77c2f87 100644 --- a/configure.in +++ b/configure.in @@ -1,393 +1,393 @@ AC_PREREQ(2.60) -AC_INIT(libpst,0.6.71,carl@five-ten-sg.com) +AC_INIT(libpst,0.6.72,carl@five-ten-sg.com) AC_CONFIG_SRCDIR([src/libpst.c]) AC_CONFIG_HEADER([config.h]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE AC_CANONICAL_HOST AC_USE_SYSTEM_EXTENSIONS # # 1. Remember that version-info is current:revision:age, and age <= current. # 2. If the source code has changed at all since the last public release, # then increment revision (`c:r:a' becomes `c:r+1:a'). # 3. If any interfaces have been added, removed, or changed since the last # update, increment current, and set revision to 0. # 4. If any interfaces have been added since the last public release, then # increment age, since we should be backward compatible with the previous # version. # 5. If any interfaces have been removed or changed since the last public # release, then set age to 0, since we are not backward compatible. # 6. libtool will build libpst.so.x.y.z where the SONAME is libpst.so.x # and x=current-age, y=age, z=revision libpst_version_info='5:14:1' AC_SUBST(LIBPST_VERSION_INFO, [$libpst_version_info]) libpst_so_major='4' AC_SUBST(LIBPST_SO_MAJOR, [$libpst_so_major]) # libpst # version soname so library name # 0.6.35 libpst.so.2 libpst.so.2.0.0 # 0.6.37 libpst.so.2 libpst.so.2.1.0 # 0.6.38 libpst.so.2 libpst.so.2.1.0 # 0.6.40 libpst.so.4 libpst.so.4.0.0 # 0.6.43 libpst.so.4 libpst.so.4.0.1 # 0.6.47 libpst.so.4 libpst.so.4.0.2 # 0.6.48 libpst.so.4 libpst.so.4.0.3 # 0.6.49 libpst.so.4 libpst.so.4.0.4 # 0.6.50 libpst.so.4 libpst.so.4.1.0 # 0.6.51 libpst.so.4 libpst.so.4.1.1 # 0.6.52 libpst.so.4 libpst.so.4.1.2 # 0.6.53 libpst.so.4 libpst.so.4.1.3 # 0.6.54 libpst.so.4 libpst.so.4.1.4 # 0.6.55 libpst.so.4 libpst.so.4.1.5 # 0.6.56 libpst.so.4 libpst.so.4.1.6 # 0.6.57 libpst.so.4 libpst.so.4.1.6 # 0.6.58 libpst.so.4 libpst.so.4.1.7 # 0.6.59 libpst.so.4 libpst.so.4.1.8 # 0.6.60 libpst.so.4 libpst.so.4.1.9 # 0.6.61 libpst.so.4 libpst.so.4.1.9 # 0.6.62 libpst.so.4 libpst.so.4.1.9 # 0.6.63 libpst.so.4 libpst.so.4.1.10 # 0.6.66 libpst.so.4 libpst.so.4.1.11 # 0.6.67 libpst.so.4 libpst.so.4.1.12 # 0.6.68 libpst.so.4 libpst.so.4.1.13 # 0.6.69 libpst.so.4 libpst.so.4.1.14 # Check for solaris AC_MSG_CHECKING([for Solaris]) case "$host" in *solaris*) os_solaris=yes ;; *) os_solaris=no ;; esac AC_MSG_RESULT($os_solaris) AM_CONDITIONAL(OS_SOLARIS, [test "$os_solaris" = "yes"]) # Check for win32 AC_MSG_CHECKING([for Win32]) case "$host" in *-mingw*) os_win32=yes ;; *) os_win32=no ;; esac AC_MSG_RESULT($os_win32) AM_CONDITIONAL(OS_WIN32, [test "$os_win32" = "yes"]) # Check for Win32 platform AC_MSG_CHECKING([for Win32 platform in general]) case "$host" in *-cygwin*) platform_win32=yes ;; *) platform_win32=$os_win32 ;; esac AC_MSG_RESULT($platform_win32) AM_CONDITIONAL(PLATFORM_WIN32, [test "$platform_win32" = "yes"]) # Checks for programs. # The following lines adds the --enable-dii option to configure: # # Give the user the choice to enter one of these: # --enable-dii # --enable-dii=yes # --enable-dii=no # AC_MSG_CHECKING([whether we are enabling dii utility]) AC_ARG_ENABLE(dii, AC_HELP_STRING([--enable-dii], [enable dii utility]), [ case "${enableval}" in yes) ;; no) ;; *) AC_MSG_ERROR(bad value ${enableval} for --enable-dii) ;; esac ], # default if not specified enable_dii=yes ) AC_MSG_RESULT([$enable_dii]) AC_PATH_PROG(CONVERT, convert) if test "x$CONVERT" = "x" ; then if test "$enable_dii" = "yes"; then enable_dii=no AC_MSG_WARN([convert program not found. pst2dii disabled]) fi else if test "x`$CONVERT --version 2>&1 | grep -i imagemagick >/dev/null ; echo $?`" != "x0"; then if test "$enable_dii" = "yes"; then enable_dii=no AC_MSG_WARN([wrong convert program found. pst2dii disabled]) fi fi fi AC_CHECK_HEADER([gd.h], [ AC_DEFINE([HAVE_GD_H], [1], [Define to 1 if you have the header file.]) ], [ if test "$enable_dii" = "yes"; then enable_dii=no AC_MSG_WARN([gd.h not found. pst2dii disabled]) fi ]) AM_CONDITIONAL(BUILD_DII, [test "$enable_dii" = "yes"]) # Checks for programs. AC_PROG_CXX AC_PROG_CC AM_PROG_CC_C_O AC_PROG_CPP AC_PROG_INSTALL AC_PROG_LN_S AC_PROG_LIBTOOL AC_PROG_MAKE_SET # make sure we get large file support AC_SYS_LARGEFILE AC_CHECK_SIZEOF(off_t) # Checks for header files. AC_CHECK_HEADER([unistd.h], AM_CONDITIONAL(NEED_XGETOPT, [test yes = no]), AM_CONDITIONAL(NEED_XGETOPT, [test yes = yes]) ) AC_HEADER_DIRENT AC_HEADER_STDC AC_CHECK_HEADERS([ctype.h dirent.h errno.h fcntl.h inttypes.h limits.h regex.h semaphore.h signal.h stdarg.h stdint.h stdio.h stdlib.h string.h sys/param.h sys/shm.h sys/stat.h sys/types.h time.h unistd.h wchar.h]) AC_SEARCH_LIBS([sem_init],[pthread rt]) # Checks for typedefs, structures, and compiler characteristics. AC_HEADER_STDBOOL AC_HEADER_SYS_WAIT AC_C_CONST AC_C_INLINE AC_TYPE_OFF_T AC_TYPE_SIZE_T AC_TYPE_PID_T AC_STRUCT_TM # Checks for library functions. AC_FUNC_FORK AC_FUNC_FSEEKO AC_FUNC_STAT AC_FUNC_LSTAT AC_FUNC_LSTAT_FOLLOWS_SLASHED_SYMLINK if test "$cross_compiling" != "yes"; then AC_FUNC_MALLOC AC_FUNC_MKTIME AC_FUNC_REALLOC fi AC_FUNC_STRFTIME AC_FUNC_VPRINTF AC_CHECK_FUNCS([chdir getcwd memchr memmove memset regcomp strcasecmp strncasecmp strchr strdup strerror strpbrk strrchr strstr strtol get_current_dir_name]) AM_ICONV if test "$am_cv_func_iconv" != "yes"; then AC_MSG_ERROR([libpst requires iconv which is missing]) fi AC_CHECK_FUNCS(regexec,,[AC_CHECK_LIB(regex,regexec, [REGEXLIB=-lregex AC_DEFINE(HAVE_REGEXEC,1,[Define to 1 if you have the regexec function.])], [AC_MSG_ERROR([No regex library found])])]) AC_SUBST(REGEXLIB) # The following lines adds the --enable-pst-debug option to configure: # # Give the user the choice to enter one of these: # --enable-pst-debug # --enable-pst-debug=yes # --enable-pst-debug=no # AC_MSG_CHECKING([whether we are forcing debug dump file creation]) AC_ARG_ENABLE(pst-debug, AC_HELP_STRING([--enable-pst-debug], [force debug dump file creation]), [ case "${enableval}" in yes) ;; no) ;; *) AC_MSG_ERROR(bad value ${enableval} for --enable-pst-debug) ;; esac ], # default if not specified enable_pst_debug=no ) AC_MSG_RESULT([$enable_pst_debug]) if test "$enable_pst_debug" = "yes"; then AC_DEFINE(DEBUG_ALL, 1, Define to 1 to force debug dump file creation) fi # The following lines adds the --enable-libpst-shared option to configure: # # Give the user the choice to enter one of these: # --enable-libpst-shared # --enable-libpst-shared=yes # --enable-libpst-shared=no # AC_MSG_CHECKING([whether we are building libpst shared object]) AC_ARG_ENABLE(libpst-shared, AC_HELP_STRING([--enable-libpst-shared], [build libpst shared object]), [ case "${enableval}" in yes) ;; no) ;; *) AC_MSG_ERROR(bad value ${enableval} for --enable-libpst-shared) ;; esac ], # default if not specified enable_libpst_shared=no ) AC_MSG_RESULT([$enable_libpst_shared]) enable_static_tools=yes if test "$enable_libpst_shared" = "yes"; then enable_shared=yes enable_static_tools=no fi # needed by STATIC_TOOLS in src/Makefile.am AC_SUBST(PST_OBJDIR, [$objdir]) # The following lines adds the --enable-static-tools option to configure: # # Give the user the choice to enter one of these: # --enable-static-tools # --enable-static-tools=yes # --enable-static-tools=no # AC_MSG_CHECKING([whether to link command line tools with libpst statically]) AC_ARG_ENABLE([static-tools], AC_HELP_STRING([--enable-static-tools], [link command line tools with libpst statically]), [ case "${enableval}" in yes) ;; no) ;; *) AC_MSG_ERROR(bad value ${enableval} for --enable-static-tools) ;; esac ], [ enable_static_tools=no ]) AC_MSG_RESULT([$enable_static_tools]) AM_CONDITIONAL(STATIC_TOOLS, [test "$enable_static_tools" = "yes"]) if test "$enable_static_tools" = "yes"; then enable_static="yes" fi # The following lines adds the --enable-python option to configure: # # Give the user the choice to enter one of these: # --enable-python # --enable-python=yes # --enable-python=no # AC_MSG_CHECKING([whether to build the libpst python interface]) AC_ARG_ENABLE([python], AC_HELP_STRING([--enable-python], [build libpst python interface]), [ case "${enableval}" in yes) ;; no) ;; *) AC_MSG_ERROR(bad value ${enableval} for --python) ;; esac ], [ enable_python=yes ]) AC_MSG_RESULT([$enable_python]) AM_CONDITIONAL(PYTHON_INTERFACE, [test "$enable_python" = "yes"]) if test "$enable_python" = "yes"; then enable_shared="yes" # get the version of installed python AX_PYTHON if test "$ax_python_bin" = "no"; then AC_MSG_ERROR(python binary not found) fi py_ver=`echo $ax_python_bin | cut -c7-` # find the flags for that version AC_PYTHON_DEVEL([$py_ver]) PYTHON_INCLUDE_DIR=`echo $python_path | cut -c3-` AC_SUBST([PYTHON_INCLUDE_DIR]) # do we have boost python AX_BOOST_PYTHON if test "$ac_cv_boost_python" = "no"; then AC_MSG_ERROR(boost python not found) fi AC_SUBST(PYTHON_VERSION, [$ax_python_bin]) fi # The following lines adds the --enable-profiling option to configure: # # Give the user the choice to enter one of these: # --enable-profiling # --enable-profiling=yes # --enable-profiling=no # AC_MSG_CHECKING([whether to link with gprof profiling]) AC_ARG_ENABLE([profiling], AC_HELP_STRING([--enable-profiling], [link with gprof profiling]), [ case "${enableval}" in yes) CFLAGS="$CFLAGS -pg" CPPFLAGS="$CPPFLAGS -pg" CXXFLAGS="$CXXFLAGS -pg" ;; no) ;; *) AC_MSG_ERROR(bad value ${enableval} for --profiling) ;; esac ], [ enable_profiling=no ]) AC_MSG_RESULT([$enable_profiling]) AM_CONDITIONAL(GPROF_PROFILING, [test "$enable_profiling" = "yes"]) gsf_flags="`pkg-config libgsf-1 --cflags`" gsf_libs="`pkg-config libgsf-1 --libs`" if test "$gsf_flags" = ""; then AC_MSG_ERROR(libgsf not found) fi AC_SUBST(GSF_FLAGS, [$gsf_flags]) AC_SUBST(GSF_LIBS, [$gsf_libs]) PKG_CHECK_MODULES([ZLIB], [zlib]) AC_OUTPUT( \ Makefile \ html/Makefile \ libpst.pc \ libpst.spec \ man/Makefile \ src/Makefile \ src/pst2dii.cpp \ python/Makefile \ xml/Makefile \ xml/libpst \ ) diff --git a/src/define.h b/src/define.h index 44f2c6f..df6fcc3 100644 --- a/src/define.h +++ b/src/define.h @@ -1,260 +1,261 @@ /*** * define.h * Part of the LibPST project * Written by David Smith * dave.s@earthcorp.com */ #ifndef DEFINEH_H #define DEFINEH_H #ifdef HAVE_CONFIG_H #include "config.h" #endif #include "libpst.h" #include "timeconv.h" #include "libstrfunc.h" #include "vbuf.h" #ifdef HAVE_STRING_H #include #endif #ifdef HAVE_CTYPE_H #include #endif #ifdef HAVE_LIMITS_H #include #endif #ifdef HAVE_WCHAR_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif #ifdef HAVE_ERRNO_H #include #endif #ifdef HAVE_ICONV #include #endif #ifdef HAVE_REGEX_H #include #endif #ifdef HAVE_GD_H #include #endif #define PERM_DIRS 0777 #ifdef _WIN32 #include #define D_MKDIR(x) mkdir(x) #define chdir _chdir #define strcasecmp _stricmp #define vsnprintf _vsnprintf #define snprintf _snprintf #ifdef _MSC_VER #define ftello _ftelli64 #define fseeko _fseeki64 #elif defined (__MINGW32__) #define ftello ftello64 #define fseeko fseeko64 #else #error Only MSC and mingw supported for Windows #endif #ifndef UINT64_MAX #define UINT64_MAX ((uint64_t)0xffffffffffffffff) #endif #ifndef PRIx64 #define PRIx64 "I64x" #endif int __cdecl _fseeki64(FILE *, __int64, int); __int64 __cdecl _ftelli64(FILE *); #ifdef __MINGW32__ #include #else #include "XGetopt.h" #endif #include #undef gmtime_r #define gmtime_r(tp,tmp) (gmtime(tp)?(*(tmp)=*gmtime(tp),(tmp)):0) #define ctime_r(tp,tmp) (ctime(tp)?(strcpy((tmp),ctime((tp))),(tmp)):0) #else #ifdef __DJGPP__ #define gmtime_r(tp,tmp) (gmtime(tp)?(*(tmp)=*gmtime(tp),(tmp)):0) #define ctime_r(tp,tmp) (ctime(tp)?(strcpy((tmp),ctime((tp))),(tmp)):0) #define fseeko(stream, offset, whence) fseek(stream, (long)offset, whence) #define ftello ftell #endif #ifdef HAVE_UNISTD_H #include #else #include "XGetopt.h" #endif #define D_MKDIR(x) mkdir(x, PERM_DIRS) #endif #ifdef HAVE_SYS_STAT_H #include #endif #ifdef HAVE_SYS_TYPES_H #include #endif #ifdef HAVE_SYS_SHM_H #include #endif #ifdef HAVE_SYS_WAIT_H #include #endif #ifdef HAVE_DIRENT_H #include #endif #ifdef HAVE_SEMAPHORE_H #include #endif void pst_debug_lock(); void pst_debug_unlock(); void pst_debug_setlevel(int level); void pst_debug_init(const char* fname, void* output_mutex); void pst_debug_func(int level, const char* function); void pst_debug_func_ret(int level); void pst_debug(int level, int line, const char *file, const char *fmt, ...); void pst_debug_hexdump(int level, int line, const char *file, const char* buf, size_t size, int cols, int delta); void pst_debug_hexdumper(FILE* out, const char* buf, size_t size, int cols, int delta); void pst_debug_close(); void* pst_malloc(size_t size); void *pst_realloc(void *ptr, size_t size); #define MESSAGEPRINT1(...) pst_debug(1, __LINE__, __FILE__, __VA_ARGS__) #define MESSAGEPRINT2(...) pst_debug(2, __LINE__, __FILE__, __VA_ARGS__) #define MESSAGEPRINT3(...) pst_debug(3, __LINE__, __FILE__, __VA_ARGS__) #define WARN(x) { \ MESSAGEPRINT3 x; \ pst_debug_lock(); \ printf x; \ fflush(stdout); \ pst_debug_unlock(); \ } #define DIE(x) { \ WARN(x); \ exit(EXIT_FAILURE); \ } #define DEBUG_WARN(x) MESSAGEPRINT3 x #define DEBUG_INFO(x) MESSAGEPRINT2 x #define DEBUG_HEXDUMP(x, s) pst_debug_hexdump(1, __LINE__, __FILE__, (char*)x, s, 0x10, 0) #define DEBUG_HEXDUMPC(x, s, c) pst_debug_hexdump(1, __LINE__, __FILE__, (char*)x, s, c, 0) #define DEBUG_ENT(x) \ { \ pst_debug_func(1, x); \ pst_debug(1, __LINE__, __FILE__, "Entering function\n"); \ } #define DEBUG_RET() \ { \ pst_debug(1, __LINE__, __FILE__, "Leaving function\n"); \ pst_debug_func_ret(1); \ } #define DEBUG_INIT(fname,mutex) {pst_debug_init(fname,mutex);} #define DEBUG_CLOSE() {pst_debug_close();} #define RET_DERROR(res, ret_val, x) if (res) { DIE(x);} #if BYTE_ORDER == BIG_ENDIAN # define LE64_CPU(x) \ x = ((((x) & UINT64_C(0xff00000000000000)) >> 56) | \ (((x) & UINT64_C(0x00ff000000000000)) >> 40) | \ (((x) & UINT64_C(0x0000ff0000000000)) >> 24) | \ (((x) & UINT64_C(0x000000ff00000000)) >> 8 ) | \ (((x) & UINT64_C(0x00000000ff000000)) << 8 ) | \ (((x) & UINT64_C(0x0000000000ff0000)) << 24) | \ (((x) & UINT64_C(0x000000000000ff00)) << 40) | \ (((x) & UINT64_C(0x00000000000000ff)) << 56)); # define LE32_CPU(x) \ x = ((((x) & 0xff000000) >> 24) | \ (((x) & 0x00ff0000) >> 8 ) | \ (((x) & 0x0000ff00) << 8 ) | \ (((x) & 0x000000ff) << 24)); # define LE16_CPU(x) \ x = ((((x) & 0xff00) >> 8) | \ (((x) & 0x00ff) << 8)); #elif BYTE_ORDER == LITTLE_ENDIAN # define LE64_CPU(x) {} # define LE32_CPU(x) {} # define LE16_CPU(x) {} #else # error "Byte order not supported by this library" #endif // BYTE_ORDER #define PST_LE_GET_UINT64(p) \ (uint64_t)((((uint8_t const *)(p))[0] << 0) | \ (((uint8_t const *)(p))[1] << 8) | \ (((uint8_t const *)(p))[2] << 16) | \ (((uint8_t const *)(p))[3] << 24) | \ (((uint8_t const *)(p))[4] << 32) | \ (((uint8_t const *)(p))[5] << 40) | \ (((uint8_t const *)(p))[6] << 48) | \ (((uint8_t const *)(p))[7] << 56)) #define PST_LE_GET_INT64(p) \ (int64_t)((((uint8_t const *)(p))[0] << 0) | \ (((uint8_t const *)(p))[1] << 8) | \ (((uint8_t const *)(p))[2] << 16) | \ (((uint8_t const *)(p))[3] << 24) | \ (((uint8_t const *)(p))[4] << 32) | \ (((uint8_t const *)(p))[5] << 40) | \ (((uint8_t const *)(p))[6] << 48) | \ (((uint8_t const *)(p))[7] << 56)) #define PST_LE_GET_UINT32(p) \ (uint32_t)((((uint8_t const *)(p))[0] << 0) | \ (((uint8_t const *)(p))[1] << 8) | \ (((uint8_t const *)(p))[2] << 16) | \ (((uint8_t const *)(p))[3] << 24)) #define PST_LE_GET_INT32(p) \ (int32_t)((((uint8_t const *)(p))[0] << 0) | \ (((uint8_t const *)(p))[1] << 8) | \ (((uint8_t const *)(p))[2] << 16) | \ (((uint8_t const *)(p))[3] << 24)) #define PST_LE_GET_UINT16(p) \ (uint16_t)((((uint8_t const *)(p))[0] << 0) | \ (((uint8_t const *)(p))[1] << 8)) #define PST_LE_GET_INT16(p) \ (int16_t)((((uint8_t const *)(p))[0] << 0) | \ (((uint8_t const *)(p))[1] << 8)) #define PST_LE_GET_UINT8(p) (*(uint8_t const *)(p)) #define PST_LE_GET_INT8(p) (*(int8_t const *)(p)) +#define MAXDATEFMTLEN 40 #endif //DEFINEH_H diff --git a/src/lspst.c b/src/lspst.c index e4652bf..f2886de 100644 --- a/src/lspst.c +++ b/src/lspst.c @@ -1,267 +1,312 @@ /*** * lspst.c * Part of the LibPST project * Author: Joe Nahmias * Based on readpst.c by by David Smith * */ #include "define.h" struct file_ll { char *dname; int32_t stored_count; int32_t item_count; int32_t skip_count; int32_t type; }; +struct options { + int long_format; + char *date_format; +}; void canonicalize_filename(char *fname); void debug_print(char *fmt, ...); void usage(char *prog_name); void version(); // global settings pst_file pstfile; void create_enter_dir(struct file_ll* f, pst_item *item) { pst_convert_utf8(item, &item->file_as); f->item_count = 0; f->skip_count = 0; f->type = item->type; f->stored_count = (item->folder) ? item->folder->item_count : 0; f->dname = strdup(item->file_as.str); } void close_enter_dir(struct file_ll *f) { free(f->dname); } - -void process(pst_item *outeritem, pst_desc_tree *d_ptr) +void process(pst_item *outeritem, pst_desc_tree *d_ptr, struct options o) { struct file_ll ff; pst_item *item = NULL; char *result = NULL; size_t resultlen = 0; + size_t dateresultlen; DEBUG_ENT("process"); memset(&ff, 0, sizeof(ff)); create_enter_dir(&ff, outeritem); while (d_ptr) { if (!d_ptr->desc) { DEBUG_WARN(("ERROR item's desc record is NULL\n")); ff.skip_count++; } else { DEBUG_INFO(("Desc Email ID %"PRIx64" [d_ptr->d_id = %"PRIx64"]\n", d_ptr->desc->i_id, d_ptr->d_id)); item = pst_parse_item(&pstfile, d_ptr, NULL); DEBUG_INFO(("About to process item @ %p.\n", item)); if (item) { if (item->message_store) { // there should only be one message_store, and we have already done it DIE(("A second message_store has been found. Sorry, this must be an error.\n")); } if (item->folder && d_ptr->child) { // if this is a folder, we want to recurse into it pst_convert_utf8(item, &item->file_as); printf("Folder \"%s\"\n", item->file_as.str); - process(item, d_ptr->child); + process(item, d_ptr->child, o); } else if (item->contact && (item->type == PST_TYPE_CONTACT)) { if (!ff.type) ff.type = item->type; // Process Contact item if (ff.type != PST_TYPE_CONTACT) { DEBUG_INFO(("I have a contact, but the folder isn't a contacts folder. Processing anyway\n")); } printf("Contact"); if (item->contact->fullname.str) printf("\t%s", pst_rfc2426_escape(item->contact->fullname.str, &result, &resultlen)); printf("\n"); } else if (item->email && ((item->type == PST_TYPE_NOTE) || (item->type == PST_TYPE_SCHEDULE) || (item->type == PST_TYPE_REPORT))) { if (!ff.type) ff.type = item->type; // Process Email item if ((ff.type != PST_TYPE_NOTE) && (ff.type != PST_TYPE_SCHEDULE) && (ff.type != PST_TYPE_REPORT)) { DEBUG_INFO(("I have an email, but the folder isn't an email folder. Processing anyway\n")); } printf("Email"); + if (o.long_format == 1) { + if (item->email->arrival_date) { + char time_buffer[MAXDATEFMTLEN]; + dateresultlen = pst_fileTimeToString(item->email->arrival_date, o.date_format, time_buffer); + if (dateresultlen < 1) + DIE(("Date format error in -f option.\n")); + printf("\tDate: %s", time_buffer); + } + else + printf("\t"); + } if (item->email->outlook_sender_name.str) printf("\tFrom: %s", item->email->outlook_sender_name.str); + else + printf("\t"); + if (o.long_format == 1) { + if (item->email->outlook_recipient_name.str) + printf("\tTo: %s", item->email->outlook_recipient_name.str); + else + printf("\t"); + if (item->email->cc_address.str) + printf("\tCC: %s", item->email->cc_address.str); + else + printf("\t"); + if (item->email->bcc_address.str) + printf("\tBCC: %s", item->email->bcc_address.str); + else + printf("\t"); + } if (item->subject.str) printf("\tSubject: %s", item->subject.str); + else + printf("\t"); printf("\n"); } else if (item->journal && (item->type == PST_TYPE_JOURNAL)) { if (!ff.type) ff.type = item->type; // Process Journal item if (ff.type != PST_TYPE_JOURNAL) { DEBUG_INFO(("I have a journal entry, but folder isn't specified as a journal type. Processing...\n")); } if (item->subject.str) printf("Journal\t%s\n", pst_rfc2426_escape(item->subject.str, &result, &resultlen)); } else if (item->appointment && (item->type == PST_TYPE_APPOINTMENT)) { char time_buffer[30]; if (!ff.type) ff.type = item->type; // Process Calendar Appointment item DEBUG_INFO(("Processing Appointment Entry\n")); if (ff.type != PST_TYPE_APPOINTMENT) { DEBUG_INFO(("I have an appointment, but folder isn't specified as an appointment type. Processing...\n")); } printf("Appointment"); if (item->subject.str) printf("\tSUMMARY: %s", pst_rfc2426_escape(item->subject.str, &result, &resultlen)); if (item->appointment->start) printf("\tSTART: %s", pst_rfc2445_datetime_format(item->appointment->start, sizeof(time_buffer), time_buffer)); if (item->appointment->end) printf("\tEND: %s", pst_rfc2445_datetime_format(item->appointment->end, sizeof(time_buffer), time_buffer)); printf("\tALL DAY: %s", (item->appointment->all_day==1 ? "Yes" : "No")); printf("\n"); } else { ff.skip_count++; DEBUG_INFO(("Unknown item type. %i. Ascii1=\"%s\"\n", item->type, item->ascii_type)); } pst_freeItem(item); } else { ff.skip_count++; DEBUG_INFO(("A NULL item was seen\n")); } } d_ptr = d_ptr->next; } close_enter_dir(&ff); if (result) free(result); DEBUG_RET(); } void usage(char *prog_name) { DEBUG_ENT("usage"); version(); printf("Usage: %s [OPTIONS] {PST FILENAME}\n", prog_name); printf("OPTIONS:\n"); printf("\t-d \t- Debug to file. This is a binary log. Use readlog to print it\n"); + printf("\t-l\t- Print the date, CC and BCC fields of emails too (by default only the From and Subject)\n"); + printf("\t-f \t- Select the date format in ctime format (by default \"%%F %%T\")\n"); printf("\t-h\t- Help. This screen\n"); printf("\t-V\t- Version. Display program version\n"); DEBUG_RET(); } void version() { DEBUG_ENT("version"); printf("lspst / LibPST v%s\n", VERSION); #if BYTE_ORDER == BIG_ENDIAN printf("Big Endian implementation being used.\n"); #elif BYTE_ORDER == LITTLE_ENDIAN printf("Little Endian implementation being used.\n"); #else # error "Byte order not supported by this library" #endif DEBUG_RET(); } int main(int argc, char* const* argv) { pst_item *item = NULL; pst_desc_tree *d_ptr; char *temp = NULL; //temporary char pointer int c; char *d_log = NULL; + struct options o; + o.long_format = 0; + char *defaultfmtdate = "%F %T"; + o.date_format = defaultfmtdate; - while ((c = getopt(argc, argv, "d:hV"))!= -1) { + while ((c = getopt(argc, argv, "d:f:lhV"))!= -1) { switch (c) { case 'd': d_log = optarg; break; + case 'f': + o.date_format = optarg; + break; + case 'l': + o.long_format = 1; + break; case 'h': usage(argv[0]); exit(0); break; case 'V': version(); exit(0); break; default: usage(argv[0]); exit(1); break; } } #ifdef DEBUG_ALL // force a log file if (!d_log) d_log = "lspst.log"; #endif // defined DEBUG_ALL DEBUG_INIT(d_log, NULL); DEBUG_ENT("main"); if (argc <= optind) { usage(argv[0]); exit(2); } // Open PST file if (pst_open(&pstfile, argv[optind], NULL)) DIE(("Error opening File\n")); // Load PST index if (pst_load_index(&pstfile)) DIE(("Index Error\n")); pst_load_extended_attributes(&pstfile); d_ptr = pstfile.d_head; // first record is main record item = pst_parse_item(&pstfile, d_ptr, NULL); if (!item || !item->message_store) { DEBUG_RET(); DIE(("Could not get root record\n")); } // default the file_as to the same as the main filename if it doesn't exist if (!item->file_as.str) { if (!(temp = strrchr(argv[1], '/'))) if (!(temp = strrchr(argv[1], '\\'))) temp = argv[1]; else temp++; // get past the "\\" else temp++; // get past the "/" item->file_as.str = strdup(temp); item->file_as.is_utf8 = 1; } d_ptr = pst_getTopOfFolders(&pstfile, item); if (!d_ptr) DIE(("Top of folders record not found. Cannot continue\n")); - process(item, d_ptr->child); // do the childred of TOPF + process(item, d_ptr->child, o); // do the childred of TOPF pst_freeItem(item); pst_close(&pstfile); DEBUG_RET(); return 0; } // This function will make sure that a filename is in cannonical form. That // is, it will replace any slashes, backslashes, or colons with underscores. void canonicalize_filename(char *fname) { DEBUG_ENT("canonicalize_filename"); if (fname == NULL) { DEBUG_RET(); return; } while ((fname = strpbrk(fname, "/\\:"))) *fname = '_'; DEBUG_RET(); } diff --git a/src/timeconv.c b/src/timeconv.c index 2e34045..69c1b48 100644 --- a/src/timeconv.c +++ b/src/timeconv.c @@ -1,29 +1,34 @@ #include "define.h" char* pst_fileTimeToAscii(const FILETIME* filetime, char* result) { time_t t; t = pst_fileTimeToUnixTime(filetime); return ctime_r(&t, result); } +size_t pst_fileTimeToString(const FILETIME* filetime, const char* date_format, char* result) { + time_t t; + t = pst_fileTimeToUnixTime(filetime); + return strftime(result, MAXDATEFMTLEN-1, date_format, localtime(&t)); +} void pst_fileTimeToStructTM (const FILETIME *filetime, struct tm *result) { time_t t1; t1 = pst_fileTimeToUnixTime(filetime); gmtime_r(&t1, result); } time_t pst_fileTimeToUnixTime(const FILETIME *filetime) { uint64_t t = filetime->dwHighDateTime; const uint64_t bias = 11644473600LL; t <<= 32; t += filetime->dwLowDateTime; t /= 10000000; t -= bias; return ((t > (uint64_t)0x000000007fffffff) && (sizeof(time_t) <= 4)) ? 0 : (time_t)t; } diff --git a/src/timeconv.h b/src/timeconv.h index 2361e56..1b4d577 100644 --- a/src/timeconv.h +++ b/src/timeconv.h @@ -1,31 +1,39 @@ #ifndef __PST_TIMECONV_H #define __PST_TIMECONV_H #include "common.h" #ifdef __cplusplus extern "C" { #endif /** Convert a FILETIME to ascii printable local time. @param[in] filetime time structure to be converted @param[out] result pointer to output buffer, must be at least 30 bytes. @return result pointer to the output buffer */ char* pst_fileTimeToAscii (const FILETIME* filetime, char* result); /** Convert a FILETIME to unix struct tm. @param[in] filetime time structure to be converted @param[out] result pointer to output struct tm */ void pst_fileTimeToStructTM (const FILETIME* filetime, struct tm *result); /** Convert a FILETIME to unix time_t value. @param[in] filetime time structure to be converted @return result time_t value */ time_t pst_fileTimeToUnixTime( const FILETIME* filetime); + + /** Convert a FILETIME to string in date_format format. + @param[in] filetime time structure to be converted + @param[in] string ctime_r format of output date + @param[out] result pointer to output buffer, must be at least 30 bytes. + @return result size_t value returned by strftime + */ + size_t pst_fileTimeToString( const FILETIME* filetime, const char* date_format, char* result); #ifdef __cplusplus } #endif #endif diff --git a/xml/libpst.in b/xml/libpst.in index 25b374d..c5787ee 100644 --- a/xml/libpst.in +++ b/xml/libpst.in @@ -1,2041 +1,2055 @@ @PACKAGE@ Utilities - Version @VERSION@ Packages The various source and binary packages are available at http://www.five-ten-sg.com/@PACKAGE@/packages/. The most recent documentation is available at http://www.five-ten-sg.com/@PACKAGE@/. The most recent developer documentation for the shared library is available at http://www.five-ten-sg.com/@PACKAGE@/devel/. A Mercurial source code repository for this project is available at http://hg.five-ten-sg.com/@PACKAGE@/. This version can now convert both 32 bit Outlook files (pre 2003), and the 64 bit Outlook 2003 pst files. Utilities are supplied to convert email messages to both mbox and MH mailbox formats, and to DII load file format for use with many of the CT Summation products. Contacts can be converted to a simple list, to vcard format, or to ldif format for import to an LDAP server. The libpff project has some excellent documentation of the pst file format. - 2016-08-29 + 2017-12-07 readpst 1 readpst @VERSION@ readpst convert PST (MS Outlook Personal Folders) files to mbox and other formats Synopsis readpst pstfile Description readpst is a program that can read an Outlook PST (Personal Folders) file and convert it into an mbox file, a format suitable for KMail, a recursive mbox structure, or separate emails. Options -C default-charset Set the character set to be used for items with an unspecified character set. -D Include deleted items in the output. -M Output messages in MH (rfc822) format as separate files. This will create folders as named in the PST file, and will put each email together with any attachments into its own file. These files will be numbered from 1 to n with no leading zeros. This format has no from quoting. -S Output messages into separate files. This will create folders as named in the PST file, and will put each email in its own file. These files will be numbered from 1 to n with no leading zeros. Attachments will also be saved in the same folder as the email message. The attachments for message $m are saved as $m-$name where $name is (the original name of the attachment, or 'attach$n' if the attachment had no name), where $n is another sequential index with no leading zeros. This format has no from quoting. -V Show program version and exit. -a attachment-extension-list Set the list of acceptable attachment extensions. Any attachment that does not have an extension on this list will be discarded. All attachments are acceptable if the list is empty, or this option is not specified. -b Do not save the attachments for the RTF format of the email body. -c format Set the Contact output mode. Use -cv for vcard format or -cl for an email list. -d debug-file Specify name of debug log file. The log file is now an ascii file, instead of the binary file used in previous versions. -e Same as the M option, but each output file will include an extension from (.eml, .ics, .vcf). This format has no from quoting. -h Show summary of options and exit. -j jobs Specifies the maximum number of parallel jobs. Specify 0 to suppress running parallel jobs. Folders may be processed in parallel. Output formats that place each mail message in a separate file (-M, -S, -e) may process the contents of individual folders in parallel. -k Changes the output format to KMail. This format uses mboxrd from quoting. -m Same as the e option, but write .msg files also -o output-directory Specifies the output directory. The directory must already exist, and is entered after the PST file is opened, but before any processing of files commences. -q Changes to silent mode. No feedback is printed to the screen, except for error messages. -r Changes the output format to Recursive. This will create folders as named in the PST file, and will put all emails in a file called "mbox" inside each folder. Appointments go into a file called "calendar", address book entries go into a file called "contacts", and journal entries go into a file called "journal". These files are then compatible with all mbox-compatible email clients. This format uses mboxrd from quoting. -t output-type-codes Specifies the item types that are processed. The argument is a sequence of single letters from (e,a,j,c) for (email, appointment, journal, contact) types. The default is to process all item types. -u Sets Thunderbird mode, a submode of recursive mode. This causes two extra .type and .size meta files to be created. This format uses mboxrd from quoting. -w Overwrite any previous output files. Beware: When used with the -S switch, this will remove all files from the target folder before writing. This is to keep the count of emails and attachments correct. -8 Output bodies in UTF-8, rather than original encoding, if a UTF-8 version is available. From Quoting Output formats that place each mail message in a separate file (-M, -S, -e, -m) don't do any from quoting. Output formats that place multiple email messages in a single file (-k, -r, -u) now use mboxrd from quoting rules. If none of those switches are specified, the default output format uses mboxrd from quoting rules, since it produces multiple email messages in a single file. Earlier versions used mboxo from quoting rules for all output formats. Author This manual page was originally written by Dave Smith <dave.s@earthcorp.com>, and updated by Joe Nahmias <joe@nahmias.net> for the Debian GNU/Linux system (but may be used by others). It was subsequently updated by Brad Hards <bradh@frogmouth.net>, and converted to xml format by Carl Byington <carl@five-ten-sg.com>. Copyright Copyright (C) 2002 by David Smith <dave.s@earthcorp.com>. XML version Copyright (C) 2008 by 510 Software Group <carl@five-ten-sg.com>. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. You should have received a copy of the GNU General Public License along with this program; see the file COPYING. If not, please write to the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. Version @VERSION@ 2016-08-29 lspst 1 lspst @VERSION@ lspst list PST (MS Outlook Personal Folders) file data Synopsis lspst + + pstfile Options -V Show program version and exit. -d debug-file Specify name of debug log file. The log file is now an ascii file, instead of the binary file used in previous versions. + + -f date-format + + Select the date format for long format listing. Defaults to "%F %T". + + + + -l + + Use long format listing to show the Date, CC and BCC headers. + + -h Show summary of options and exit. Description lspst is a program that can read an Outlook PST (Personal Folders) file and produce a simple listing of the data (contacts, email subjects, etc). Author lspst was written by Joe Nahmias <joe@nahmias.net> based on readpst. This man page was written by 510 Software Group <carl@five-ten-sg.com>. Copyright Copyright (C) 2004 by Joe Nahmias <joe@nahmias.net>. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. You should have received a copy of the GNU General Public License along with this program; see the file COPYING. If not, please write to the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. Version @VERSION@ - 2016-08-29 + 2017-12-07 pst2ldif 1 pst2ldif @VERSION@ pst2ldif extract contacts from a MS Outlook .pst file in .ldif format Synopsis pst2ldif pstfilename Options -V Show program version. Subsequent options are then ignored. -b ldap-base Sets the ldap base value used in the dn records. You probably want to use something like "o=organization, c=US". -c class Sets the objectClass values for the contact items. This class needs to be defined in the schema used by your LDAP server, and at a minimum it must contain the ldap attributes given below. This option may be specified multiple times to generate entries with multiple object classes. -d debug-file Specify name of debug log file. The log file is now an ascii file, instead of the binary file used in previous versions. -l extra-line Specify an extra line to be added to each ldap entry. This option may be specified multiple times to add multiple lines to each ldap entry. -o Use the old ldap schema, rather than the default new ldap schema. The old schema generates multiple postalAddress attributes for a single entry. The new schema generates a single postalAddress (and homePostalAddress when available) attribute with $ delimiters as specified in RFC4517. Using the old schema also generates two extra leading entries, one for "dn:ldap base", and one for "dn: cn=root, ldap base". -h Show summary of options. Subsequent options are then ignored. Description pst2ldif reads the contact information from a MS Outlook .pst file and produces a .ldif file that may be used to import those contacts into an LDAP database. The following ldap attributes are generated for the old ldap schema: cn givenName sn personalTitle company mail postalAddress l st postalCode c homePhone telephoneNumber facsimileTelephoneNumber mobile description The following attributes are generated for the new ldap schema: cn givenName sn title o mail postalAddress homePostalAddress l st postalCode c homePhone telephoneNumber facsimileTelephoneNumber mobile description labeledURI Copyright Copyright (C) 2008 by 510 Software Group <carl@five-ten-sg.com> This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. You should have received a copy of the GNU General Public License along with this program; see the file COPYING. If not, please write to the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. Version @VERSION@ - 2016-08-29 + 2017-12-07 pst2dii 1 pst2dii @VERSION@ pst2dii extract email messages from a MS Outlook .pst file in DII load format Synopsis pst2dii -f ttf-font-file pstfilename Options -B bates-prefix Sets the bates prefix string. The bates sequence number is appended to this string, and printed on each page. -O dii-output-file Name of the output DII load file. -V Show program version. Subsequent options are then ignored. -b bates-number Starting bates sequence number. The default is zero. -c bates-color Font color for the bates stamp on each page, specified as 6 hex digits as rrggbb values. The default is ff0000 for bright red. -d debug-file Specify name of debug log file. The log file is now an ascii file, instead of the binary file used in previous versions. -f ttf-font-file Specify name of a true type font file. This should be a fixed pitch font. -h Show summary of options. Subsequent options are then ignored. -o output-directory Specifies the output directory. The directory must already exist. Description pst2dii reads the email messages from a MS Outlook .pst file and produces a DII load file that may be used to import message summaries into a Summation DII system. The DII output file contains references to the image and attachment files in the output directory. Copyright Copyright (C) 2008 by 510 Software Group <carl@five-ten-sg.com> This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. You should have received a copy of the GNU General Public License along with this program; see the file COPYING. If not, please write to the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. Version @VERSION@ - 2016-08-29 + 2017-12-07 outlook.pst 5 outlook.pst format of MS Outlook .pst file Synopsis outlook.pst Overview Low level or primitive items in a .pst file are identified by an I_ID value. Higher level or composite items in a .pst file are identified by a D_ID value. There are two separate b-trees indexed by these I_ID and D_ID values. Starting with Outlook 2003, the file format changed from one with 32 bit pointers, to one with 64 bit pointers. We describe both formats here. 32 bit File Header The 32 bit file header is located at offset 0 in the .pst file. We only support index types 0x0e, 0x0f, 0x15, and 0x17, and encryption types 0x00, 0x01 and 0x02. Index type 0x0e is the older 32 bit Outlook format. Index type 0x0f seems to be rare, and so far the data seems to be identical to that in type 0x0e files. Index type 0x17 is the newer 64 bit Outlook format. Index type 0x15 seems to be rare, and according to the libpff project should have the same format as type 0x17 files. It was found in a 64-bit pst file created by Visual Recovery. It may be that index types less than 0x10 are 32 bit, and index types greater than or equal to 0x10 are 64 bit, and the low order four bits of the index type is some subtype or minor version number. Encryption type 0x00 is no encryption, type 0x01 is "compressible" encryption which is a simple substitution cipher, and type 0x02 is "strong" encryption, which is a simple three rotor Enigma cipher from WWII. offsetIndex1 is the file offset of the root of the index1 b-tree, which contains (I_ID, offset, size, unknown) tuples for each item in the file. backPointer1 is the value that should appear in the parent pointer of that root node. offsetIndex2 is the file offset of the root of the index2 b-tree, which contains (D_ID, DESC-I_ID, TREE-I_ID, PARENT-D_ID) tuples for each item in the file. backPointer2 is the value that should appear in the parent pointer of that root node. 64 bit File Header The 64 bit file header is located at offset 0 in the .pst file. 32 bit Index 1 Node The 32 bit index1 b-tree nodes are 512 byte blocks with the following format. The itemCount specifies the number of 12 byte records that are active. The nodeLevel is non-zero for this style of nodes. The leaf nodes have a different format. The backPointer must match the backPointer from the triple that pointed to this node. Each item in this node is a triple of (I_ID, backPointer, offset) where the offset points to the next deeper node in the tree, the backPointer value must match the backPointer in that deeper node, and I_ID is the lowest I_ID value in the subtree. 64 bit Index 1 Node The 64 bit index1 b-tree nodes are 512 byte blocks with the following format. The itemCount specifies the number of 24 byte records that are active. The nodeLevel is non-zero for this style of nodes. The leaf nodes have a different format. The backPointer must match the backPointer from the triple that pointed to this node. Each item in this node is a triple of (I_ID, backPointer, offset) where the offset points to the next deeper node in the tree, the backPointer value must match the backPointer in that deeper node, and I_ID is the lowest I_ID value in the subtree. 32 bit Index 1 Leaf Node The 32 bit index1 b-tree leaf nodes are 512 byte blocks with the following format. The itemCount specifies the number of 12 byte records that are active. The nodeLevel is zero for these leaf nodes. The backPointer must match the backPointer from the triple that pointed to this node. Each item in this node is a tuple of (I_ID, offset, size, unknown) The two low order bits of the I_ID value seem to be flags. I have never seen a case with bit zero set. Bit one indicates that the item is not encrypted. Note that references to these I_ID values elsewhere may have the low order bit set (and I don't know what that means), but when we do the search in this tree we need to clear that bit so that we can find the correct item. 64 bit Index 1 Leaf Node The 64 bit index1 b-tree leaf nodes are 512 byte blocks with the following format. The itemCount specifies the number of 24 byte records that are active. The nodeLevel is zero for these leaf nodes. The backPointer must match the backPointer from the triple that pointed to this node. Each item in this node is a tuple of (I_ID, offset, size, unknown) The two low order bits of the I_ID value seem to be flags. I have never seen a case with bit zero set. Bit one indicates that the item is not encrypted. Note that references to these I_ID values elsewhere may have the low order bit set (and I don't know what that means), but when we do the search in this tree we need to clear that bit so that we can find the correct item. 32 bit Index 2 Node The 32 bit index2 b-tree nodes are 512 byte blocks with the following format. The itemCount specifies the number of 12 byte records that are active. The nodeLevel is non-zero for this style of nodes. The leaf nodes have a different format. The backPointer must match the backPointer from the triple that pointed to this node. Each item in this node is a triple of (D_ID, backPointer, offset) where the offset points to the next deeper node in the tree, the backPointer value must match the backPointer in that deeper node, and D_ID is the lowest D_ID value in the subtree. 64 bit Index 2 Node The 64 bit index2 b-tree nodes are 512 byte blocks with the following format. The itemCount specifies the number of 24 byte records that are active. The nodeLevel is non-zero for this style of nodes. The leaf nodes have a different format. The backPointer must match the backPointer from the triple that pointed to this node. Each item in this node is a triple of (D_ID, backPointer, offset) where the offset points to the next deeper node in the tree, the backPointer value must match the backPointer in that deeper node, and D_ID is the lowest D_ID value in the subtree. 32 bit Index 2 Leaf Node The 32 bit index2 b-tree leaf nodes are 512 byte blocks with the following format. The itemCount specifies the number of 16 byte records that are active. The nodeLevel is zero for these leaf nodes. The backPointer must match the backPointer from the triple that pointed to this node. Each item in this node is a tuple of (D_ID, DESC-I_ID, TREE-I_ID, PARENT-D_ID) The DESC-I_ID points to the main data for this item (Associated Descriptor Items 0x7cec, 0xbcec, or 0x0101) via the index1 tree. The TREE-I_ID is zero or points to an Associated Tree Item 0x0002 via the index1 tree. The PARENT-D_ID points to the parent of this item in this index2 tree. 64 bit Index 2 Leaf Node The 64 bit index2 b-tree leaf nodes are 512 byte blocks with the following format. The itemCount specifies the number of 32 byte records that are active. The nodeLevel is zero for these leaf nodes. The backPointer must match the backPointer from the triple that pointed to this node. Each item in this node is a tuple of (D_ID, DESC-I_ID, TREE-I_ID, PARENT-D_ID) The DESC-I_ID points to the main data for this item (Associated Descriptor Items 0x7cec, 0xbcec, or 0x0101) via the index1 tree. The TREE-I_ID is zero or points to an Associated Tree Item 0x0002 via the index1 tree. The PARENT-D_ID points to the parent of this item in this index2 tree. 32 bit Associated Tree Item 0x0002 A D_ID value may point to an entry in the index2 tree with a non-zero TREE-I_ID which points to this descriptor block via the index1 tree. It maps local ID2 values (referenced in the main data for the original D_ID item) to I_ID values. This descriptor block contains triples of (ID2, I_ID, CHILD-I_ID) where the local ID2 data can be found via I_ID, and CHILD-I_ID is either zero or it points to another Associated Tree Item via the index1 tree. In the above 32 bit leaf node, we have a tuple of (0x61, 0x02a82c, 0x02a836, 0) 0x02a836 is the I_ID of the associated tree, and we can lookup that I_ID value in the index1 b-tree to find the (offset,size) of the data in the .pst file. 64 bit Associated Tree Item 0x0002 This descriptor block contains a tree that maps local ID2 values to I_ID entries, similar to the 32 bit version described above. Associated Descriptor Item 0xbcec Contains information about the item, which may be email, contact, or other outlook types. In the above leaf node, we have a tuple of (0x21, 0x00e638, 0, 0) 0x00e638 is the I_ID of the associated descriptor, and we can lookup that I_ID value in the index1 b-tree to find the (offset,size) of the data in the .pst file. This descriptor is eventually decoded to a list of MAPI elements. Note the signature of 0xbcec. There are other descriptor block formats with other signatures. Note the indexOffset of 0x013c - starting at that position in the descriptor block, we have an array of two byte integers. The first integer (0x000b) is a (count-1) of the number of overlapping pairs following the count. The first pair is (0, 0xc), the next pair is (0xc, 0x14) and the last (12th) pair is (0x123, 0x13b). These pairs are (start,end+1) offsets of items in this block. So we have count+2 integers following the count value. Note the b5offset of 0x0020, which is a type that I will call an index reference. Such index references have at least two different forms, and may point to data either in this block, or in some other block. External pointer references have the low order 4 bits all set, and are ID2 values that can be used to fetch data. This value of 0x0020 is an internal pointer reference, which needs to be right shifted by 4 bits to become 0x0002, which is then a byte offset to be added to the above indexOffset plus two (to skip the count), so it points to the (0xc, 0x14) pair. So far we have only described internal index references where the high order 16 bits are zero. That suffices for single descriptor blocks. But in the case of the type 0x0101 descriptor block, we have an array of subblocks. In this case, the high order 16 bits of an internal index reference are used to select the subblock. Each subblock starts with a 16 bit indexOffset which points to the count and array of 16 bit integer pairs which are offsets in the current subblock. Finally, we have the offset and size of the "b5" block located at offset 0xc with a size of 8 bytes in this descriptor block. The "b5" block has the following format: Note the descoffset of 0x0040, which again is an index reference. In this case, it is an internal pointer reference, which needs to be right shifted by 4 bits to become 0x0004, which is then a byte offset to be added to the above indexOffset plus two (to skip the count), so it points to the (0x14, 0x7c) pair. The datasize (6) plus the b5 code (02) gives the size of the entries, in this case 8 bytes. We now have the offset 0x14 of the descriptor array, composed of 8 byte entries that describe MAPI elements. Each descriptor entry has the following format: For some reference types (2, 3, 0xb) the value is used directly. Otherwise, the value is an index reference, which is either an ID2 value, or an offset, to be right shifted by 4 bits and used to fetch a pair from the index table to find the offset and size of the item in this descriptor block. The following reference types are known, but not all of these are implemented in the code yet. The following item types are known, but not all of these are implemented in the code yet. Associated Descriptor Item 0x7cec This style of descriptor block is similar to the 0xbcec format. This descriptor is also eventually decoded to a list of MAPI elements. Note the signature of 0x7cec. There are other descriptor block formats with other signatures. Note the indexOffset of 0x017a - starting at that position in the descriptor block, we have an array of two byte integers. The first integer (0x0006) is a (count-1) of the number of overlapping pairs following the count. The first pair is (0, 0xc), the next pair is (0xc, 0x14) and the last (7th) pair is (0x160, 0x179). These pairs are (start,end+1) offsets of items in this block. So we have count+2 integers following the count value. Note the 7coffset of 0x0040, which is an index reference. In this case, it is an internal reference pointer, which needs to be right shifted by 4 bits to become 0x0004, which is then a byte offset to be added to the above indexOffset plus two (to skip the count), so it points to the (0x14, 0xea) pair. We have the offset and size of the "7c" block located at offset 0x14 with a size of 214 bytes in this case. The "7c" block starts with a header with the following format: Note the b5Offset of 0x0020, which is an index reference. In this case, it is an internal reference pointer, which needs to be right shifted by 4 bits to become 0x0002, which is then a byte offset to be added to the above indexOffset plus two (to skip the count), so it points to the (0xc, 0x14) pair. Finally, we have the offset and size of the "b5" block located at offset 0xc with a size of 8 bytes in this descriptor block. The "b5" block has the following format: Note the descoffset of 0x0060, which again is an index reference. In this case, it is an internal pointer reference, which needs to be right shifted by 4 bits to become 0x0006, which is then a byte offset to be added to the above indexOffset plus two (to skip the count), so it points to the (0xea, 0xf0) pair. The datasize (2) plus the b5 code (04) gives the size of the entries, in this case 6 bytes. We now have the offset 0xea of an unused block of data in an unknown format, composed of 6 byte entries. That gives us (0xf0 - 0xea)/6 = 1, so we have a recordCount of one. We have seen cases where the descoffset in the b5 block is zero, and the index2Offset in the 7c block is zero. This has been seen for objects that seem to be attachments on messages that have been read. Before the message was read, it did not have any attachments. Note the index2Offset above of 0x0080, which again is an index reference. In this case, it is an internal pointer reference, which needs to be right shifted by 4 bits to become 0x0008, which is then a byte offset to be added to the above indexOffset plus two (to skip the count), so it points to the (0xf0, 0x155) pair. This is an array of tables of four byte integers. We will call these the IND2 tables. The size of each of these tables is specified by the recordSize field of the "7c" header. The number of these tables is the above recordCount value derived from the "b5" block. Now the remaining data in the "7c" block after the header starts at offset 0x2a. There should be itemCount 8 byte items here, with the following format: The ind2Offset is a byte offset into the current IND2 table of some value. If that is a four byte integer value, then once we fetch that, we have the same triple (item type, reference type, value) as we find in the 0xbcec style descriptor blocks. If not, then this value is used directly. These 8 byte descriptors are processed recordCount times, each time using the next IND2 table. The item and reference types are as described above for the 0xbcec format descriptor block. 32 bit Associated Descriptor Item 0x0101 This descriptor block contains a list of I_ID values. It is used when an I_ID (that would normally point to a type 0x7cec or 0xbcec descriptor block) contains more data than can fit in any single descriptor of those types. In this case, it points to a type 0x0101 block, which contains a list of I_ID values that themselves point to the actual descriptor blocks. The total length value in the 0x0101 header is the sum of the lengths of the blocks pointed to by the list of I_ID values. The result is an array of subblocks, that may contain index references where the high order 16 bits specify which descriptor subblock to use. Only the first descriptor subblock contains the signature (0xbcec or 0x7cec). 64 bit Associated Descriptor Item 0x0101 This descriptor block contains a list of I_ID values, similar to the 32 bit version described above.