00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0x00 xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 ... 0xA0 00 00 00 00 00 00 00 00 xx xx xx xx 00 00 00 00 0xB0 00 00 00 00 00 00 00 00 00 00 00 00 xx xx xx xx 0xC0 00 00 00 00 xx xx xx xx 00 00 00 00 00 00 00 00
The first 4 bytes of the PST file should be 0x21 0x42 0x44 0x4E, or as an int 0x4E444221. This is the only signature I have come across and will probably work in nearly all situations.
This is the size of the file. If I understand correctly, then Outlook would appear to have a 2GB, or 4GB file limit. Actually, I am not sure that the whole file format could take more than 1GB.
This is what is reffered to as the second index, or Descriptive index. These records contain pointers to the item description and a table of extra ids. These records also contain the id2# of its parent.
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F xx xx xx xx 00 00 00 00 xx xx xx xx
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx
This is what is reffered to as an ID. These just basically point to offsets in the file. The do not describe what they point to. Each ID2 record that needs data not stored in it, will have an ID value that is a pointer to some data.
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F xx xx xx xx 00 00 00 00 xx xx xx xx
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F xx xx xx xx xx xx xx xx xx xx 00 00
This is a simple record associating the ID records with the ID2 records. It is nearly always the case that an item record will refer to an ID2 value. This list, which should be pre-read, will allow the ID2 values to point to file offsets. We must keep a full list of ID values in memory so that we can lookup the file offsets when required.
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 02 00 xx xx[xx xx xx xx xx xx xx xx 00 00 00 00]...
This is a record that lists attributes of an item together with the attribute's data. It is the main place where data is stored. All data in a PST file is stored as items - from emails, to contacts, to the layout of a folder.
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F xx xx EC BC xx xx xx xxOR
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F xx xx EC 7C xx xx xx xx