1

I'm trying to understand the format and specifications of Outlook Ole Attachments at the compound file level of things, the Ole Attachment in hand is a Picture (Device Independent Bitmap), I produced the Msg file by composing RTF text email with inline picture within the body text. Opening the msg file using Structured Storage Explorer (a tool by Microsoft), I can see the attachment substorage: substorage ole attachment

I understand the structure of the Ole Attachment Object, but what I can't find anywhere is the format of the MailStream stream within the substorage. I'm asking if anyone knows the format or can point me to the documentation that helps in this case. I'm asking specifically about the MailStream, please do not answer pointing to how compound files specifications are or something similar. Thanks in advance.

RaniDevpr
  • 410
  • 2
  • 13

1 Answers1

2

As far as I know, the first 4 bytes are dwAspect. The next 2 DWORDs are width and height.

BTW, you don't have to use Structured Storage Explorer - you can see the data in OutlookSpy (I am its author): click IMessage button, go to the GetAttachmentTable tab, double click on the attachment, select PR_ATTACH_DATA_OBJ, right click, select IMAPIProp::OpenProperty, select IID_IStorage.

Dmitry Streblechenko
  • 62,942
  • 4
  • 53
  • 78
  • Thank you for your answer, are you sure about that, i am convinced the first 4 bytes is dwAspect. but take for example this extracted MailStream : 01 00 00 00 66 37 00 00 a7 29 00 00 , the first is 1 which is true dwAspect , the next DWORDS, are very high to be dimensions. – RaniDevpr Mar 28 '16 at 14:38
  • 14182 x 10663 is the size in twips – Dmitry Streblechenko Mar 28 '16 at 15:14
  • 1
    Thank you Dmitry, you are the best, this is not the first time you answer my questions brilliantly. – RaniDevpr Mar 28 '16 at 15:20
  • 1
    I believe that the width and height are actually in units of 0.1 mm (2540 per inch) and not twips (1440 per inch). – Ross J Jan 18 '21 at 00:56