Outlook 2003/2007 NK2 File Format and Developer Guidelines

Transcription

1 Outlook 2003/2007 NK2 File Format and Developer Guidelines This post explains how Microsoft Office Outlook 2007 interacts with the nickname cache file, also known as the.nk2 file. The.nk2 file is where Outlook 2007 persists the autocomplete list, which is the list of names that displays in the To, Cc, and Bcc edit boxes while composing an . This post also discusses the binary format of the file and the recommended ways for interacting with the.nk2 file. This blog post should contain sufficient information to support reading and modifying the.nk2 file. You can use any programming language to write your application because there are no dependencies on the Outlook object model or MAPI APIs. Outlook 2007 Interaction with the.nk2 file When a user logs on to Outlook 2007, Outlook reads the user s MAPI Profile. Later, when the autocomplete list is shown, the.nk2 file is loaded. The.nk2 file has the same name as the profile that was used to log on, typically outlook.nk2, in the default scenario. This file can be found here: %APPDATA%\Microsoft\Outlook Outlook 2007 interacts with the.nk2 file in two ways: 1. Loading the.nk2 file. 2. And, later, saving the.nk2 file. Loading the.nk2 file Outlook 2007 loads the.nk2 file when any item with addressing functionality gets initialized. For example, addresses are used in a new mail, a mail reply, a contact item, a meeting request, etc. To load, Outlook 2007 reads all of the contents of the file as a binary stream into a structure in memory. For autocomplete operations, Outlook interacts exclusively with this in-memory structure for the duration of the outlook.exe process lifetime. Outlook 2007 does not interact with the.nk2 file in any additional ways until it saves the in-memory structure back to disk on shutdown. Saving the.nk2 file Outlook 2007 saves the.nk2 file on shutdown if the autocomplete list has changed in any way. Here are the ways that the autocomplete list gets changed: A new nickname entry is added through resolving a name, picking a recipient from the address book dialog, or sending mail to a recipient that was not already in the list. An entry is modified by sending mail to an existing recipient in the list.

2 An entry is removed by the user through the UI. Other minor scenarios not relevant to this blog post Outlook 2007 does not save the.nk2 file on shutdown if the autocomplete list has not changed. The save involves writing the in-memory structure to the.nk2 file as a binary stream. If the size of the.nk2 file contents shrink during an Outlook session (for example, the user deletes some entries), Outlook saves the new contents to the file, but the file itself will not shrink in size. Recommendations Never partially modify the.nk2 file. The supported interaction is to 1) read the entire file into memory, 2) modify the memory structure, and 3) write out the entire file when the modifications are finished. We recommend locking the file from modification by other processes while you re reading it and writing it using standard Windows file locking APIs (e.g. LockFile in C/C++ and FileStream.Lock in C#). Don t interact with the.nk2 file while Outlook is running. If Outlook is running while you modify the file, Outlook will likely overwrite your changes when it shuts down. Do not write properties of type PT_MV_UNICOD and PR_MV_STRING8 into an.nk2 file to be consumed by Outlook These properties are only understood by Outlook Do not write properties of types that are not mentioned in this document. NK2 File Format In addition to knowing how Outlook interacts with the.nk2 file, you must also understand the binary file format of the.nk2 file. The.nk2 file is a set of recipient property rows that are saved as a binary stream along with some bookkeeping metadata that is used only by Outlook 2007 and Outlook The metadata is relevant to Outlook s interactions with the.nk2 file so third parties must preserve what is in each metadata block when saving a modified.nk2 file. In other words, third parties should modify only the row-set portion of the binary format and preserve what was already in the metadata blocks of the file. When creating a new.nk2 file from scratch, use the metadata values from the binary example below to populate the metadata in the new file. File Visualization The high-level layout of the file looks like this: Metadata (12 bytes) Number of rows n (4 bytes)

3 Number of properties p in row one (4 bytes) Property 1 s property tag (4 bytes) Property 1 s reserved data (4 bytes) Property 1 s value union (8 bytes) Property 1 s value data (0 or variable bytes) (property 2 through property P-1) Property p s property tag (4 bytes) Property p s reserved data (4 bytes) Property p s value union (8 bytes) Property p s value data (0 or variable bytes) Number of properties q in row two (4 bytes) (row two s properties) (row 3 through row n-1) Number of properties r in row n (4 bytes) (row n s properties) Metadata (12 bytes) For an example of a binary file structure, see here. High-level Layout Broadly speaking, this is the layout of the.nk2 file: Metadata 12 Row-set Variable Metadata 12 Row-set Layout The row-set layout is as follows:

4 Number of rows 4 Rows Variable The number of rows identifies how many rows will come in the next part of the binary stream sequence. Row Layout ach row is of the following format: Number of properties 4 Properties Variable The number of properties identifies how many properties will come in the next part of the binary stream sequence. Property Layout ach property is of the following format: Property Tag 4 Reserved Data 4 Property Value Union 8 0 or variable (depending on the prop tag) Interpreting the Property Value The Property Value Union and the are to be interpreted based on the property tag in the first 4 bytes of the property block. This property tag is in the same format as a MAPI property tag. Bits 0 through 15 of the property tag are the property s type. Bits 16 through 31 are the property s identifier. The property type determines how the rest of the property should be read.

5 Static Values Some properties have no and only have data in the union. The following property types (which come from the Property Tag) should interpret the 8-byte Property Union data as follows: Prop Type PT_I2 PT_LONG PT_R4 PT_DOUBL PT_BOOLAN PT_SYSTIM PT_I8 Property Union Interpretation short int long float double short int FILTIM LARG_INTGR Dynamic Values Other properties have data in a block after the first 16 bytes that contain the Property Tag, the Reserved Data, and the Property Value Union. Unlike static values, the data stored in the 8 byte Property Value union is irrelevant on reading. When writing, make sure to fill these 8 bytes with something, but the content of the 8 bytes doesn t matter. In dynamic values, the property tag s type determines how to interpret the. PT_STRING8 Number of bytes n 4 Bytes to be interpreted as an ANSI string (includes NULL terminator) n Number of bytes n 4 Bytes to be interpreted as a UNICOD string (includes NULL n

6 terminator) PT_CLSID Bytes to be interpreted as a GUID 16 PT_BINARY Number of bytes n 4 Bytes to be interpreted as a byte array n PT_MV_BINARY Number of binary arrays X 4 A run of bytes containing X binary arrays. ach array should be interpreted like the PT_BINARY byte run described above. Variable PT_MV_STRING8 (Outlook 2007) Number of ANSI strings X 4 A run of bytes containing X ANSI strings. ach string should be interpreted like the PT_STRING8 byte run described above. Variable PT_MV_UNICOD (Outlook 2007)

7 Number of UNICOD strings X 4 A run of bytes containing X UNICOD strings. ach string should be interpreted like the byte run described above. Variable For an example of a binary file structure, see here. Significant properties As mentioned above, the binary blocks that represent properties have property tags that correspond to properties on address book recipients. For properties that aren t listed here, you can look up the property description at The properties below are the minimum set of properties necessary for a row to be valid. Therefore, new rows added to the.nk2 file must be populated with the properties below. Property Name Property Tag Description (see MSDN for more details) PR_NICK_NAM_W (not transmitted on recipients, specific to.nk2 file only) 0x F This property must be first in each recipient row. Functionally serves as a key identifier for the recipient row. PR_NTRYID 0x0FFF0102 The address book entry identifier for the recipient. PR_DISPLAY_NAM_W 0x F The recipient s display name. PR_MAIL_ADDRSS_W 0x F The recipient s address (e.g. johndoe@contoso.com or /o=contoso/ou=foo/cn=recipients/cn=johnd oe). PR_ADDRTYP_W 0x F The recipient s address type (e.g. SMTP or X). PR_SARCH_KY 0x300B0102 The recipient s MAPI search key. PR_SMTP_ADDRSS_W 0x39F001F The recipient s SMTP address. PR_OBJCT_TYP 0x0FF0003 Represents the type of this recipient. Values can either be MAPI_MAILUSR or

8 MAPI_DISTLIST. PR_DISPLAY_TYP 0x Similar to PR_OBJCT_TYP, but it s used by Outlook s UI to determine how to display the recipient (for example, bolding a distribution list). Common values for this are DT_DISTLIST and DT_MAILUSR. PR_NW_NICK_NAM (not transmitted on recipients, specific to.nk2 file only) PR_DROPDOWN_DISPLAY_NAM_ W (not transmitted on recipients, specific to.nk2 file only) PR_NICK_NAM_WIGHT (not transmitted on recipients, specific to.nk2 file only) 0x B 0x F 0x Specifies whether this row was just added to the nickname cache or not. If you are creating a new row, this should be set to true. The display string that shows up in the autocomplete list. The weight of this autocomplete entry. The weight is used to determine in what order autocomplete entries show up when matching the autocomplete list. ntries with higher weight will show before entries with lower weight. The entire autocomplete list is sorted by this property. The weight periodically decreases over time and increases when the user sends an to this recipient. See the description below for more information about this property. PR_NICK_NAM_WIGHT The set of rows in the.nk2 file is sorted in descending order by the PR_NICK_NAM_WIGHT property and the.nk2 file should always preserve this sorted characteristic. Therefore, any changes to a row s weight should also ensure that the row s position retains the sorted order of the entire set of rows. Any additions to the row-set should be inserted to the proper position to maintain the sorted order. The minimum value of this weight is 0x1 and the maximum value is LONG_MAX. Any other values for the weight are considered invalid. When Outlook 2007 sends a mail to or resolves a recipient, it will increase that recipient s weight by 0x2000.

9 Binary xample The following binary is an example of an.nk2 with two SMTP recipients in it: and h: 0D F0 AD BA 0A h: F FD A h: C A h: D F h: F F F h: C h: F 00 0A 00 F F h: A A 2D F h: A A h: F4 FC 5F 03 0B A C a0h: D0 FC 5F b0h: C B 30 CD A B c0h: AC 1A B D A 4A d0h: D F F 53 4F 2 4F e0h: F9 0F AC 00 7A C f0h: 1A A B 1F A4 B h: A D 6 00 DD 01 0F A h: D h: F F F h: F D h: A D h: F h: 00 6F F F h: FF 0F A B h: 04 7A B 1F A4 B A h: 19 9D 6 00 DD 01 0F A a0h: D b0h: F F F c0h: 00 6F D d0h: A D e0h: F F f0h: F F

10 h: 00 F 0F 94 FC 5F F h: A A BB 1B C 31 AC 00 2C h: A D h: F F h: F F F h: C 31 AC B C FC 5F 03 0A h: D F h: F1 1B 3 04 FF FF C h: 00 6A D h: F F a0h: 00 6F F FF b0h: 5F D c0h: 5F 4F FD d0h: 5F F 00 F e0h: 5F F 00 1D 1C C f0h: 00 6A D h: F F h: 00 6F F F h: 5F AA 0A 18 C7 7A C A h: B 1F A4 B A D h: DD 01 0F A h: D F h: F F F h: D A h: D h: F F F a0h: F DF 5F b0h: FD B c0h: FD F d0h: CF C3 1C C A e0h: D f0h: F F F h: F C h: FF FF 7F F h: FD F h: A 00 6F F 00 65

11 h: F F F h: F 00 6D C h: F A 00 F h: F A A h: BF F 38 0F C4 B F A h: 32 1A F4 FC 2B 06 0B A a0h: 1 1C D0 FC 2B b0h: C B 30 CD c0h: A F d0h: 4D A 4A 4F F F e0h: 4F 53 4F F 4D F9 0F AC f0h: F h: 81 2B 1F A4 B A D 6 00 DD 01 0F h: A 00 6F F h: F F h: 6F F 00 6D D h: A 00 6F h: 6F F F h: F F 00 6D h: FF 0F B F h: B 1F A4 B A D h: 00 DD 01 0F A 00 6F a0h: F F b0h: F F F 00 6D c0h: D A 00 6F d0h: F F e0h: F F F f0h: 6D F 0F 94 FC 2B h: 30 B F A A D F h: 3C 31 AC A 00 6F h: F F h: 6F F F 00 6D h: 1F C 31 AC F C FC 2B h: 0A D F h: F F FF FF h: A 00 6F F

12 h: F F F h: F 00 6D FF 5F a0h: D 5F b0h: FD 5F 4D c0h: F 00 F6 5F d0h: B7 F A e0h: 6F F f0h: 6F F F h: 6F 00 6D F7 5F h: DF F B h: 1F A4 B A D 6 00 DD 01 0F h: A 00 6F F h: F F F h: F 00 6D D h: A 00 6F F h: F F h: 6F F 00 6D DF 5F h: FD B a0h: 90 FD F b0h: D0 9F F c0h: 6A 00 6F F d0h: F F F e0h: F 00 6D C f0h: B FF FF 7F D F4 7D Binary h: 72 B6 CA 01 Name Size Type Value 0DF0ADBA0A DF0ADBA0A Header 12 Binary Number of rows 4 ULONG Hex: 0x Decimal: Row 1 number of properties 4 ULONG Hex: 0x Decimal: 23 1F Row 1 Property 1 Property Tag 4 ULONG Hex: 0x f Decimal: FD1300 Reserved 4 ULONG Hex: 0x0013fd90 Decimal: A Irrelevant Union 8 Binary 801A C Unicode String bytes 4 ULONG Hex: 0x c Decimal: 44

13 6A D F F F F Unicode String Value C Row 1 Property 2 Property Tag 4 ULONG Hex: 0x0c Decimal: Reserved 4 ULONG Hex: 0x Decimal: F00 Property Union 8 PT_I4 Hex: 0x Decimal: 1 0A00F39 Row 1 Property 3 Property Tag 4 ULONG Hex: 0x39fe000a Decimal: Reserved 4 ULONG Hex: 0x Decimal: F Irrelevant Union 8 Binary 0F A00003A Row 1 Property 4 Property Tag 4 ULONG Hex: 0x3a00000a Decimal: D Reserved 4 ULONG Hex: 0x d Decimal: F Irrelevant Union 8 Binary 0F A Row 1 Property 5 Property Tag 4 ULONG Hex: 0x3a Decimal: A39 Reserved 4 ULONG Hex: 0x391a3240 Decimal: F4FC5F03 Property Union 8 PT_I4 Hex: 0x Decimal: 0 0B00403A Row 1 Property 6 Property Tag 4 ULONG Hex: 0x3a40000b Decimal: C02 Reserved 4 ULONG Hex: 0x021c1e90 Decimal: D0FC5F03 Property Union 8 PT_BOOLA N Hex: 0x Decimal: Row 1 Property 7 Property Tag 4 ULONG Hex: 0x Decimal: Reserved 4 ULONG Hex: 0x Decimal: C02 Property Union 8 PT_I4 Hex: 0x Decimal: B30 Row 1 Property 8 Property Tag 4 ULONG Hex: 0x300b0102 Decimal: CDA26032 Reserved 4 ULONG Hex: 0x3260a2cd Decimal: B000000AC1A304 Irrelevant Union 8 Binary 1B000000AC1A304 1B Binary num bytes 4 ULONG Hex: 0x b Decimal: D54503A4A D F4544F534F2 4F Binary content 27 Binary 0201F90F Row 1 Property 9 Property Tag 4 ULONG 534D54503A4A D F4544F534F24 F Hex: 0x0ff90102 Decimal:

14 8006AC00 Reserved 4 ULONG Hex: 0x00ac0680 Decimal: A000000C71A304 Irrelevant Union 8 Binary 7A000000C71A304 7A Binary num bytes 4 ULONG Hex: 0x a Decimal: A D F F F F D A D F F F002006F Binary content 122 Binary 0201FF0F Row 1 Property 10 Property Tag 4 ULONG Reserved 4 ULONG 906A D F F F F D A D F F F002006F Hex: 0x0fff0102 Decimal: Hex: 0x Decimal: A B304 Irrelevant Union 8 Binary 7A B304 7A Binary num bytes 4 ULONG Hex: 0x a Decimal: A D F F F F D A D F F F002006F Binary content 122 Binary 906A D F F F F D A D F F F002006F F0F Row 1 Property 11 Property Tag 4 ULONG Hex: 0x0ffe0003 Decimal: FC5F03 Reserved 4 ULONG Hex: 0x035ffc94 Decimal: Property Union 8 PT_I4 Hex: 0x Decimal: 6 1F Row 1 Property 12 Property Tag 4 ULONG Hex: 0x f Decimal: AA6032 Reserved 4 ULONG Hex: 0x3260ae2a Decimal: BB1B3043C31AC00 Irrelevant Union 8 Binary BB1B3043C31AC00 2C Unicode String bytes 4 ULONG Hex: 0x c Decimal: 44

15 6A D F F F F Unicode String Value 44 1F Row 1 Property 13 Property Tag 4 ULONG Hex: 0x f Decimal: C31AC00 Reserved 4 ULONG Hex: 0x00ac313c Decimal: B3047CFC5F03 Irrelevant Union 8 Binary 71B3047CFC5F03 0A Unicode String bytes 4 ULONG Hex: 0x a Decimal: D Unicode String Value 10 SMTP 1F Row 1 Property 14 Property Tag 4 ULONG Hex: 0x f Decimal: Reserved 4 ULONG Hex: 0x Decimal: 0 F11B304FFFF0000 Irrelevant Union 8 Binary F11B304FFFF0000 2C Unicode String bytes 4 ULONG Hex: 0x c Decimal: 44 6A D F F F F Unicode String Value 44 janesmith@contoso.org 0300FF5F Row 1 Property 15 Property Tag 4 ULONG Hex: 0x5fff0003 Decimal: Reserved 4 ULONG Hex: 0x Decimal: 0 0 Property Union 8 PT_I4 Hex: 0x Decimal: D5F Row 1 Property 16 Property Tag 4 ULONG Hex: 0x5fde0003 Decimal: F Reserved 4 ULONG Hex: 0x f Decimal: Property Union 8 PT_I4 Hex: 0x Decimal: FD5F Row 1 Property 17 Property Tag 4 ULONG Hex: 0x5ffd0003 Decimal: Reserved 4 ULONG Hex: 0x Decimal: Property Union 8 PT_I4 Hex: 0x Decimal: 1 1F00F65F Row 1 Property 18 Property Tag 4 ULONG Hex: 0x5ff6001f Decimal: F00 Reserved 4 ULONG Hex: 0x006f0042 Decimal: D1C Irrelevant Union 8 Binary 1D1C C Unicode String bytes 4 ULONG Hex: 0x c Decimal: 44

16 6A D F F F F Unicode String Value F75F Row 1 Property 19 Property Tag 4 ULONG Hex: 0x5ff70102 Decimal: AA0A18C7 Reserved 4 ULONG Hex: 0xc7180aaa Decimal: A C304 Irrelevant Union 8 Binary 7A C304 7A Binary num bytes 4 ULONG Hex: 0x a Decimal: A D F F F F D A D F F F002006F Binary content 122 Binary 906A D F F F F D A D F F F002006F DF5F Row 1 Property 20 Property Tag 4 ULONG Hex: 0x5fdf0003 Decimal: Reserved 4 ULONG Hex: 0x Decimal: FD1300 Property Union 8 PT_I4 Hex: 0x Decimal: 0 0B Row 1 Property 21 Property Tag 4 ULONG Hex: 0x b Decimal: 90FD1300 Reserved 4 ULONG Property Union 8 PT_BOOLA N Hex: 0x0013fd90 Decimal: Hex: 0x Decimal: 0 1F Row 1 Property 22 Property Tag 4 ULONG Hex: 0x f Decimal: CF0205 Reserved 4 ULONG Hex: 0x0502cf30 Decimal: C31C Irrelevant Union 8 Binary C31C C Unicode String bytes 4 ULONG Hex: 0x c Decimal: 44 6A D F F F F Unicode String Value Row 1 Property 23 Property Tag 4 ULONG janesmith@contoso.org Hex: 0x Decimal:

17 C Reserved 4 ULONG Hex: 0x301044c7 Decimal: FFFF7F Property Union 8 PT_I4 Hex: 0x Decimal: Row 2 number of properties 4 ULONG Hex: 0x Decimal: 23 1F Row 2 Property 1 Property Tag 4 ULONG Hex: 0x f Decimal: FD1300 Reserved 4 ULONG Hex: 0x0013fd90 Decimal: F Irrelevant Union 8 Binary 38F Unicode String bytes 4 ULONG Hex: 0x Decimal: 40 6A006F F F F F F006D Unicode String Value 40 johndoe@contoso.com C Row 2 Property 2 Property Tag 4 ULONG Hex: 0x0c Decimal: Reserved 4 ULONG Hex: 0x Decimal: F Property Union 8 PT_I4 Hex: 0x Decimal: 1 0A00F39 Row 2 Property 3 Property Tag 4 ULONG Hex: 0x39fe000a Decimal: Reserved 4 ULONG Hex: 0x Decimal: 0 0F Irrelevant Union 8 Binary 0F A00003A Row 2 Property 4 Property Tag 4 ULONG Hex: 0x3a00000a Decimal: BFF38 Reserved 4 ULONG Hex: 0x38efbf6e Decimal: F010480C4BF38 Irrelevant Union 8 Binary 0F010480C4BF A Row 2 Property 5 Property Tag 4 ULONG Hex: 0x3a Decimal: A39 Reserved 4 ULONG Hex: 0x391a3240 Decimal: F4FC2B06 Property Union 8 PT_I4 Hex: 0x Decimal: 0 0B00403A Row 2 Property 6 Property Tag 4 ULONG Hex: 0x3a40000b Decimal: C02 Reserved 4 ULONG Hex: 0x021c1e90 Decimal: D0FC2B06 Property Union 8 PT_BOOLA N Row 2 Property 7 Property Tag 4 ULONG Hex: 0x Decimal: 0 Hex: 0x Decimal: Reserved 4 ULONG Hex: 0x Decimal: C02 Property Union 8 PT_I4 Hex: 0x Decimal: B30 Row 2 Property 8 Property Tag 4 ULONG Hex: 0x300b0102 Decimal:

18 CDA26032 Reserved 4 ULONG Hex: 0x3260a2cd Decimal: F4204 Irrelevant Union 8 Binary F Binary num bytes 4 ULONG Hex: 0x Decimal: D54503A4A4F484444F F4544F534F2434F4 D00 Binary content 25 Binary 534D54503A4A4F484444F F4544F534F2434F4 D F90F Row 2 Property 9 Property Tag 4 ULONG Hex: 0x0ff90102 Decimal: AC00 Reserved 4 ULONG Hex: 0x00ac0680 Decimal: F4204 Irrelevant Union 8 Binary F Binary num bytes 4 ULONG Hex: 0x Decimal: A006F F F F F F006D D A006F F F F F F006D Binary content 114 Binary 0201FF0F Row 2 Property 10 Property Tag 4 ULONG Reserved 4 ULONG 906A006F F F F F F006D D A006F F F F F F006D Hex: 0x0fff0102 Decimal: Hex: 0x e Decimal: BF4204 Irrelevant Union 8 Binary BF Binary num bytes 4 ULONG Hex: 0x Decimal: A006F F F A006F F F F F F F Binary content 114 Binary 06F006D D0054 F006D D A006F F F F F F006D A006F F F F F F006D F0F Row 2 Property 11 Property Tag 4 ULONG Hex: 0x0ffe0003 Decimal: FC2B06 Reserved 4 ULONG Hex: 0x062bfc94 Decimal:

19 B5307 Property Union 8 PT_I4 Hex: 0x Decimal: 6 1F Row 2 Property 12 Property Tag 4 ULONG Hex: 0x f Decimal: AA6032 Reserved 4 ULONG Hex: 0x3260ae2a Decimal: DF52043C31AC00 Irrelevant Union 8 Binary 5DF52043C31AC Unicode String bytes 4 ULONG Hex: 0x Decimal: 40 6A006F F F F F F006D Unicode String Value 40 johndoe@contoso.com 1F Row 2 Property 13 Property Tag 4 ULONG Hex: 0x f Decimal: C31AC00 Reserved 4 ULONG Hex: 0x00ac313c Decimal: F52047CFC2B06 Irrelevant Union 8 Binary 85F52047CFC2B06 0A Unicode String bytes 4 ULONG Hex: 0x a Decimal: D Unicode String Value 10 SMTP 1F Row 2 Property 14 Property Tag 4 ULONG Hex: 0x f Decimal: Reserved 4 ULONG Hex: 0x Decimal: 0 8FF5204FFFF0000 Irrelevant Union 8 Binary 8FF5204FFFF Unicode String bytes 4 ULONG Hex: 0x Decimal: 40 6A006F F F F F F006D Unicode String Value 40 johndoe@contoso.com 0300FF5F Row 2 Property 15 Property Tag 4 ULONG Hex: 0x5fff0003 Decimal: Reserved 4 ULONG Hex: 0x Decimal: 0 0 Property Union 8 PT_I4 Hex: 0x Decimal: D5F Row 2 Property 16 Property Tag 4 ULONG Hex: 0x5fde0003 Decimal: Reserved 4 ULONG Hex: 0x Decimal: Property Union 8 PT_I4 Hex: 0x Decimal: FD5F Row 2 Property 17 Property Tag 4 ULONG Hex: 0x5ffd0003 Decimal: D Reserved 4 ULONG Hex: 0x d Decimal: Property Union 8 PT_I4 Hex: 0x Decimal: 1 1F00F65F Row 2 Property 18 Property Tag 4 ULONG Hex: 0x5ff6001f Decimal:

20 Reserved 4 ULONG Hex: 0x Decimal: B7F Irrelevant Union 8 Binary B7F Unicode String bytes 4 ULONG Hex: 0x Decimal: 40 6A006F F F F F F006D Unicode String Value 40 johndoe@contoso.com 0201F75F Row 2 Property 19 Property Tag 4 ULONG Hex: 0x5ff70102 Decimal: Reserved 4 ULONG Hex: 0x Decimal: DFF5204 Irrelevant Union 8 Binary DFF Binary num bytes 4 ULONG Hex: 0x Decimal: A006F F F A006F F F F F F F Binary content 114 Binary 06F006D D0054 F006D D A006F F F F F F006D A006F F F F F F006D DF5F Row 2 Property 20 Property Tag 4 ULONG Hex: 0x5fdf0003 Decimal: Reserved 4 ULONG Hex: 0x Decimal: FD1300 Property Union 8 PT_I4 Hex: 0x Decimal: 0 0B Row 2 Property 21 Property Tag 4 ULONG Hex: 0x b Decimal: 90FD1300 Reserved 4 ULONG Property Union 8 PT_BOOLA N Hex: 0x0013fd90 Decimal: Hex: 0x Decimal: 0 1F Row 2 Property 22 Property Tag 4 ULONG Hex: 0x f Decimal: D09F3307 Reserved 4 ULONG Hex: 0x07339fd0 Decimal: F Irrelevant Union 8 Binary 51F Unicode String bytes 4 ULONG Hex: 0x Decimal: 40

21 6A006F F F F F F006D Unicode String Value Row 2 Property 23 Property Tag 4 ULONG C Reserved 4 ULONG BFFFF7F Property Union 8 PT_I DF47D72B6CA0 1 Footer Metadata 12 Binary johndoe@contoso.com Hex: 0x Decimal: Hex: 0x301044c7 Decimal: Hex: 0x Decimal: DF47D72B6CA0 1