Outlook Item (MSG)
| Format | Outlook Item (MSG) |
|---|---|
| Short name | MSG |
| Category | document |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
A single Outlook item (e-mail, appointment, contact, task) stored in a Compound File Binary container. Properties are stored as streams named '__substg1.0_<tag><type>' and in a '__properties_version1.0' stream; recipients and attachments are kept in sub-storages, embedded items as nested storages. Messages contain sender, recipients, subject, body (plain text, compressed RTF and/or HTML) and timestamps such as submit, delivery, creation and last modification time; received mail usually retains the original transport headers including the Received chain. The file carries the CFB signature and is identified by its stream names.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | D0 CF 11 E0 A1 B1 1A E1 | ........ | CFB signature at offset 0 (shared with all CFB files); identified by '__substg1.0_' / '__properties_version1.0' stream names |
Known extensions
.msg
References
- [MS-OXMSG]: Outlook Item (.msg) File Format (Microsoft) https://learn.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxmsg/b046868c-9fbf-41ae-9ffb-8de2bd4eec82
Cite this entry
Crush Format Reference, “Outlook Item (MSG)”. https://kalink0.github.io/crush-forensics/formats/msg/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction