OST or Outlook Offline Storage File stores an offline copy of Outlook mailbox items that exists on the server. OST file allows users to work even in the absence of the server connection. Whenever users work in the absence of server, a carbon copy of the mailbox is stored by Outlook and stored locally on the system. Once the connection is established, the file is synchronized with the server. OST file contains emails, contacts, notes, calendar information, tasks, and other data. OST file is typically used with Microsoft Exchange Server account and an offline copy of your data.
The OST and PST both file format consists of Personal Folder File (PFF) that stores users emails, contacts and appointments. Data stored in PFF file is represented as FILETIME in UTC, defines two types of PFF:
PST file format specifications provided by Microsoft, are applied to OST file format as free and irrevocable patent licensing through Open Specification Promise.
It has multiple elements –
Header Information
The header structure of OST file is located at the starting of the file at 0 offset. It has metadata information about OST file and ROOT information to access NDB Layer data structures mentioned above. The header structure is different for ANSI OST and UNICODE OST file.
The header begins with a 4-byte word !BDN presented by bytes (0x21, 0x42, 0x44, 0x4E). The other 2-bytes number, SM (0x53, 0x4D), is located at offset 8 from the beginning of the file. Version (ANSI and UNICODE) information is located at the offset of 10 from the beginning of the file. Hex value (0x17) specifies Unicode OST and 0x0E or 0x0F specifies ANSI file format.
| Fields | Description |
|---|---|
| dwMagic (4 bytes) | Must be “{ 0x21, 0x42, 0x44, 0x4E } ("!BDN”)” |
| dwCRCPartial (4 bytes) | The 32-bit CRC value of the 471 bytes of data starting from wMagicClient (0ffset 0x0008) |
| wMagicClient (2 bytes) | MUST be “{ 0x53, 0x4D }". |
| wVer(2 bytes) | File format version. This value MUST be 14 or 15 for ANSI PST and 23 for Unicode PST file. |
| wVerClient (2 bytes) | Client file format version. The version that corresponds to the format de in this document is 19. Creating a new PST file based on this document should start with value to 19. |
| bPlatformCreate (1 byte) | This value MUST be set to 0x01. |
| bPlatformAccess (1 byte) | This value MUST be set to 0x01. |
| dwReserved (8 bytes) | |
| bidUnused (8 bytes Unicode only) | Unused padding added when the Unicode PST file format was created. |
| bidNextP(Unicode: 8byte and ANSI-4 bytes) | Next page BID. Pages having a special counter for allocating bidIndex values. The value for bidIndex for BIDs for pages is provide from this counter. |
| bidNextB (4 bytes ANSI only) | Next BID. This value is the monotonic counter that represents the BID to be assigned for the next allocated block. BID values advance in increments of 4. For more details, see section 2.2.2.2. |
| dwUnique (4 bytes) | This is a monotonically-increasing value that is altered every time the HEADER structure of PST file is altered. The working of this value is to provide a unique value, and to ensure that the HEADER CRCs are different after each header modification |
| rgnid[] (128 bytes) | A fixed array of 32 NIDs, each corresponding to one of the 32 possible NID_TYPEs (NID_TYPE, NID_TYPE_NORMAL_FOLDER, NID_TYPE_SEARCH_FOLDER, NID_TYPE_NORMAL_MESSAGE,NID_TYPE_ASSOC_MESSAGE) |
| qwUnused (8 bytes) | Unused space; MUST be set to zero. Unicode PST file format only. |
| root(Unicode OST -72 bytes and ANSI- 40 bytes) | A ROOT structure (section 2.2.2.5) |
| dwAlign (4 bytes) | Unused alignment bytes; MUST be set to zero. Unicode PST file format only. |
| rgbFM (128 bytes) | Deprecated FMap. This is no longer used and MUST be filled with 0xFF. Readers SHOULD ignore the value of these bytes. |
| rgbFP (128 bytes) | Deprecated FPMap. This is no longer used and MUST be filled with 0xFF. Readers SHOULD ignore the value of these bytes. |
| bSentinel (1 byte) | MUST be set to 0x80. |
| bCryptMethod (1 byte) | Shows how the data within the PST file is encoded. MUST be set to any of the pre-defined values (NDB_CRYPT_NONE, NDB_CRYPT_PERMUTE, NDB_CRYPT_CYCLIC). |
| rgbReserved (2 bytes) | Reserved; MUST be set to zero. |
| bidNextB (8 bytes) | Represents the next available BID value. Unicode PST file format only. |
| bidNextB (Unicode ONLY: 8 bytes) | Next BID. This value is the monotonic counter that indicates the BID to be assigned for the next allocated block. BID values advance in increments of 4. For more details, see section 2.2.2.2. |
| dwCRCFull (4 bytes) | The 32-bit CRC value of the 516 bytes of data starting from wMagicClient to bidNextB, inclusive. Unicode PST file format only. |
| ullReserved (8 bytes) | Reserved; MUST be set to zero. ANSI PST file format only. |
| dwReserved (4 bytes) | Reserved; MUST be set to zero. ANSI PST file format only. |
| rgbReserved2 (3 bytes) | |
| bReserved (1 byte) | |
| rgbReserved3 (32 bytes) |