Table of Contents
Viewing an Outlook PST file In HEX Editor is a great experience of its own so as to watch what lies beneath those good formatted Outlook Personal folders. Though PST file is not that good looking in HEX but what it reveals to a programmer or any techie with its glimpse is just can't explained.
Video to Open, View and Verify PST File in HEX
PST Structures to which you get insights with HEX are:
Outlook Personal folders Header part (Table of Contents (TOC), ANSI/Unicode information and meta data, information to access NDB layer data structures).
PST Data Part (Emails, calendars, Tasks, Lists, Journals, Contacts, etc)
Steps to view Outlook PST file in HEX are:
Download any HEX viewer of your choice. The one I am using here is i.Hex which is small and free graphical HEX Editor for Windows platform.
Okay, so install i.Hex which requires a couple of clicks on your part. Go to Start and choose i.Hex application from program's menu and bingo a text editor like view opens before you.
- Look for File menu (Top left corner of screen) and choose "Open" there under.
- Browse for Outlook PST file (outlook.pst by default).
- Default Outlook PST location is Outlook Installation Drive:\Documents and Settings\Current logged in User\Local Settings\Application Data\Microsoft\Outlook\outlook.pst
- It is recommended to make of copy of Outlook PST file and then open it within HEX as editing file in HEX requires careful file handling missing which render you with corrupt Outlook PST file which probably you can't afford.
- Okay; making copy and opening PST file in Outlook presents you with a numeric view of Outlook PST file. Don't be scared with that. By the end of this tutorial you will know how you can sufficiently use any file in HEX.
Knowing Your HEX Editor
HEX view has three columns as shown.
- Column 1: Word Storage Offset
- Column 2: HEX encoded PST Header and data part
- Column 3: Characters corresponding to HEX values
Quick Steps to Learn HEX
At first storage Offset is in HEX. Unmark HEX as shown and storage offset will present itself in Decimal format.
Select any HEX value and and its corresponding character on right hand side also selected. Some characters are shown as dots as they are special characters and can't be rendered within ASCII.
If your machine is Intel built then make sure to have Little Endian (Intel) selected for that. For IBM machine unmark it to open HEX view in Big Endian mode.
Marking Signed takes each major digit (first digit from left when transformed to binary) of HEX value either as positive or negative depending if major digit is 1 or 0 respectively.
Visualize helps you define your own C language structures.
Play with PST file in HEX
Verify PST file in HEX
Notice above that PST structure in HEX is started with bytes like 21 42 44 4E. It is the PST signature and you will find each healthy Outlook PST file starting with same series of bytes.
Scroll down PST file a bit, delete some of the bytes, modify some characters, save down as separate PST and try to import it in Outlook. Do anything but remember to have backup copy of original PST file first. Let's go!!
