MSG File Documentation

---

Technical details

Feature	Value
Full name	Outlook Item (.msg) File
File extension	.msg
MIME type	application/vnd.ms-outlook
Format type	Proprietary binary — Compound File Binary (OLE structured storage)
Developer	Microsoft
Introduced	Late 1990s, with Microsoft Outlook
Specification	[MS-OXMSG] Outlook Item (.msg) File Format
Open standard	No (format documented publicly)
Container base	Compound File Binary (same family as legacy .doc/.xls)
Byte order	Little-endian
Magic number	D0 CF 11 E0 A1 B1 1A E1 at offset 0
Holds	One item (email, appointment, contact or task)
Data model	MAPI properties stored as named streams and storages
Property stream prefix	__substg1.0_
Body formats	Plain text, HTML and/or RTF, each in its own stream
Attachments	Each in its own embedded storage
Open sibling format	.eml (MIME, single message)
Mailbox stores	.pst, .ost (many items, not one)
Related extensions	.eml, .pst, .ost, .oft, .mbox
Specification URL	learn.microsoft.com/.../ms-oxmsg

What is a MSG file?

A MSG file is Microsoft Outlook’s format for a single saved item, usually an email, but it can also be a calendar appointment, a contact or a task dragged out of Outlook. You create one by dragging a message from Outlook onto the desktop, or with File > Save As from an open message. The extension has been part of Outlook since the late 1990s, and Microsoft documents its internal layout publicly as [MS-OXMSG], which is why third-party viewers can read it. Its MIME type is application/vnd.ms-outlook.

The key technical point is that a .msg is not plain text. Unlike the open EML format, which is a readable MIME message, a .msg is a binary Compound File Binary, the same OLE structured-storage container family as legacy .doc and .xls. The message’s subject, addresses, bodies and attachments are stored as separate internal streams inside that container. The sections below cover the container signature, how the internal storage tree is organised, how MAPI properties map to stream names, how attachments are embedded, and how .msg differs from EML and from the PST/OST mailbox stores.

The Compound File Binary container

Every .msg begins with the same 8-byte signature at offset 0: D0 CF 11 E0 A1 B1 1A E1. Those bytes identify the Microsoft Compound File Binary format (historically called OLE2 structured storage). The format is essentially a small file system inside a single file: it defines storages, which behave like folders, and streams, which behave like files, arranged in a tree. A reader navigates that tree the way it would a directory, opening named streams to read their contents. This is the same container used by .doc, .xls and .ppt from the pre-2007 Office era, so a generic compound-file library can list the structure of a .msg even if it knows nothing about email.

All numeric values in the container are little-endian. Because the payload is held in these binary streams rather than as text, renaming a .msg to .txt produces unreadable output, a frequent point of confusion for people who expect it to behave like the plain-text EML format. To read a .msg you need a program that understands the storage tree and the property naming described next.

MAPI properties and the __substg1.0_ stream names

Outlook is built on MAPI (the Messaging Application Programming Interface), and a .msg is essentially a serialisation of an item’s MAPI properties. Each property has a 16-bit property ID and a 16-bit type. Fixed-size properties (integers, dates, booleans) are packed together in a single __properties_version1.0 stream, while each variable-length property (strings, binary blobs) gets its own stream whose name encodes the property tag.

The naming rule is precise: a variable-length property is stored in a stream called __substg1.0_ followed by the 8-hex-digit property tag, which is the property ID concatenated with the type. So the subject line, whose property is PidTagSubject (ID 0x0037) stored as a Unicode string (type 001F), lives in the stream __substg1.0_0037001F.

Property	Stream name	Holds
PidTagSubject	__substg1.0_0037001F	the subject line
PidTagBody	__substg1.0_1000001F	the plain-text body
PidTagHtml	__substg1.0_10130102	the HTML body (binary)
PidTagSenderName	__substg1.0_0C1A001F	the sender’s display name

The type suffix tells the reader how to interpret the bytes: 001F is a Unicode (UTF-16LE) string, 001E an ANSI string, and 0102 a binary blob. A .msg can hold the body in several forms at once, plain text in one stream, HTML in another and RTF in a third, so a viewer chooses whichever it prefers to display.

Recipient and attachment sub-storages

Recipients and attachments are not single streams but their own sub-storages, because each is a small collection of properties in its own right. Every recipient (a To, Cc or Bcc entry) is stored in a numbered storage named __recip_version1.0_#XXXXXXXX, and inside it the recipient’s display name and email address sit in the same __substg1.0_ property streams described above, just scoped to that sub-storage.

Attachments follow the same pattern in storages named __attach_version1.0_#XXXXXXXX. Each attachment storage holds the file name in a property stream and the raw file bytes in the __substg1.0_37010102 stream (PidTagAttachDataBinary). A viewer “extracts” an attachment simply by reading that binary stream out to disk. An attachment can itself be an embedded message, in which case its data is not a flat blob but a nested compound-file storage, an entire .msg tree inside the parent, which is how forwarded emails carry their originals intact.

MSG versus EML, and versus PST/OST

Two comparisons clear up most confusion about where .msg sits. First, .msg against EML. Both hold exactly one message, but EML is the open internet standard: a plain-text MIME file (as defined by the email RFCs) that almost any mail program opens, and that you can read in a text editor. MSG is Outlook’s proprietary binary equivalent. That difference is why converting MSG to EML is the standard move for portability, done with msgconvert on Linux and macOS, with Thunderbird plus the ImportExportTools NG add-on, or with dedicated viewers.

Second, .msg against .pst and .ost. Those are mailbox stores: a single PST or OST holds many messages across many folders (an entire mailbox or its offline cache), whereas a .msg holds one item. You do not really convert a .msg to a PST; you import the message into Outlook, which writes it into a PST. So the natural conversions from a single .msg are to EML for portability or to PDF for archiving and records, not to the mailbox-store formats.

References

• Microsoft — [MS-OXMSG]: Outlook Item (.msg) File Format
• Mozilla Thunderbird — official site
• msgconvert (Email::Outlook::Message) — MSG to EML

Feedback

Was this page helpful?

Yes No

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.