ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.
Outlook Express Database (DBX)
OE5 DBX files start with hexadecimal: 0xcf 0xad 0x12 0xfe. For now it is assumed that this is the file signature. It is followed by a content class identifier (CLSID), which is unique for the type of DBX file.
Although DBX probably contains a minor/major version (offset: 20 and 24) until now it is unknown how it affects the file type.
The contents of a DBX file is dependent on the content CLSID.
- Message Database (CLSID: 6F74FDC5-E366-11d1-9A4E-00C04FA309D4)
- Folder Database (CLSID: 6F74FDC6-E366-11d1-9A4E-00C04FA309D4)